Security Onion

Russ McRee wrote an excellent article about OSSEC for the October 2009 issue of ISSA Journal. (Disclaimer: I contributed to the article.)...

Mark Baggett posted some excellent videos at PaulDotCom showing solutions to the CSAW Exercises for a burgeoning Army of Ninjas : http://p...

I'm joining Joel Esler in a quest to help kill Adobe Flash . Go to http://www.youtube.com/html5 to use HTML5 instead of Flash in your...

SANS has a new web site for those interested in Computer Security Training: Computer Security Training

I've written about NSMnow a few times before and I'm a big fan. They already had at least partial support for Fedora and I suggeste...

I'll be mentoring SANS 401 Security Essentials in Augusta, GA on Tuesday nights starting January 12, 2010. ISSA members are eligible fo...

I've been getting more and more feedback on each successive release of the Security Onion LiveCD. Thanks to all those who've sent i...

A new version of the Security Onion LiveCD has been released! Here's the changelog: 2009/07/31: New Release! * All Xubuntu 9.04 updates...

UPDATE: This issue has been fixed in the Security Onion LiveCD 20090731 release . I was testing the new Security Onion LiveCD yesterday and...

A new version of the Security Onion LiveCD has been released! Here's the changelog: * All Xubuntu 9.04 updates as of 2009/07/24. * Adde...

From http://www.pcworld.com/article/168160/ussouth_korea_cyberattack_lessons_learned.html : "Investigators may not yet know who was be...

Announcement from SANS: "In August, SANS will be running 5 tracks in support of the US-CERT GFIRST conference taking place at the Omni ...

I'm currently working on the next version of the Security Onion LiveCD. What specific packages/features would you like to see added to ...

A new version of the Security Onion LiveCD is now available! Here's the changelog: -All Xubuntu 9.04 updates as of 2009/06/13. -Adde...

The Security Onion LiveCD is now available! You can download it from the following location: http://distro.ibiblio.org/pub/ linux/distribut...

My previous Sguil/NSMnow recipes used Ubuntu 8.04. I thought I'd play with the new Ubuntu 9.04 and see if there were any differences. ...

One of my SANS 503 Mentor students has started his own blog. Check it out at: http://detroitdavesraves.blogspot.com/

At work, one of our remote business units was experiencing slowness in their WAN link. Our Network Architect began looking into the problem...

My SANS GCIA Gold Paper on Snort 3.0 Beta 3 has been posted to the SANS Reading Room!

Wireshark 1.0.7 has been released. Please upgrade ASAP! For more information about the release, please see: http://www.wireshark.org/docs/...

Snort 2.8.4 has been released. From http://www.snort.org/pub-bin/snortnews.cgi#864 : Snort 2.8.4 is now available on snort.org, at http://w...

To complete the updating of my 3-part series on Installing and Configuring Snort 3 Beta 3, I now present to you the final chapter in this tr...

Since I updated the " Installing Snort 3.0 Beta on Ubuntu 8.04 " post to work with Snort 3.0 Beta 3, here's the update for the...

Snort 3.0 Beta 3 was released on April 1. You can read an overview of the changes in Snort 3.0 Beta 3 in the mailing list announcement . ...

One of the many interesting new features in Snort 3.0 (SnortSP) is the ability to run in inline bridging mode. Step 1: Add a new function t...

So once you have Snort 3.0 installed , what can you do with it? One thing you can do with it (and the one that most people are interested in...

Here's a really quick recipe for installing the Snort 3.0 Architecture on Ubuntu 8.04. Note that the Snort 3.0 Architecture consists of ...

I previously discussed the NSMnow project . These guys have made tremendous progress in the last few weeks and have fixed the bugs that I ...

Registration is now closed for the previously mentioned SANS 503 Mentor class here in Augusta . This was the first SANS Mentor class to sel...

If you're about to take SANS 503 and it's been a while since you've had to deal with the world of binary and hex, here are a fe...

Have you ever been in a situation where you needed to calculate multiple hashes (md5 and sha1, for example) of a large drive image, but you ...

SANS is researching how organizations handle log management. Please take 5 minutes out of your day and complete the following survey (I di...

We have less than 2 weeks to go before the January 20 deadline for the best deal on SANS 503 Intrusion Detection training here in Augusta! ...

A few months ago, I upgraded from Fedora 8 to Fedora 9 using Preupgrade . Last night, I decided it was time to upgrade to Fedora 10 (F10), ...

I mentioned in my last post that I'm using NSMnow to install Barnyard2, SANcp, Snort, and Sguil in my Security Onion LiveCD . The NSM...

In my last post , I mentioned that I was working on integrating BASE into the Security Onion LiveCD . I chose BASE because I wanted a quick...

I'm currently working on integrating Barnyard and BASE into the Security Onion LiveCD . After generating a new ISO and booting it up,...

In the past, I've upgraded to the latest Fedora version by using the unsupported "yum upgrade" . This is potentially dangerou...

As I mentioned previously , I'm currently working on the Security Onion LiveCD. I started building custom LiveCDs years ago by going th...

As part of my GCIA Gold research paper, I'm building a security LiveCD based on Ubuntu 8.04 . The Security Onion LiveCD includes both S...

Starting in February, I'll be mentoring SANS 503: Intrusion Detection In-Depth . This class is extremely valuable for those who work w...

Back in April, I traveled to Orlando and took SANS 503 from the amazing Mike Poor . I then spent the next few months reviewing the course ...

Onions have layers...good security has layers. Onions smell bad...quite often, security stinks. Onions make you cry...poor security can make...