Security Onion

Security Onion 20111130 is now available!  This resolves the following issue: Issue 14 4  - sguild.email configuration not loading pr...

A few quick notes on the Suricata 1.1 update  and its default suricata.yaml configuration file: decoder-events.rules and stream-events.rul...

Security Onion 20111127 is now available!  This resolves the following issues: Issue 134 - Upgrade Suricata to 1.1 Issue 153 -  Whe...

This is a follow-up to my recent post " How do I receive an email when my sensor stops receiving traffic? ".  That post explains ...

Security Onion 20111118 is now available!  This resolves the following issue: Issue 141 - Upgrade Barnyard2 New Users New users...

Security Onion 20111116 is now available!  This resolves the following issue: Issue 1 50  -  Ensure that OSSEC timezone matches the hos...

Recently, I logged into Sguil and noticed that a normally busy sensor had no current alerts.  I looked at the full packet capture logs for t...

Security Onion 20111103 is now available!  This resolves the following issues: Issue 138 - Time for a new ISO image Issue 136 - Setu...

Security Onion 20111028 is now available!   This resolves  Issue 135   by updating the NSM scripts to start Snort with the AFPACKET DA...

Security Onion 20111025 is now available!   This resolves Issue 84   by updating Snort to version 2.9.1.2 and its DAQ to version 0.6.2....

Security Onion 20111020 is now available!   This resolves Issue 133 by updating the NSM scripts to spawn daemonlogger (instead of snort)...

I was looking at some packets recently and noticed the Wireshark message "Packet size limited during capture".  This was strange s...

I'll be presenting "Security Onion: Network Security Monitoring in Minutes" at  # BSidesATL  on Friday, November 4.  For more ...

I've got a guest blog post over at PaulDotCom describing how to find evil User Agents on your network using the new httpry functionality...

Security Onion 20111013 is now available!   This simple update resolves Issue 131 . In-place Upgrade Existing Security Onion users...

Security Onion 20111001 is now available!   This simple update resolves two issues in /usr/local/bin/pulledpork_update.sh: Issue 127 r...

Security Onion 20110922 is now available!   This update resolves Issue 126 .  It also spawns instances of  httpry and  httpry_agent  for ea...