New NSM and Setup packages allow you to enable/disable sensor services

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to enable/disable sensor services.  When you run Setup, choosing "Quick Setup" will still default to running all sensor services, but if you choose "Advanced Setup", you'll be prompted to select which sensor processes to enable/disable:

IDS Engine

Bro

http_agent

Argus 

Prads

Full Packet Capture

Your choices are then written into configuration files as follows:

/etc/nsm/securityonion.conf

BRO_ENABLED=yes

/etc/nsm/HOSTNAME-INTERFACE/sensor.conf

PCAP_ENABLED="yes"
PCAP_AGENT_ENABLED="yes"
SNORT_AGENT_ENABLED="yes"
IDS_ENGINE_ENABLED="yes"
BARNYARD2_ENABLED="yes"
PRADS_ENABLED="yes"
SANCP_AGENT_ENABLED="yes"
PADS_AGENT_ENABLED="yes"
ARGUS_ENABLED="yes"
HTTP_AGENT_ENABLED="yes"

Disabling Services after Setup

If you've already run Setup and want to disable a certain sensor service, you can simply stop the running service and then change the corresponding config value from "yes" to "no" to prevent it from restarting the next time the NSM scripts are run.

For example, suppose you access Bro's HTTP logs via ELSA, so you want to disable http_agent to prevent those HTTP logs from being duplicated into the Sguil database.  You would first stop the running http_agent service:

sudo nsm_sensor_ps-stop --only-http-agent

You would then edit /etc/nsm/HOSTNAME-INTERFACE/sensor.conf and change:

HTTP_AGENT_ENABLED="yes"

to:

HTTP_AGENT_ENABLED="no"

to prevent http_agent from restarting the next time the NSM scripts are run.  A quick way to do this for all /etc/nsm/*/sensor.conf files on one box is to use the sed command as follows:

sudo sed -i 's|HTTP_AGENT_ENABLED="yes"|HTTP_AGENT_ENABLED="no"|g' /etc/nsm/*/sensor.conf

Example Screenshots

Stopping the running service

Disabling the service

Service now disabled

Issues Resolved
These updates resolve the following issues:
Issue 312: Update NSM scripts to allow $SERVICE=yes/no in securityonion.conf and/or sensor.conf
Issue 313: Update Setup so that Advanced Setup asks about enabling/disabling individual services
Issue 268: Update NSM scripts so that OSSEC and Bro sections respect --sensor-name option
Issue 351: Update /etc/init/securityonion.conf to start Xplico (controlled by user in /etc/nsm/securityonion.conf)

Thanks
Thanks to Karolis Cepulis for submitting a patch for Issue 268!
Thanks to the following for testing the new packages!
Matt Gregory
Michal Purzynski

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-bro-scripts and securityonion-capme packages

A new version of our securityonion-bro-scripts package is now available that extends Bro's conn.log to include the hostname and interface that saw the connection.  In addition, a new version of our securityonion-capme package automatically determines if you're pivoting from ELSA and, if so, queries Bro's conn.log via ELSA for the source and destination IP/port.  It then parses the hostname/interface out of the result to locate the pcap and render the transcript.  The net result of these changes is that pivoting to CapMe from ELSA no longer depends on the prads session data in the Sguil sancp table.

This update resolves the following issue:
Issue 348: Update CapME with a new option to query Bro conn.log via ELSA

Thanks
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie
Michal Purzynski

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart Bro:

sudo broctl restart

Screenshots

Upgrade Process

Restarting Bro using "sudo broctl restart"

When pivoting from ELSA, CapMe now defaults to searching ELSA instead of the sancp table

CapMe Transcript

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-sguil-db-purge package terminates orphaned sguild processes

A new version of our securityonion-sguil-db-purge package is now available that will automatically terminate any orphaned sguild processes.

This update resolves the following issue:
Issue 359: nsm_server_ps-restart --if-stale leaves orphaned sguild processes

Thanks
Thanks to David Zawdie for testing the new package!

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New NSM and Setup packages allow for changing the default 90% disk usage threshold

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our default 90% disk usage threshold.  When you run Setup, it will still default to purging old logs when disk usage hits 90%.  Choosing "Advanced Setup" will prompt you to specify your own disk usage threshold:

Advanced Setup prompts for disk usage threshold

This setting is then written into /etc/nsm/securityonion.conf as CRIT_DISK_USAGE, where it is sourced by /usr/sbin/nsm_sensor_clean when the hourly cronjob runs.

If you've already run Setup and want to change the default 90% disk usage threshold, you can simply set the value in /etc/nsm/securityonion.conf.

These updates resolve the following issues:
Issue 315: Update NSM scripts so that WARN_DISK_USAGE and CRIT_DISK_USAGE are configurable by user
Issue 358: Update Setup so that Advanced Setup asks about CRIT_DISK_USAGE

Thanks
Thanks to Karolis Cepulis for the nsm_sensor_clean patch!
Thanks to David Zawdie for testing the new package!

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training

Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!

http://securityonion.eventbrite.com/

Suricata 1.4.3 package now available

Suricata 1.4.3 was recently released:
http://www.openinfosecfoundation.org/index.php/component/content/article/1-latest-news/178-suricata-143-released

I've packaged Suricata 1.4.3 and the new package has been tested by the following (thanks!):
David Zawdie

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

The Suricata update will do the following:

• back up each of your existing suricata.yaml file(s) to suricata.yaml.bak
• update Suricata to 1.4.3

If you're running Suricata in production, then you'll need to do the following:

• apply your local customizations to the new suricata.yaml
• restart Suricata as follows:

sudo nsm_sensor_ps-restart --only-snort-alert

Upgrading Suricata

suricata -V

Update suricata.yaml file(s) and then run "sudo nsm_sensor_ps-restart --only-snort-alert"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New NSM and Setup packages allow for changing the default netsniff-ng PCAP size

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our default 150MB netsniff-ng PCAP size.  When you run Setup, it will still default to 150MB.  Choosing "Advanced Setup" will prompt you to specify your own PCAP_SIZE:

Advanced Setup prompts for PCAP size

This PCAP_SIZE option is then placed into /etc/nsm/HOSTNAME-INTERFACE/sensor.conf where it is sourced by the NSM scripts when they start netsniff-ng.

If you've already run Setup and want to change the default 150MB PCAP size, you can add the PCAP_SIZE option to /etc/nsm/HOSTNAME-INTERFACE/sensor.conf.  Please note that netsniff-ng accepts the following units for PCAP_SIZE:
KiB
MiB
GiB

So if you want to increase your PCAPs to 500MB, you would add the following option to /etc/nsm/HOSTNAME-INTERFACE/sensor.conf:
PCAP_SIZE=500MiB

Then restart netsniff-ng as follows:

sudo nsm_sensor_ps-restart --only-pcap

Also, I've seen some intermittent cases where pcap_agent fails to start right after running Setup, so I've added a 5-second delay between starting netsniff-ng and starting pcap_agent to help ensure that netsniff-ng is fully initialized.

These updates resolve the following issues:
Issue 341: nsm_sensor_ps-start needs "sleep 5s" between netsniff-ng and pcap_agent
Issue 314: Update NSM scripts so that netsniff-ng pcap size is configurable by user

Thanks
Thanks to JP Bourget for the NSM/Setup patches for setting the PCAP size!
Thanks to the following for testing the new package:
Matt Gregory
Liam Randall
David Zawdie

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

8-hour Security Onion class in Augusta GA on Thursday August 1, 2013

Want to learn more about Security Onion?  Please make plans to attend the upcoming 8-hour class in Augusta GA on Thursday August 1, 2013!  For more details and to register, please see:

http://securityonion.eventbrite.com/

New securityonion-rule-update package distributes OSSEC local_rules.xml and allows for per-sensor NIDS/HIDS rule tuning

A new version of our securityonion-rule-update package is now available that distributes OSSEC's local_rules.xml from master server to slave sensors by default and also allows for NIDS/HIDS rule tuning per physical sensor.

This update resolves the following issues:
Issue 342: Allow more granular rule tuning (per physical sensor)
Issue 325: rule-update needs to check for privileges
Issue 326: rule-update needs to check for /etc/nsm/rules/backup/
Issue 349: rule-update needs to copy OSSEC local_rules.xml from master to sensor
Issue 353: rule-update should remove unneeded messages from PulledPork output

NIDS Rules
Previously, rule-update in distributed deployments would copy NIDS rules from the master server to slave sensors but wouldn't allow you to tune the ruleset per sensor.  This new version of rule-update allows for ruleset tuning per physical sensor.  If you'd like to enable this, set the following option in /etc/nsm/securityonion.conf on the sensor:

LOCAL_NIDS_RULE_TUNING=true

The next time rule-update runs, it should copy the raw NIDS rules from the master server and run Pulledpork locally making changes to the ruleset as you've configured in /etc/nsm/pulledpork/ on the sensor itself.

HIDS Rules
Another change in this new rule-update is that OSSEC's local_rules.xml is now copied from the master server to slave sensors by default.  If local_rules.xml has changed since the previous run of rule-update, it will then automatically restart OSSEC to activate the new configuration.  If you want to tune local_rules.xml per physical sensor, set the following option in /etc/nsm/securityonion.conf on the sensor:

LOCAL_HIDS_RULE_TUNING=true

What if I've already modified OSSEC's local_rules.xml on the sensor?  Will my changes be overwritten?
If you had previously tuned OSSEC's local_rules.xml on the sensor itself and don't want those changes to be overwritten when the new version of rule-update runs, set LOCAL_HIDS_RULE_TUNING=true before upgrading the rule-update package.  If you have already upgraded rule-update without setting LOCAL_HIDS_RULE_TUNING=true, your custom local_rules.xml should have been backed up to /var/ossec/rules/local_rules_orig.xml.  You can then set LOCAL_HIDS_RULE_TUNING=true and copy /var/ossec/rules/local_rules_orig.xml to /var/ossec/rules/local_rules.xml.

Thanks
Thanks to Chris White for the granular NIDS rule tuning patch!
Thanks to the following for testing the new package:
David Zawdie
Heine Lysemose

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Github
Found bugs in rule-update or want to add new features?  rule-update is now on github:
https://github.com/Security-Onion/securityonion-rule-update

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-sguil-client package now available

I've patched the Sguil client to add "Copy IP Address" to the right-click context menu for IP addresses. So for example, if you find an interesting IP address in Sguil and want to search ELSA for that IP address, you can just right-click the IP address, select "Copy IP Address", select "SrcIP" or "DstIP", and then alt-tab to your ELSA window and paste it in.

Copy IP Address

Thanks
The new package has been tested by the following:
David Zawdie
Heine Lysemose

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

8-hour Security Onion class in Augusta GA on Thursday August 1, 2013

Want to learn more about Security Onion?  Please make plans to attend this 8-hour class in Augusta GA on Thursday August 1, 2013!

More details (including cost, location, and registration information) will be posted here soon.  Stay tuned for details!

UPDATE 2013/06/27

Registration is now live!
http://securityonion.eventbrite.com/

New securityonion-rule-update package

Michal Purzynski fixed a bug in our securityonion-rule-update package (thanks Michal!).  The new package is now available in our stable repo.  If you're running Sourcefire VRT rules in a distributed deployment, we recommend updating to ensure that Shared Object (SO) rules get copied to your distributed sensors properly. 

Feedback

If you have any questions or problems, please use our mailing list:

https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted

If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:

https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Security Onion 12.04.1 ISO image now available

We have a new Security Onion 12.04.1 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of June 5, 2013!  It also contains the two new pcap samples packages recently released:
http://securityonion.blogspot.com/2013/05/new-pcap-samples-package-securityonion.html
http://securityonion.blogspot.com/2013/05/new-pcap-samples-package-securityonion_27.html

Changelog
For a list of all changes made since our original 12.04 ISO image was released, please see:
https://code.google.com/p/security-onion/wiki/Roadmap

New Users
I've updated the Installation guide to reflect the download locations for the new 12.04.1 ISO image:
https://code.google.com/p/security-onion/wiki/Installation

As always, please remember to verify the checksum of the downloaded ISO image using the instructions in the Installation guide.

Existing Deployments
If you have existing installations based on our original 12.04 ISO image, there is no need to download the new 12.04.1 ISO image.  You can simply continue using the standard Ubuntu package management tools to install updated packages as they are made available:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-pfring-module package now available

We recently released PF_RING 5.5.3 packages:
http://securityonion.blogspot.com/2013/05/pfring-553-packages-now-available.html

Shortly after releasing the packages, we determined that there was a bug in the kernel module.  The PF_RING team patched the kernel module and I've created a new securityonion-pfring-module package which is now available in our stable repo.

To ensure that the PF_RING kernel module is installed before any Ubuntu kernel updates, you may want to install as follows:

sudo apt-get update ; sudo apt-get install securityonion-pfring-module ; sudo apt-get dist-upgrade

For more information, please see our Upgrade page:
https://code.google.com/p/security-onion/wiki/Upgrade

The securityonion-pfring-module package will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module and insert it
• start all NSM sensor processes

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Suricata 1.4.2 package now available

Suricata 1.4.2 was recently released:
http://suricata-ids.org/2013/05/29/suricata-1-4-2-released/

I've packaged Suricata 1.4.2 and it has been tested by the following (thanks!):
David Zawdie

Upgrade Process

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get install securityonion-suricata

The Suricata update will do the following:

• back up each of your existing suricata.yaml file(s) to suricata.yaml.bak
• update Suricata to 1.4.2

If you're running Suricata in production, then you'll need to do the following:

• apply your local customizations to the new suricata.yaml
• restart Suricata as follows:

sudo nsm_sensor_ps-restart --only-snort-alert

sudo apt-get update && sudo apt-get install securityonion-suricata

suricata -V

Update suricata.yaml file(s) and then run "sudo nsm_sensor_ps-restart --only-snort-alert"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

PF_RING 5.5.3 packages now available

PF_RING 5.5.3 was recently released:
http://www.ntop.org/pf_ring/pf_ring-5-5-3-released/

I've packaged PF_RING 5.5.3 and the packages have been tested by the following (thanks!):
David Zawdie
Matt Gregory

The new packages are now available in our stable repo.  To ensure that the PF_RING kernel module is installed before any Ubuntu kernel updates, you may want to install as follows:

sudo apt-get update ; sudo apt-get install securityonion-pfring-module ; sudo apt-get dist-upgrade

For more information, please see our Upgrade page:
https://code.google.com/p/security-onion/wiki/Upgrade

The securityonion-pfring-module package will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module
• start all NSM sensor processes

Update process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New Setup package configures OSSEC to send alerts to ELSA

Previously, when a user ran Setup and enabled ELSA, they would be able to log into ELSA and view OSSEC *archive* logs (the raw logs received by OSSEC) but they wouldn't be able to view OSSEC *alerts* (created based on OSSEC's analysis of the incoming logs as configured by the OSSEC ruleset).  I've pushed a new Setup package that will configure OSSEC to send alerts to local syslog if the user enables ELSA.  The new package has been tested by Matt Gregory.  Thanks, Matt!

If you've already run Setup and would like to configure OSSEC to send alerts to ELSA, please see:
https://code.google.com/p/security-onion/wiki/OSSECalertsToELSA

Updating
If you're performing a new installation, it's important to update your packages right after you've completed the Ubuntu installer and BEFORE running Setup.  You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Upgrade Process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New NSM scripts package includes daily restart of Sguil agents

Under certain conditions, some Sguil agents may fail to reconnect to sguild properly.  I've added daily cronjobs to /etc/cron.d/sensor-newday to restart all Sguil agents to help alleviate this.

The new securityonion-nsmnow-admin-scripts package has been tested and confirmed by the following (thanks!):
David Zawdie
Matt Gregory

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Upgrade Process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Snorby 2.6.2 package now available

Snorby 2.6.2 was recently released:
https://github.com/Snorby/snorby/blob/master/ChangeLog.md

I've packaged Snorby 2.6.2 and the new securityonion-snorby package has been tested and confirmed by the following (thanks!):
Matt Gregory
David Zawdie

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Ubuntu recently released some MySQL updates, so you may also be prompted to update MySQL at the same time.  Please see the following for the recommended procedure for updating MySQL:
http://code.google.com/p/security-onion/wiki/MySQLUpdates

When the new securityonion-snorby package installs, it should restart Apache and, if Setup has already been run, it should run "bundle exec rake snorby:update" and restart the Snorby worker as follows (you can disregard any "Jammit Warning" messages).

Upgrade Process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Snort 2.9.4.6 package now available

Snort 2.9.4.6 was recently released:
http://blog.snort.org/2013/04/snort-2946-has-been-released.html

I've packaged Snort 2.9.4.6 and and the new package has been tested by the following (thanks!):
Heine Lysemose
Matt Gregory
David Zawdie

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Install Process

The Snort update will do the following:

• back up each of your existing snort.conf file(s) to snort.conf.bak
• update Snort to 2.9.4.6

If you're running Snort in production, then you'll need to do the following:

• apply your local customizations to the new snort.conf file(s)
• update ruleset and restart Snort as follows:
  sudo rule-update

sudo apt-get update && sudo apt-get dist-upgrade

snort -V

Apply any local customizations to snort.conf file(s) and then run "sudo rule-update"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New pcap samples package securityonion-samples-markofu

Mark Hillick put together some pcap samples (thanks Mark!) and I've put them into a new package called securityonion-samples-markofu.  The package will install the pcaps to:
/opt/samples/markofu/

Installation
This package will be included in the upcoming 12.04.1 ISO image, but it's an optional package so it won't automatically install on existing installations.  If you'd like to install this package onto your existing installation, you can use the graphical Update Manager or the following one-liner:

sudo apt-get update && sudo apt-get install securityonion-samples-markofu

Screenshot

Installation

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New pcap samples package securityonion-samples-pnsm

Richard Bejtlich put together some pcap samples (thanks Richard!) and I've put them into a new package called securityonion-samples-pnsm.  The package will install the pcaps to:
/opt/samples/pnsm/

Some of the pcaps have file extensions other than .pcap, so the default Ubuntu AppArmor policy won't allow tcpdump to read them.  This package will automatically update the AppArmor policy to fix this.

Installation
This package will be included in the upcoming 12.04.1 ISO image, but it's an optional package so it won't automatically install on existing installations.  If you'd like to install this package onto your existing installation, you can use the graphical Update Manager or the following one-liner:

sudo apt-get update && sudo apt-get install securityonion-samples-pnsm

Screenshot

Installation

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Upcoming Events in May and June

I'll be speaking on "Enterprise Log Collection and Analysis using Security Onion, OSSEC, and ELSA" at the Augusta Linux User Group meeting on Thursday 5/16:
http://www.meetup.com/Augusta-Linux-User-Group/

I'll also be presenting Security Onion at BSides Charlotte on 6/8:
http://bsidesclt.org/

Hope to see you there!

New Setup package avoids bug when monitoring multiple interfaces

A new Setup package is now available that avoids a bug when monitoring multiple interfaces. When you choose Advanced Setup, the Bro CPU Cores screen will still ask you how many CPU cores you'd like to use for Bro, but it now also includes the following note:

Please note there is a bug in Bro 2.1 when monitoring multiple interfaces with PF_RING that results in traffic loss. If you're monitoring multiple interfaces, we'll configure Bro to disable PF_RING load balancing to avoid this issue. We'll record your desired number of PF_RING CPU cores for when Bro 2.2 is released.

This resolves the following issue:

Issue 317: Setup should disable Bro's PF_RING load balancing config when monitoring multiple NICs

The new package has been tested by Matt Gregory.  Thanks, Matt!

Updating
If you're performing a new installation, it's important to update your packages right after you've completed the Ubuntu installer and BEFORE running Setup.  You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New ELSA and Sphinx packages now available

Scott Runnels has been hard at work updating our ELSA packages and building our own custom Sphinx package!  These new packages should resolve the following issues:

Issue 290: Update ELSA to r713
Issue 289: ELSA - include YUI library
Issue 300: /etc/elsa_web.conf needs 127.0.0.1 to have ports defined as well
Issue 298: Build new sphinx package with --enable-id64 compile-time option
Issue 324: sphinx should check for proper permissions before starting
Issue 299: sphinx.conf - swap "3307" with "9312"
Issue 327: Remove sphinx default cronjob as it is unnecessary and can cause issues

The new packages have been tested by the following (thanks!):
Brad Shoop
David Zawdie
Matt Gregory

UPDATE 5/3 21:18 - We have reports of issues with the sphinxsearch upgrade.  Please do not upgrade until we've determined the root cause.

UPDATE 5/4 00:05 - We've determined the root cause and are trying to determine the best fix.

UPDATE 5/4 13:00 - We're currently building a new package.  Will update later today after it has finished building and has been tested.

UPDATE 5/5 08:24 - The new sphinxsearch package has had some initial testing which appears to be successful. If you can test it in a non-production environment, we'd appreciate any feedback on our mailing list.

UPDATE 5/7 07:21 - Added the "Cleaning Up Perl Processes" and "Rebuilding Indexes" sections below.

UPDATE 5/7 09:45 - Added the "Known Issues" section below.

Updating
The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Warning
Ubuntu recently released some MySQL updates, so you may also be prompted to update MySQL at the same time.  If so, please cancel the update and use our recommended procedure for updating MySQL:
http://code.google.com/p/security-onion/wiki/MySQLUpdates

Cleaning Up Perl Processes
One of the issues fixed in this release was the extra perl processes occurring as a result of the ELSA LiveTail feature.  LiveTail has been disabled in these new packages, but you may still have some extra perl processes hanging around from before the upgrade.  You can resolve this by rebooting (Ubuntu recently released some kernel updates so you may need to do this anyway) or by doing the following:

sudo service syslog-ng stop && sudo pkill -9 perl && sudo service syslog-ng start

Rebuilding Indexes
Another issue fixed in this release is that sphinxsearch is now compiled with id64. Previously, we were using the stock Ubuntu package of sphinxsearch which used the CRC32 algorithm and could result in keyword collisions, meaning that you get results that don't actually match what you were searching for. To ensure that all of your indexes are using the new id64 support, you should reindex as follows (note this may take anywhere from minutes to hours):

sudo indexer --rotate --all

Known Issues
If you access ELSA from a browser whose local timezone is not UTC *and* you haven't enabled the use_utc setting in your ELSA Preferences, then each search rolls the From time back the same number of hours as the UTC offset.  For example, suppose your local workstation is set to Eastern time and you login to ELSA and notice that the From defaults to:
2013-05-05 18:01:50

When you then perform a search, the From changes to:
2013-05-05 14:01:50

The workaround is to enable the use_utc setting in your ELSA Preferences (which is probably a good idea anyway to ensure that your timestamps in ELSA match your timestamps in Sguil/Squert/Snorby):
https://code.google.com/p/enterprise-log-search-and-archive/wiki/Documentation#Preferences

Screenshots

Upgrade Process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Ubuntu MySQL Updates

Ubuntu recently released updated MySQL packages.  As a reminder, please follow the instructions at the following link to avoid any issues with MySQL updates:
https://code.google.com/p/security-onion/wiki/MySQLUpdates

New netsniff-ng and NSM packages now available

I've packaged a new version of netsniff-ng that allows for dropping privileges to a non-root user and I've updated the NSM scripts to take advantage of that.  These new packages fix the following issues:
Issue 310: Update netsniff-ng
Issue 320: Update NSM scripts so that nsm_sensor_ps-restart includes $PCAP_OPTIONS
Issue 311: Update NSM scripts to run netsniff-ng as non-root user
Issue 318: Update NSM scripts to force netsniff-ng to write to proper directory
Issue 303: Update NSM scripts so that sensor_cleandisk looks for unified2 files in proper directories

The new packages have been tested by the following (thanks!):
Heine Lysemose
Matt Gregory
David Zawdie

Updating
The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Once the new packages are installed, you'll need to restart netsniff-ng to run the new binary as a non-root user:

sudo nsm_sensor_ps-restart --only-pcap

Screenshots

Update Process

Restarting netsniff-ng

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you or your organization has found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Snort 2.9.4.1 packages now available

Snort 2.9.4.1 was recently released:
http://blog.snort.org/2013/03/snort-2941-has-been-released.html

I've packaged Snort 2.9.4.1 and DAQ 2.0.0 and the new packages have been tested by the following (thanks!):
Heine Lysemose
David Zawdie

The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Please note that, if you normally use the Registered User VRT Ruleset, you are on a 30-day delay and rules may not be available for Snort 2.9.4.1 yet.

Install Process

The Snort update will do the following:

• back up each of your existing snort.conf file(s) to snort.conf.bak
• update Snort to 2.9.4.1

If you're running Snort in production, then you'll need to do the following:

• apply your local customizations to the new snort.conf file(s)
• update ruleset and restart Snort as follows:

sudo rule-update

sudo apt-get update && sudo apt-get dist-upgrade

snort -V

Apply any local customizations to snort.conf and then run "sudo rule-update"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Suricata 1.4.1 package now available

Suricata 1.4.1 was recently released:
http://suricata-ids.org/2013/03/08/suricata-1-4-1-released/

I've packaged Suricata 1.4.1 and it has been tested by the following (thanks!):
Eric Ooi
David Zawdie

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Install Process

The Suricata update will do the following:

• install some new dependencies (libluajit and libjansson)
• back up each of your existing suricata.yaml file(s) to suricata.yaml.bak
• update Suricata to 1.4.1

If you're running Suricata in production, then you'll need to do the following:

• apply your local customizations to the new suricata.yaml
• restart Suricata as follows:

sudo nsm_sensor_ps-restart --only-snort-alert

sudo apt-get update && sudo apt-get dist-upgrade

suricata -V

Update suricata.yaml file(s) and then run "sudo nsm_sensor_ps-restart --only-snort-alert"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

New PRADS package available

I've packaged a new version of PRADS which changes the way that byte counts are reported.  PRADS will now report total IP bytes, which matches up with the way that NetworkMiner reports byte counts.  It also matches the byte counts in Bro's conn.log in the orig_ip_bytes and resp_ip_bytes fields.  For more details, please see:
https://github.com/gamelinux/prads/issues/30


The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

After upgrading, you'll need to manually restart PRADS as follows:

sudo nsm_sensor_ps-restart --only-prads

Here's an example using traffic from testmyids.com:

Byte counts in Sguil (provided by PRADS)

Byte counts in NetworkMiner

Byte counts in Bro's conn.log (orig_ip_bytes and resp_ip_bytes fields)

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists