Security Onion

We have a new Security Onion 12.04.2 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of July 17, 2...

A new version of our securityonion-sguil-server package is now available that changes the CapMe web interface to render transcripts using th...

New versions of our securityonion-sguil-client and securityonion-sguil-server packages are now available that add a new "Bro" opti...

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to enable/disable s...

A new version of our securityonion-bro-scripts package is now available that extends Bro's conn.log to include the hostname and interfac...

A new version of our securityonion-sguil-db-purge package is now available that will automatically terminate any orphaned sguild processes. ...

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our defau...

Suricata 1.4.3 was recently released: http://www.openinfosecfoundation.org/index.php/component/content/article/1-latest-news/178-suricata-1...

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our defau...

Want to learn more about Security Onion?  Please make plans to attend the upcoming 8-hour class in Augusta GA on Thursday August 1, 2013! ...

A new version of our securityonion-rule-update package is now available that distributes OSSEC's local_rules.xml from master server to s...

I've patched the Sguil client to add "Copy IP Address" to the right-click context menu for IP addresses. So for example, if yo...

Want to learn more about Security Onion?  Please make plans to attend this 8-hour class in Augusta GA on Thursday August 1, 2013! More d...

Michal Purzynski fixed a bug in our securityonion-rule-update package (thanks Michal!).  The new package is now available in our stable repo...

We have a new Security Onion 12.04.1 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of June 5, 20...

We recently released PF_RING 5.5.3 packages: http://securityonion.blogspot.com/2013/05/pfring-553-packages-now-available.html Shortly aft...

Suricata 1.4.2 was recently released: http://suricata-ids.org/2013/05/29/suricata-1-4-2-released/ I've packaged Suricata 1.4.2 and it...

PF_RING 5.5.3 was recently released: http://www.ntop.org/pf_ring/pf_ring-5-5-3-released/ I've packaged PF_RING 5.5.3 and the packages...

Previously, when a user ran Setup and enabled ELSA, they would be able to log into ELSA and view OSSEC *archive* logs (the raw logs received...

Under certain conditions, some Sguil agents may fail to reconnect to sguild properly.  I've added daily cronjobs to /etc/cron.d/sensor-n...

Snorby 2.6.2 was recently released: https://github.com/Snorby/snorby/blob/master/ChangeLog.md I've packaged Snorby 2.6.2 and the new ...

Snort 2.9.4.6 was recently released: http://blog.snort.org/2013/04/snort-2946-has-been-released.html I've packaged Snort 2.9.4.6 ...

Mark Hillick put together some pcap samples (thanks Mark!) and I've put them into a new package called securityonion-samples-markofu.  ...

Richard Bejtlich put together some pcap samples (thanks Richard!) and I've put them into a new package called securityonion-samples-pns...

I'll be speaking on "Enterprise Log Collection and Analysis using Security Onion, OSSEC, and ELSA" at the Augusta Linux User G...

A new Setup package is now available that avoids a bug when monitoring multiple interfaces . When you choose Advanced Setup, the Bro CPU Cor...

Scott Runnels has been hard at work updating our ELSA packages and building our own custom Sphinx package!  These new packages should reso...

Ubuntu recently released updated MySQL packages.  As a reminder, please follow the instructions at the following link to avoid any issues wi...

I've packaged a new version of netsniff-ng that allows for dropping privileges to a non-root user and I've updated the NSM scripts ...

Snort 2.9.4.1 was recently released: http://blog.snort.org/2013/03/snort-2941-has-been-released.html I've packaged Snort 2.9.4.1 and ...