Security Onion

Thursday, March 19, 2020

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion226 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion226 is now available for Security Onion and should resolve the following issue:

NSM: add ability to pin snort via IDS_LB_CPUS #1729
https://github.com/Security-Onion-Solutions/security-onion/issues/1729

You can read more about this new capability here:
https://securityonion.readthedocs.io/en/latest/performance.html#cpu-affinity-pinning

Thanks
Thanks to Pete Nelson for submitting the Pull Request!
Thanks to Bryant Treacle for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support? Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion. For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://securityonionsolutions.com

Thanks!

Wednesday, March 18, 2020

Elastic 6.8.7 now available for Security Onion!

The following updates are now available for Security Onion!

Elastic 6.8.7 Docker images
securityonion-elastic - 20190510-1ubuntu1securityonion87

These updates should resolve the following issues:

Elastic 6.8.7 #1728
https://github.com/Security-Onion-Solutions/security-onion/issues/1728

securityonion-elastic: adjust bro_notice parsing #1724
https://github.com/Security-Onion-Solutions/security-onion/issues/1724

securityonion-elastic: check ingest geoip fields #1725
https://github.com/Security-Onion-Solutions/security-onion/issues/1725

so-import-pcap: support paths with spaces #1714
https://github.com/Security-Onion-Solutions/security-onion/issues/1714

so-import-pcap: enable file-extraction #1715
https://github.com/Security-Onion-Solutions/security-onion/issues/1715

securityonion-elastic: change template name in 9002_output_import.conf #1723
https://github.com/Security-Onion-Solutions/security-onion/issues/1723

securityonion-elastic: logstash custom config should get copied for LOGSTASH_MINIMAL #1719
https://github.com/Security-Onion-Solutions/security-onion/issues/1719

Thanks
Thanks to the Elastic team for Elastic 6.8.7!
Thanks to Wes Lambert and Bryant Treacle for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support? Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion. For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://securityonionsolutions.com

Thanks!

Tuesday, March 17, 2020

Suricata 4.1.7 now available for Security Onion!

securityonion-suricata - 4.1.7-1ubuntu1securityonion1 is now available for Security Onion and should resolve the following issue:

Suricata 4.1.7 #1720
https://github.com/Security-Onion-Solutions/security-onion/issues/1720

Thanks
Thanks to the Suricata team for Suricata 4.1.7!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support? Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion. For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://securityonionsolutions.com

Thanks!

Zeek 3.0.3 now available for Security Onion!

The following updates are now available for Security Onion!

securityonion-bro - 3.0.3-1ubuntu1securityonion1 (Zeek 3.0.3)
securityonion-bro-afpacket - 1.3.0-1ubuntu1securityonion21
securityonion-bro-scripts - 20121004-0ubuntu0securityonion104
securityonion-samples-bro - 20170824-1ubuntu1securityonion6

These updates should resolve the following issues:

Zeek 3.0.3 #1726
https://github.com/Security-Onion-Solutions/security-onion/issues/1726

securityonion-samples-bro: symlink /opt/samples/zeek to /opt/samples/bro #1727
https://github.com/Security-Onion-Solutions/security-onion/issues/1727

Thanks
Thanks to the Zeek team for Zeek 3.0.3!
Thanks to Pete Nelson and Wes Lambert for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support? Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion. For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://securityonionsolutions.com

Thanks!

Tuesday, March 10, 2020

Security Onion at SCALE 18X

Thanks to SCALE 18X for the invitation to speak about Security Onion and thanks to all of those who attended the talk!

For those who weren't able to attend, check out the recording:

Monday, March 2, 2020

Fourth Edition of Security Onion Documentation printed book now available!

Many folks have asked for a printed version of our official online documentation and we're excited to provide that! Whether you work on airgapped networks or simply want a portable reference that doesn't require an Internet connection or batteries, this is what you've been asking for.

Thanks to Richard Bejtlich for writing the inspiring foreword!

Proceeds go to the Rural Technology Fund!

This fourth edition has been updated for our latest ISO image release and includes a 10% discount code for our online training!

This book covers the following Security Onion topics:

Getting Started
Analyst Tools
Network Visibility
Host Visibility
Elastic Stack
Updating
Customizing for your Environment
Tuning
Tricks and Tips
Services
Utilities
Help
Integrations

Q&A

What is the difference between this book and the online documentation?

This book is the online documentation formatted specifically for print. It also includes an inspiring foreword by Richard Bejtlich that is not available anywhere else! Proceeds go to the Rural Technology Fund! Finally, the printed book includes a 10% discount code for our online training.

Who should get this book?

You should get this book if you work on airgapped networks or simply want a portable reference that doesn't require an Internet connection or batteries! Also anyone who wants to donate to a worthy cause like Rural Technology Fund!

How often will the book be updated?

Currently, we plan to release a new edition of the book every time we release a new version of our ISO image.

What is the difference between this edition and the previous edition?

This edition has been updated for our latest ISO image release!

Where do we get it?

The following URL will always take you to the latest version of the printed book at Amazon:
https://securityonion.net/book

Tuesday, February 18, 2020

Security Onion 16.04.6.4 ISO image now available featuring Zeek 3.0.1, Suricata 4.1.6, Snort 2.9.15.1, Elastic 6.8.6, CyberChef 9.12.0, and more!

Our Security Onion 16.04.6.4 ISO image is now available!

Security Onion 16.04.6.4 boot menu

Major Changes Since Last ISO Image

Zeek 3.0.1
Suricata 4.1.6
Snort 2.9.15.1
Elastic 6.8.6
CyberChef 9.12.0

Thanks
Thanks to the following for testing this ISO image!
Bryant Treacle
Josh Brower
Wilk4013

Package Updates
This release also includes the following updated packages:
pinguybuilder - 20180514-1ubuntu1securityonion21
securityonion-iso - 20151016-1ubuntu1securityonion34

These packages resolve the following issues:

pinguybuilder: increment version to 16.04.6.4 #1701
https://github.com/Security-Onion-Solutions/security-onion/issues/1701

Build 16.04.6.4 ISO image #1704
https://github.com/Security-Onion-Solutions/security-onion/issues/1704

Issues Resolved
For a list of all issues resolved in this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/projects/10

Release Notes
For more information about this release, please see:
https://securityonion.net/docs/release-notes.html

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://securityonion.net/docs/installation.html

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image. You can simply continue using our standard update process to install updated packages as they are made available:
https://securityonion.net/docs/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://securityonion.net/docs/upgrading-from-14.04-to-16.04.html

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Support
Need support? Please see:
https://securityonion.net/docs/Support

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes. We also offer online classes as well. For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://securityonionsolutions.com

Screenshot Tour