Security Onion

One of my SANS 503 Mentor students has started his own blog. Check it out at: http://detroitdavesraves.blogspot.com/

At work, one of our remote business units was experiencing slowness in their WAN link. Our Network Architect began looking into the problem...

My SANS GCIA Gold Paper on Snort 3.0 Beta 3 has been posted to the SANS Reading Room!

Wireshark 1.0.7 has been released. Please upgrade ASAP! For more information about the release, please see: http://www.wireshark.org/docs/...

Snort 2.8.4 has been released. From http://www.snort.org/pub-bin/snortnews.cgi#864 : Snort 2.8.4 is now available on snort.org, at http://w...

To complete the updating of my 3-part series on Installing and Configuring Snort 3 Beta 3, I now present to you the final chapter in this tr...

Since I updated the " Installing Snort 3.0 Beta on Ubuntu 8.04 " post to work with Snort 3.0 Beta 3, here's the update for the...

Snort 3.0 Beta 3 was released on April 1. You can read an overview of the changes in Snort 3.0 Beta 3 in the mailing list announcement . ...

One of the many interesting new features in Snort 3.0 (SnortSP) is the ability to run in inline bridging mode. Step 1: Add a new function t...

So once you have Snort 3.0 installed , what can you do with it? One thing you can do with it (and the one that most people are interested in...

Here's a really quick recipe for installing the Snort 3.0 Architecture on Ubuntu 8.04. Note that the Snort 3.0 Architecture consists of ...

I previously discussed the NSMnow project . These guys have made tremendous progress in the last few weeks and have fixed the bugs that I ...

Registration is now closed for the previously mentioned SANS 503 Mentor class here in Augusta . This was the first SANS Mentor class to sel...

If you're about to take SANS 503 and it's been a while since you've had to deal with the world of binary and hex, here are a fe...

Have you ever been in a situation where you needed to calculate multiple hashes (md5 and sha1, for example) of a large drive image, but you ...

SANS is researching how organizations handle log management. Please take 5 minutes out of your day and complete the following survey (I di...

We have less than 2 weeks to go before the January 20 deadline for the best deal on SANS 503 Intrusion Detection training here in Augusta! ...

A few months ago, I upgraded from Fedora 8 to Fedora 9 using Preupgrade . Last night, I decided it was time to upgrade to Fedora 10 (F10), ...

I mentioned in my last post that I'm using NSMnow to install Barnyard2, SANcp, Snort, and Sguil in my Security Onion LiveCD . The NSM...

In my last post , I mentioned that I was working on integrating BASE into the Security Onion LiveCD . I chose BASE because I wanted a quick...

I'm currently working on integrating Barnyard and BASE into the Security Onion LiveCD . After generating a new ISO and booting it up,...

In the past, I've upgraded to the latest Fedora version by using the unsupported "yum upgrade" . This is potentially dangerou...

As I mentioned previously , I'm currently working on the Security Onion LiveCD. I started building custom LiveCDs years ago by going th...

As part of my GCIA Gold research paper, I'm building a security LiveCD based on Ubuntu 8.04 . The Security Onion LiveCD includes both S...

Starting in February, I'll be mentoring SANS 503: Intrusion Detection In-Depth . This class is extremely valuable for those who work w...

Back in April, I traveled to Orlando and took SANS 503 from the amazing Mike Poor . I then spent the next few months reviewing the course ...

Onions have layers...good security has layers. Onions smell bad...quite often, security stinks. Onions make you cry...poor security can make...