New package OnionSalt now available for configuration management

Mike Reeves created OnionSalt, a set of Salt configuration management scripts to manage lots of sensors from your master server.  I've packaged OnionSalt and added support for it in Setup.

Please note that Salt is totally optional.  If you're happy with your current method of sensor management, then you don't have to install securityonion-onionsalt and nothing will change for you.  Should you decide to install securityonion-onionsalt, you get the following features out of the box:

• manage user accounts, sudoers, and SSH keys from one location and have it replicate to all sensors
• have sensors check for new IDS rules every 15 minutes, copy files, and restart engines as necessary

In addition, Salt is a full configuration management system, so you can script anything that you want to deploy across your army of sensors.

Thanks
Thanks to Mike Reeves for developing OnionSalt!
Thanks to the following for testing:
JP Bourget
David Zawdie

Warning
OnionSalt is still considered experimental.  You'll want to test in a lab environment before deciding to deploy in production.

Installing
To read more about how to integrate OnionSalt into a new or existing Security Onion deployment, please see our Salt page:
https://code.google.com/p/security-onion/wiki/Salt

Screenshots

Enabling Salt on Master Server via Advanced Setup

After completing Setup, verifying that the Master can manage itself

Enabling Salt on sensor1 via Advanced Setup

After completing Setup, verifying that the Master can now manage both boxes

Salt can run arbitrary commands on all boxes at once

Adding johndoe to /opt/onionsalt/pillar/users/init.sls

Adding johndoe's public key to /opt/onionsalt/salt/users/keys/

Running "sudo salt '*' state.highstate" to push accounts and keys to all boxes

Verifying that we can now login using the new account/key

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

PF_RING 5.6.1, Snort 2.9.5.3, and Suricata 1.4.5 packages now available!

The following software was recently released:

PF_RING 5.6.1
http://sourceforge.net/projects/ntop/files/PF_RING/

Snort 2.9.5.3
http://blog.snort.org/2013/07/snort-2953-is-now-available.html

Suricata 1.4.5
http://suricata-ids.org/2013/07/26/suricata-1-4-5-released/

I've packaged these new releases and the new packages have been tested by David Zawdie.  Thanks, David!

UPDATE 2013/09/04: Lysemose pointed out on the mailing list that VRT Registered Ruleset users won't get rules for Snort 2.9.5.3 until September 6:
https://groups.google.com/d/topic/security-onion/wd32jmXoy04/discussion

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

These updates will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module
• start all NSM sensor processes
• back up each of your existing snort.conf files to snort.conf.bak
• update Snort
• back up each of your existing suricata.yaml files to suricata.yaml.bak
• update Suricata

You'll then need to do the following:

• apply your local customizations to the new snort.conf or suricata.yaml files
• update ruleset and restart Snort/Suricata as follows:

sudo rule-update

Notes
One change that I've made to our normal Snort config is the PF_RING clustermode.  Previously, snort would default to clustermode=2 meaning that PF_RING would hash each stream to a particular Snort instance based solely on src and dst IP.  So let's say you have multiple Snort instances in a PF_RING cluster and you run a series of "curl testmyids.com" tests.  Each and every "curl testmyids.com" would be sent to the SAME Snort instance since the src and dst IP never change. With the new clustermode=4, the snort instance would be selected based on src/dst IP *and* src/dst port.  So each time you do "curl testmyids.com" it will go to a different Snort instance in the PF_RING cluster.  This results in more effective load balancing.

Screenshots

"sudo soup" upgrade process

PF_RING 5.6.1, Snort 2.9.5.3, and Suricata 1.4.5

Updating ruleset and restarting Snort/Suricata using "sudo rule-update"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New Squert 1.1 and other packages

Paul Halliday recently released Squert 1.1:
http://www.squertproject.org/

I've packaged Squert 1.1 and updated a few other packages at the same time.  The following updated packages are now available:
securityonion-et-rules
securityonion-rule-update
securityonion-setup
securityonion-squert
securityonion-squert-cron

These packages should resolve the following issues:

Issue 240: Squert 1.1
https://code.google.com/p/security-onion/issues/detail?id=240

Issue 366: Setup doesn't need to prompt if there is no Internet connection
https://code.google.com/p/security-onion/issues/detail?id=366

Issue 371: sosetup-network should require the user to choose static/DHCP for management interface
https://code.google.com/p/security-onion/issues/detail?id=371

Issue 373: Setup doesn't correctly configure VRT+ETNOGPL
https://code.google.com/p/security-onion/issues/detail?id=373

Issue 380: Update securityonion-et-rules package and include tarball
https://code.google.com/p/security-onion/issues/detail?id=380

Issue 381: Update Setup so that if no Internet access, run pulledpork -n
https://code.google.com/p/security-onion/issues/detail?id=381

Notes
Please note that Squert now has the ability to retrieve transcripts and categorize events, but you'll need to edit /var/www/squert/.inc/config.php and insert your Sguil username/password to enable this functionality.

Thanks
Thanks to the following for testing the new packages:
David Zawdie
JP Bourget

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Screenshots

Squert 1.1

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-bro-scripts package fixes a race condition

A new version of our securityonion-bro-scripts package is now available that fixes a possible race condition.

This update resolves the following issue:
Issue 374: Update hostname.bro and interface.bro

Thanks
Thanks to Jon Siwek for the new Bro scripts!
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart Bro:

sudo broctl restart

Screenshots

Under certain conditions, the old Bro scripts would fail to determine the hostname and interface...

...resulting in Bro's conn.log containing an invalid "sensorname" field (should be hostname-interface)

Installing new securityonion-bro-scripts package

Restarting Bro

Bro now properly determines hostname and interface resulting in...

...conn.log having the correct sensorname (hostname-interface)

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-sguil-server and securityonion-capme packages allow tcpflow/bro rendering

New versions of our securityonion-sguil-server and securityonion-capme packages are now available! After installing these packages and restarting sguild, you'll notice that CapMe now gives you the option to choose tcpflow or bro for transcript rendering.

This update resolves the following issue:
Issue 375: Update CapMe so that the user can choose between tcpflow and Bro for transcript rendering

Thanks
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart sguild:

sudo nsm_server_ps-restart

Screenshots

New "Transcript" option defaults to "tcpflow" 

"tcpflow -cr" doesn't decode gzip decoding, so click the "close" button to go back

Select "bro" and click "submit"

Bro decodes gzip encoding

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion packages

New versions of the following packages are now available!

securityonion-nsmnow-admin-scripts
securityonion-sguild-add-user
securityonion-sostat

These new packages resolve the following issues:

Issue 370: soup: a script to handle Ubuntu/SO updates properly (mysql-server and pfring)
You can now run a single command to update your system without having to worry about mysql/pfring updates:

sudo soup

Issue 323: Create sguild-passwd-user script
You can now reset a user's Sguil/Squert/ELSA password using the following:

sudo nsm_server_user-passwd

Issue 363: netsniff-ng: log and print statistics
At the next daily restart, netsniff-ng will begin using the --verbose option to log statistics.  sostat has been updated to report on those statistics:

sudo sostat

Thanks
Thanks to Jon Schipp for submitting the netsniff-ng patches for the NSM and sostat scripts!
Thanks to JP Bourget for submitting the sguild-passwd-user patches!
Thanks to the following for testing the new packages!
David Zawdie
Matt Gregory
JP Bourget

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-capme package

A new version of our securityonion-capme package is now available!

This new package resolves the following issues:
Issue 365: CapMe red/blue color coding should match Sguil's transcript
Issue 364: Remove "after 1000" from CapMe's cliscript.tcl

Thanks
Thanks to the following for testing the new package!
David Zawdie
Matt Gregory
JP Bourget

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-networkminer package updates NetworkMiner to 1.5

NetworkMiner was recently updated to 1.5:
http://www.netresec.com/?page=Blog&month=2013-08&post=Security-Advisory%3a-Two-Vulnerabilities-in-NetworkMiner

I've packaged NetworkMiner 1.5 and this resolves the following issue:
Issue 372: NetworkMiner 1.5

Thanks
Thanks to the following for testing the new package!
David Zawdie
Matt Gregory
JP Bourget

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-rule-update package fixes a bug when running Suricata

A new version of our securityonion-rule-update package is now available that resolves the following issue:
Issue 368: /usr/bin/rule-update should check for "Suricata"

Thanks
Thanks to David Zawdie for testing the new package!

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Security Onion 12.04.2 ISO image now available

We have a new Security Onion 12.04.2 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of July 17, 2013!

Thanks
Thanks to the following for testing the new ISO image!
David Zawdie
JP Bourget

Changelog
For a list of all changes made since our original 12.04 ISO image was released, please see:
https://code.google.com/p/security-onion/wiki/Roadmap

New Users
I've updated the Installation guide to reflect the download locations for the new 12.04.2 ISO image:
https://code.google.com/p/security-onion/wiki/Installation

As always, please remember to verify the checksum of the downloaded ISO image using the instructions in the Installation guide.

Existing Deployments
If you have existing installations based on our original 12.04 ISO image, there is no need to download the new 12.04.2 ISO image.  You can simply continue using the standard Ubuntu package management tools to install updated packages as they are made available:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-sguil-server package changes CapMe to use Bro transcript option

A new version of our securityonion-sguil-server package is now available that changes the CapMe web interface to render transcripts using the new Bro transcript option:
http://securityonion.blogspot.com/2013/07/new-securityonion-sguil-client-and.html

This update resolves the following issue:
Issue 367: CapMe should use the new Bro transcript option

Thanks
Thanks to David Zawdie for testing the new package!

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart sguild:

sudo nsm_server_ps-restart

Screenshots

New Bro option unzips any gzip encoded server responses

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-sguil-client and securityonion-sguil-server packages include Bro Transcript functionality

New versions of our securityonion-sguil-client and securityonion-sguil-server packages are now available that add a new "Bro" option to the Sguil client's right-click context menu.  This option will run the pcap through a Bro script that will mimic the existing tcpflow transcript option but with a couple of very important changes:

• any gzipped server responses are automatically unzipped
• transcripts are rendered for not only tcp but also udp traffic

This update resolves the following issue:
Issue 347: New Sguil client transcript option to run through tcpudpflow.bro

Thanks
Thanks to Scott Runnels for his work on the Bro script and changes to the sguil packages!
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart sguild:

sudo nsm_server_ps-restart

Screenshots

Upgrade Process

Restarting sguild

Existing Transcript option

Existing Transcript option doesn't handle gzip encoded server responses

New Bro option

New Bro option unzips any gzip encoded server responses

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New NSM and Setup packages allow you to enable/disable sensor services

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to enable/disable sensor services.  When you run Setup, choosing "Quick Setup" will still default to running all sensor services, but if you choose "Advanced Setup", you'll be prompted to select which sensor processes to enable/disable:

IDS Engine

Bro

http_agent

Argus 

Prads

Full Packet Capture

Your choices are then written into configuration files as follows:

/etc/nsm/securityonion.conf

BRO_ENABLED=yes

/etc/nsm/HOSTNAME-INTERFACE/sensor.conf

PCAP_ENABLED="yes"
PCAP_AGENT_ENABLED="yes"
SNORT_AGENT_ENABLED="yes"
IDS_ENGINE_ENABLED="yes"
BARNYARD2_ENABLED="yes"
PRADS_ENABLED="yes"
SANCP_AGENT_ENABLED="yes"
PADS_AGENT_ENABLED="yes"
ARGUS_ENABLED="yes"
HTTP_AGENT_ENABLED="yes"

Disabling Services after Setup

If you've already run Setup and want to disable a certain sensor service, you can simply stop the running service and then change the corresponding config value from "yes" to "no" to prevent it from restarting the next time the NSM scripts are run.

For example, suppose you access Bro's HTTP logs via ELSA, so you want to disable http_agent to prevent those HTTP logs from being duplicated into the Sguil database.  You would first stop the running http_agent service:

sudo nsm_sensor_ps-stop --only-http-agent

You would then edit /etc/nsm/HOSTNAME-INTERFACE/sensor.conf and change:

HTTP_AGENT_ENABLED="yes"

to:

HTTP_AGENT_ENABLED="no"

to prevent http_agent from restarting the next time the NSM scripts are run.  A quick way to do this for all /etc/nsm/*/sensor.conf files on one box is to use the sed command as follows:

sudo sed -i 's|HTTP_AGENT_ENABLED="yes"|HTTP_AGENT_ENABLED="no"|g' /etc/nsm/*/sensor.conf

Example Screenshots

Stopping the running service

Disabling the service

Service now disabled

Issues Resolved
These updates resolve the following issues:
Issue 312: Update NSM scripts to allow $SERVICE=yes/no in securityonion.conf and/or sensor.conf
Issue 313: Update Setup so that Advanced Setup asks about enabling/disabling individual services
Issue 268: Update NSM scripts so that OSSEC and Bro sections respect --sensor-name option
Issue 351: Update /etc/init/securityonion.conf to start Xplico (controlled by user in /etc/nsm/securityonion.conf)

Thanks
Thanks to Karolis Cepulis for submitting a patch for Issue 268!
Thanks to the following for testing the new packages!
Matt Gregory
Michal Purzynski

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-bro-scripts and securityonion-capme packages

A new version of our securityonion-bro-scripts package is now available that extends Bro's conn.log to include the hostname and interface that saw the connection.  In addition, a new version of our securityonion-capme package automatically determines if you're pivoting from ELSA and, if so, queries Bro's conn.log via ELSA for the source and destination IP/port.  It then parses the hostname/interface out of the result to locate the pcap and render the transcript.  The net result of these changes is that pivoting to CapMe from ELSA no longer depends on the prads session data in the Sguil sancp table.

This update resolves the following issue:
Issue 348: Update CapME with a new option to query Bro conn.log via ELSA

Thanks
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie
Michal Purzynski

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart Bro:

sudo broctl restart

Screenshots

Upgrade Process

Restarting Bro using "sudo broctl restart"

When pivoting from ELSA, CapMe now defaults to searching ELSA instead of the sancp table

CapMe Transcript

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-sguil-db-purge package terminates orphaned sguild processes

A new version of our securityonion-sguil-db-purge package is now available that will automatically terminate any orphaned sguild processes.

This update resolves the following issue:
Issue 359: nsm_server_ps-restart --if-stale leaves orphaned sguild processes

Thanks
Thanks to David Zawdie for testing the new package!

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New NSM and Setup packages allow for changing the default 90% disk usage threshold

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our default 90% disk usage threshold.  When you run Setup, it will still default to purging old logs when disk usage hits 90%.  Choosing "Advanced Setup" will prompt you to specify your own disk usage threshold:

Advanced Setup prompts for disk usage threshold

This setting is then written into /etc/nsm/securityonion.conf as CRIT_DISK_USAGE, where it is sourced by /usr/sbin/nsm_sensor_clean when the hourly cronjob runs.

If you've already run Setup and want to change the default 90% disk usage threshold, you can simply set the value in /etc/nsm/securityonion.conf.

These updates resolve the following issues:
Issue 315: Update NSM scripts so that WARN_DISK_USAGE and CRIT_DISK_USAGE are configurable by user
Issue 358: Update Setup so that Advanced Setup asks about CRIT_DISK_USAGE

Thanks
Thanks to Karolis Cepulis for the nsm_sensor_clean patch!
Thanks to David Zawdie for testing the new package!

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training

Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!

http://securityonion.eventbrite.com/

Suricata 1.4.3 package now available

Suricata 1.4.3 was recently released:
http://www.openinfosecfoundation.org/index.php/component/content/article/1-latest-news/178-suricata-143-released

I've packaged Suricata 1.4.3 and the new package has been tested by the following (thanks!):
David Zawdie

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

The Suricata update will do the following:

• back up each of your existing suricata.yaml file(s) to suricata.yaml.bak
• update Suricata to 1.4.3

If you're running Suricata in production, then you'll need to do the following:

• apply your local customizations to the new suricata.yaml
• restart Suricata as follows:

sudo nsm_sensor_ps-restart --only-snort-alert

Upgrading Suricata

suricata -V

Update suricata.yaml file(s) and then run "sudo nsm_sensor_ps-restart --only-snort-alert"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New NSM and Setup packages allow for changing the default netsniff-ng PCAP size

New versions of our securityonion-nsmnow-admin-scripts and securityonion-setup packages are now available that allow you to change our default 150MB netsniff-ng PCAP size.  When you run Setup, it will still default to 150MB.  Choosing "Advanced Setup" will prompt you to specify your own PCAP_SIZE:

Advanced Setup prompts for PCAP size

This PCAP_SIZE option is then placed into /etc/nsm/HOSTNAME-INTERFACE/sensor.conf where it is sourced by the NSM scripts when they start netsniff-ng.

If you've already run Setup and want to change the default 150MB PCAP size, you can add the PCAP_SIZE option to /etc/nsm/HOSTNAME-INTERFACE/sensor.conf.  Please note that netsniff-ng accepts the following units for PCAP_SIZE:
KiB
MiB
GiB

So if you want to increase your PCAPs to 500MB, you would add the following option to /etc/nsm/HOSTNAME-INTERFACE/sensor.conf:
PCAP_SIZE=500MiB

Then restart netsniff-ng as follows:

sudo nsm_sensor_ps-restart --only-pcap

Also, I've seen some intermittent cases where pcap_agent fails to start right after running Setup, so I've added a 5-second delay between starting netsniff-ng and starting pcap_agent to help ensure that netsniff-ng is fully initialized.

These updates resolve the following issues:
Issue 341: nsm_sensor_ps-start needs "sleep 5s" between netsniff-ng and pcap_agent
Issue 314: Update NSM scripts so that netsniff-ng pcap size is configurable by user

Thanks
Thanks to JP Bourget for the NSM/Setup patches for setting the PCAP size!
Thanks to the following for testing the new package:
Matt Gregory
Liam Randall
David Zawdie

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

8-hour Security Onion class in Augusta GA on Thursday August 1, 2013

Want to learn more about Security Onion?  Please make plans to attend the upcoming 8-hour class in Augusta GA on Thursday August 1, 2013!  For more details and to register, please see:

http://securityonion.eventbrite.com/

New securityonion-rule-update package distributes OSSEC local_rules.xml and allows for per-sensor NIDS/HIDS rule tuning

A new version of our securityonion-rule-update package is now available that distributes OSSEC's local_rules.xml from master server to slave sensors by default and also allows for NIDS/HIDS rule tuning per physical sensor.

This update resolves the following issues:
Issue 342: Allow more granular rule tuning (per physical sensor)
Issue 325: rule-update needs to check for privileges
Issue 326: rule-update needs to check for /etc/nsm/rules/backup/
Issue 349: rule-update needs to copy OSSEC local_rules.xml from master to sensor
Issue 353: rule-update should remove unneeded messages from PulledPork output

NIDS Rules
Previously, rule-update in distributed deployments would copy NIDS rules from the master server to slave sensors but wouldn't allow you to tune the ruleset per sensor.  This new version of rule-update allows for ruleset tuning per physical sensor.  If you'd like to enable this, set the following option in /etc/nsm/securityonion.conf on the sensor:

LOCAL_NIDS_RULE_TUNING=true

The next time rule-update runs, it should copy the raw NIDS rules from the master server and run Pulledpork locally making changes to the ruleset as you've configured in /etc/nsm/pulledpork/ on the sensor itself.

HIDS Rules
Another change in this new rule-update is that OSSEC's local_rules.xml is now copied from the master server to slave sensors by default.  If local_rules.xml has changed since the previous run of rule-update, it will then automatically restart OSSEC to activate the new configuration.  If you want to tune local_rules.xml per physical sensor, set the following option in /etc/nsm/securityonion.conf on the sensor:

LOCAL_HIDS_RULE_TUNING=true

What if I've already modified OSSEC's local_rules.xml on the sensor?  Will my changes be overwritten?
If you had previously tuned OSSEC's local_rules.xml on the sensor itself and don't want those changes to be overwritten when the new version of rule-update runs, set LOCAL_HIDS_RULE_TUNING=true before upgrading the rule-update package.  If you have already upgraded rule-update without setting LOCAL_HIDS_RULE_TUNING=true, your custom local_rules.xml should have been backed up to /var/ossec/rules/local_rules_orig.xml.  You can then set LOCAL_HIDS_RULE_TUNING=true and copy /var/ossec/rules/local_rules_orig.xml to /var/ossec/rules/local_rules.xml.

Thanks
Thanks to Chris White for the granular NIDS rule tuning patch!
Thanks to the following for testing the new package:
David Zawdie
Heine Lysemose

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Github
Found bugs in rule-update or want to add new features?  rule-update is now on github:
https://github.com/Security-Onion/securityonion-rule-update

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-sguil-client package now available

I've patched the Sguil client to add "Copy IP Address" to the right-click context menu for IP addresses. So for example, if you find an interesting IP address in Sguil and want to search ELSA for that IP address, you can just right-click the IP address, select "Copy IP Address", select "SrcIP" or "DstIP", and then alt-tab to your ELSA window and paste it in.

Copy IP Address

Thanks
The new package has been tested by the following:
David Zawdie
Heine Lysemose

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

8-hour Security Onion class in Augusta GA on Thursday August 1, 2013

Want to learn more about Security Onion?  Please make plans to attend this 8-hour class in Augusta GA on Thursday August 1, 2013!

More details (including cost, location, and registration information) will be posted here soon.  Stay tuned for details!

UPDATE 2013/06/27

Registration is now live!
http://securityonion.eventbrite.com/

New securityonion-rule-update package

Michal Purzynski fixed a bug in our securityonion-rule-update package (thanks Michal!).  The new package is now available in our stable repo.  If you're running Sourcefire VRT rules in a distributed deployment, we recommend updating to ensure that Shared Object (SO) rules get copied to your distributed sensors properly. 

Feedback

If you have any questions or problems, please use our mailing list:

https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted

If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:

https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Security Onion 12.04.1 ISO image now available

We have a new Security Onion 12.04.1 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of June 5, 2013!  It also contains the two new pcap samples packages recently released:
http://securityonion.blogspot.com/2013/05/new-pcap-samples-package-securityonion.html
http://securityonion.blogspot.com/2013/05/new-pcap-samples-package-securityonion_27.html

Changelog
For a list of all changes made since our original 12.04 ISO image was released, please see:
https://code.google.com/p/security-onion/wiki/Roadmap

New Users
I've updated the Installation guide to reflect the download locations for the new 12.04.1 ISO image:
https://code.google.com/p/security-onion/wiki/Installation

As always, please remember to verify the checksum of the downloaded ISO image using the instructions in the Installation guide.

Existing Deployments
If you have existing installations based on our original 12.04 ISO image, there is no need to download the new 12.04.1 ISO image.  You can simply continue using the standard Ubuntu package management tools to install updated packages as they are made available:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-pfring-module package now available

We recently released PF_RING 5.5.3 packages:
http://securityonion.blogspot.com/2013/05/pfring-553-packages-now-available.html

Shortly after releasing the packages, we determined that there was a bug in the kernel module.  The PF_RING team patched the kernel module and I've created a new securityonion-pfring-module package which is now available in our stable repo.

To ensure that the PF_RING kernel module is installed before any Ubuntu kernel updates, you may want to install as follows:

sudo apt-get update ; sudo apt-get install securityonion-pfring-module ; sudo apt-get dist-upgrade

For more information, please see our Upgrade page:
https://code.google.com/p/security-onion/wiki/Upgrade

The securityonion-pfring-module package will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module and insert it
• start all NSM sensor processes

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!