Introduction
New to Security Onion? Here's a short FAQ from Brad Shoop:What is Security Onion?
Security Onion is a network security monitoring system that provides full context and forensic visibility into the traffic it monitors. At it's heart it is designed to make deploying multiple complex open source tools simple via a single package, reducing what would normally take days to weeks of work to minutes. Featuring Bro IDS, your choice of Snort or Suricata, Sguil analyst console, ELSA, Squert, Snorby and capME web interfaces, and the ability to pivot from one tool to the next seamlessly provides the most effective collection of network security tools available in a single package.
What can it do for you?
- Signature-based detection - Whether you choose Snort or Suricata for signature-based detection, you'll have Snort and/or Emerging Threats signatures available for use.
- Context - Bro IDS provides visibility into the haystack, while signature-based detection targets the needle. Now you can know not only what signature-based events occurred, but you can have full context of all activity detected from the host involved. What domains a host queries, SSL certificates it's used, files downloaded, FTP/SMTP/IRC activity? All contextual questions that can help determine whether a signature-based alert is an event or an incident.
- Evidence - Full packet capture means you can know exactly what a host did. Sguil and its integration with other tools in Security Onion, such as Network Miner and Wireshark in addition to ELSA, Squert and Snorby via capME, allow an analyst to look at the evidence of a network attack frame by frame exactly as it happened, all with a click of a mouse.
- Tools - Security Onion is loaded with tools to monitor your network efficiently and effectively. Sguil provides the best security analyst console available in terms of function and utility. Squert and Snorby provide visibility into Sguil and Snort respectively, and ELSA provides a Splunk-like interface to the vast wealth of log data Security Onion will harvest from Bro, OSSEC and more.
- Save Money - It's free, well except for the hardware. But it will help you save a lot of money you might otherwise throw at commercial solutions and you could maybe spend some of that money so your analysts can become better.
What can't it do for you?
Security Onion is a network monitoring and detection system. It will not block an attack, nor is it designed to. It will however act as a video camera for your network for every connection it sees, not just the one's that it thinks are bad. In a world where detection rates are unpredictable, evidence like this can save you a lot of money.
Changes
No major changes since we announced RC1 and the ISO image, just a few small bug fixes:- Setup no longer disables NIC offloading features on management interface
- Setup now disables the IPv6 stack on sniffing interfaces (can still sniff IPv6, though)
- if running Quick Setup, netsniff-ng is started with "-c" option to disable scatter/gather mode and force traffic to be written to disk instantly
Instructions
For full instructions on installing Security Onion 12.04, please see the installation page on our Wiki.Screenshots
 |
| Booting ISO image |
 |
| Booted into Live desktop, starting Xubuntu installer |
 |
| Started Xubuntu installer |
 |
| Completed Xubuntu installer, ready to reboot into new installation |
 |
| Rebooted into new installation, ready to run Setup |
 |
| Started Setup Wizard |
 |
| Configuring /etc/network/interfaces |
 |
| Selecting management interface |
 |
| Selecting DHCP for this test VM |
 |
| Selecting sniffing interfaces |
 |
| Confirming network interface configuration, ready to reboot |
 |
| Rebooted and ready to do the second phase of Setup |
 |
| Started Setup Wizard |
 |
| Setup detects that network interfaces have already been configured |
 |
| Choosing Quick Setup for this test VM |
 |
| Selecting interface to run sniffing processes on |
 |
| Setting username for Sguil/Squert/ELSA |
 |
| Setting email address for Snorby |
 |
| Setting password for Sguil/Squert/Snorby/ELSA |
 |
| Confirming password |
 |
| Optionally enabling ELSA |
 |
| Confirming selections |
 |
| Setup wizard performs all configuration automatically |
 |
| Setup Complete #1 |
 |
| Setup Complete #2 |
 |
| Setup Complete #3 |
 |
| Replaying sample pcaps to simulate network traffic |
 |
| Logging into Snorby |
 |
| Snorby Dashboard |
 |
| Pivoting from IDS alert in Snorby to Full Transcript |
 |
| Viewing full transcript in CapME |
 |
| Logging into Squert |
 |
| Squert Dashboard |
 |
| Squert Signature Statistics |
 |
| Squert GeoIP |
 |
| Squert events |
 |
| Logging into Sguil |
 |
| Sguil RealTime Console |
 |
| Sguil pivoting from IDS alert to full transcript |
 |
| Logging into ELSA |
 |
| ELSA query for Bro Notices |
 |
| ELSA pivoting from Bro notice to full transcript |
 |
| Full transcript in CapME |
