Security Onion

Suricata 1.4.2 was recently released: http://suricata-ids.org/2013/05/29/suricata-1-4-2-released/ I've packaged Suricata 1.4.2 and it...

PF_RING 5.5.3 was recently released: http://www.ntop.org/pf_ring/pf_ring-5-5-3-released/ I've packaged PF_RING 5.5.3 and the packages...

Previously, when a user ran Setup and enabled ELSA, they would be able to log into ELSA and view OSSEC *archive* logs (the raw logs received...

Under certain conditions, some Sguil agents may fail to reconnect to sguild properly.  I've added daily cronjobs to /etc/cron.d/sensor-n...

Snorby 2.6.2 was recently released: https://github.com/Snorby/snorby/blob/master/ChangeLog.md I've packaged Snorby 2.6.2 and the new ...

Snort 2.9.4.6 was recently released: http://blog.snort.org/2013/04/snort-2946-has-been-released.html I've packaged Snort 2.9.4.6 ...

Mark Hillick put together some pcap samples (thanks Mark!) and I've put them into a new package called securityonion-samples-markofu.  ...

Richard Bejtlich put together some pcap samples (thanks Richard!) and I've put them into a new package called securityonion-samples-pns...

I'll be speaking on "Enterprise Log Collection and Analysis using Security Onion, OSSEC, and ELSA" at the Augusta Linux User G...

A new Setup package is now available that avoids a bug when monitoring multiple interfaces . When you choose Advanced Setup, the Bro CPU Cor...

Scott Runnels has been hard at work updating our ELSA packages and building our own custom Sphinx package!  These new packages should reso...

Ubuntu recently released updated MySQL packages.  As a reminder, please follow the instructions at the following link to avoid any issues wi...

I've packaged a new version of netsniff-ng that allows for dropping privileges to a non-root user and I've updated the NSM scripts ...

Snort 2.9.4.1 was recently released: http://blog.snort.org/2013/03/snort-2941-has-been-released.html I've packaged Snort 2.9.4.1 and ...

Suricata 1.4.1 was recently released: http://suricata-ids.org/2013/03/08/suricata-1-4-1-released/ I've packaged Suricata 1.4.1 and i...

I've packaged a new version of PRADS which changes the way that byte counts are reported.  PRADS will now report total IP bytes, which m...

PF_RING 5.5.2 was recently released: http://www.ntop.org/pf_ring/pf_ring-5-5-2-released/ I've packaged PF_RING 5.5.2 and the packages...

An issue was recently discovered in Bro 2.1 when monitoring multiple interfaces with PF_RING that could result in traffic loss.  This issue...

I've updated our NSM scripts to resolve the following issues: Issue 292 : Need cronjob to reload syslog-ng at midnight Issue 295 : In...

Seth Hall wrote a great Bro module  based on the recent Mandiant APT1 report .  Here are some quick instructions for loading the module on ...

Snorby 2.5.6 was recently released to fix a vulnerability: https://github.com/Snorby/snorby/blob/master/ChangeLog.md I've packaged S...

Snorby 2.5.4 was recently released with some vulnerability fixes: https://github.com/Snorby/snorby/blob/master/ChangeLog.md I've pac...

UPDATE 2013-10-05: See the updated version of this blog post here: http://securityonion.blogspot.com/2013/10/got-dns-visibility.html The...

Introduction New to Security Onion?  Here's a short FAQ from  Brad Shoop : What is Security Onion? Security Onion is a netwo...