Security Onion

After many months of hard work, I'm excited to announce that Security Onion 12.04 Beta is available now!  Thanks to everyone who has hel...

The current version of Security Onion is based on Ubuntu 10.04.   Ubuntu 12.04.1 was just released yesterday and is being offered to users ...

Dr. Johannes Ullrich of the SANS Internet Storm Center posted a  great DNS Anomaly Detection script  based on the query logs coming from his...

Security Onion 20120518 is now available!  This resolves the following issues: Issue 261: Add Mark Baggett's reassembler.py http://...

I'll be presenting Security Onion at the DC404 meeting this Saturday 5/19! Brad Shoop will also be there presenting his Splunk app fo...

Security Onion 20120511 is now available!  This resolves the following issues: Issue 205:      Bro's http.log needs to be per-interfa...

Security Onion 20120508 is now available!  This resolves the following issue: Issue 239: autossh tunnel from sensor to server needs to be ...

Security Onion 20120427 is now available!  This resolves the following issues: Issue 245: Snort 2.9.2.2 Issue 259: Update Security Onion ...

Security Onion 20120425 is now available!  This resolves the following issues: Issue 155: Modify Setup script so that IDS Engine choice is...

Security Onion 20120423 is now available!  This resolves the following issues: Issue 248: sostat doesn't handle single-digit date prop...

Security Onion 20120418 is now available!  This resolves the following issue: Issue 254: tcpflow 1.1.1 connection counter breaks Sguil...

Security Onion 20120412 is now available!  This resolves the following issues: Issue 226: Rename bro workers Issue 255: Add /etc/cron.d/n...

Security Onion 20120405 is now available!  This resolves the following issue: Issue 219: Default Web page Notes After this upgrade, you...

Security Onion 20120329 is now available!  This resolves the following issues: Issue 114: Provide single location for configuring BPF fil...

Security Onion 20120326 is now available!  This resolves the following issues: Issue 197: Snort 2.9.2.1 Issue 218: /etc/nsm/gen-msg.map ...

Security Onion 20120321 is now available!  This resolves the following issues: Issue 237: Snorby 2.5.1  - This is a bugfix release.  It f...

I spent some time this morning creating and updating several pages on the Security Onion Wiki : Installation Procedure http://code.googl...

Security Onion 20120312 is now available!  This resolves the following issues: Issue 233: Snorby 2.5.0 Our original Snorby package ...

Ubuntu just released new MySQL packages.  A few things to be aware of for Security Onion users: The update will stop MySQL in order to pe...

SANS is coming to Augusta GA in June!  Doug Burks will be teaching SANS SEC503: Intrusion Detection In-Depth and Mark Baggett will be teachi...

Security Onion 20120229 is now available!  This resolves the following issues: Issue 220: Add mon to /usr/local/bin/setup Issue 231: Sno...

Problem #1 Suppose you're monitoring traffic that has VLAN tags (in both directions).  By default, when you right-click the Alert ID ...

Security Onion 20120222 is now available!  This resolves the following issues: Issue 199: Snorby dashboard not updating New Users New ...

I really like having byobu configured for all my Security Onion SSH sessions, as it gives lots of good health/status information about the s...

Security Onion 20120202 is now available!  This resolves the following issues: Issue 195: Update nsm scripts to not create /etc/nsm/HOSTN...

Only 2 days left to vote for 2011 Toolsmith Tool of the Year!  If you're a fan of Security Onion, please vote! http://holisticinfosec.b...

Security Onion 20120125 is now available!  This resolves the following issues: Issue 203: New users should have a more sensible default fo...

I'll be giving a Shmoocon Firetalk on Saturday 1/28 at 7:40 PM: http://www.novainfosecportal.com/2012/01/25/shmoocon-2012-firetalks-%E...

Last year, I received a few success stories from satisfied Security Onion users: http://securityonion.blogspot.com/2011/05/security-onion-s...

Security Onion 20120124 is now available!  This resolves the following issue: Issue 140: OSSEC agent needs to be integrated into NSM scrip...