Monday, August 6, 2018

Security Onion 16.04.5.1 now available!

Security Onion 16.04.5.1 is now available!



Issues Resolved

Issue 1284: 16.04.5.1 ISO image
https://github.com/Security-Onion-Solutions/security-onion/issues/1284

Release Notes

For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/16.04.5.1

Security Onion 14.04 EOL Reminder
As a reminder, all new development is now on Security Onion 16.04 and Security Onion 14.04 will reach EOL on November 30, 2018:
https://blog.securityonion.net/2018/06/6-month-eol-notice-for-security-onion.html

After that date, we will not provide any support for Security Onion 14.04.  Please plan to upgrade or replace any existing 14.04 systems before that date.

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Installation

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image.  You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrading-from-14.04-to-16.04

Thanks
Thanks to Wes Lambert for testing this new ISO image!

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Screenshot Tour

ISO Boot Menu

ISO booted into Live Desktop Environment 
Welcome to Setup

 
Network Configuration

Evaluation Mode vs Production Mode

Sniffing Interface Selection

Creating User Account

Setting Password

Confirming Password

Confirming Options

Setup Complete

so-COMPONENT-VERB scripts

CyberChef

Single Sign On (SSO) for Squert, CapMe, and Kibana

Squert

CapMe

Kibana Overview Dashboard

Help

Bro Notices

ElastAlert

OSSEC HIDS Alerts

NIDS Alerts

Bro - Connections

Bro - DCE/RPC

Bro - DHCP

Bro - DNP3

Bro - DNS

Bro - Files

Bro - FTP

Bro - HTTP

Bro - Intel 
Bro - IRC


Bro - Kerberos

Bro - Modbus

Bro - MySQL

Bro - NTLM

Bro - PE

Bro - RADIUS

Bro - RDP

Bro - RFB

Bro - SIP

Bro - SMB

Bro - SMTP

Bro - SNMP

Bro - Software

Bro - SSH

Bro - SSL

Bro - Syslog

Bro - Tunnels

Bro - Weird

Bro - X.509

Autoruns

Beats

OSSEC Logs

Sysmon

Baby Domains

Firewall Logs

Frequency Analysis

Syslog

securityonion-iso - 20151016-1ubuntu1securityonion26 now available for Security Onion 16.04!

The following package is now available:
securityonion-iso - 20151016-1ubuntu1securityonion26

This should resolve the following issues:

Issue 1287: securityonion-iso: so-iso-build should purge grub-legacy-ec2
https://github.com/Security-Onion-Solutions/security-onion/issues/1287

Issue 1288: securityonion-iso: so-iso-build should install xserver-xorg-hwe-16.04
https://github.com/Security-Onion-Solutions/security-onion/issues/1288

Issue 1289: securityonion-iso: so-iso-build should purge dev/test repos
https://github.com/Security-Onion-Solutions/security-onion/issues/1289

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

pinguybuilder - 20180514-1ubuntu1securityonion10 now available for Security Onion 16.04!

The following package is now available:
pinguybuilder - 20180514-1ubuntu1securityonion10

This should resolve the following issue:

pinguybuilder: do not remove linux hwe package #1286
https://github.com/Security-Onion-Solutions/security-onion/issues/1286

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Thursday, August 2, 2018

securityonion-sguil-client - 20141004-0ubuntu0securityonion22 now available for Security Onion!

The following packages are now available:
securityonion-sguil-client - 20141004-0ubuntu0securityonion22
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion22
securityonion-sguil-server - 20141004-0ubuntu0securityonion22

This should resolve the following issue:

securityonion-sguil-server: update dependencies to new tcl version #1275
https://github.com/Security-Onion-Solutions/security-onion/issues/1275

Thanks
Thanks to Wes Lambert for testing these new packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Registration is now open for Security Onion Conference 2018 in beautiful Augusta GA!

For more information and to register, please see:
http://socaugusta2018.eventbrite.com

Wednesday, August 1, 2018

securityonion-sostat - 20120722-0ubuntu0securityonion108 now available for Security Onion!

For background, please see yesterday's post:
https://blog.securityonion.net/2018/07/mysql-upgrade-errors.html

securityonion-sostat - 20120722-0ubuntu0securityonion108 is now available and should resolve the following issue:

soup: avoid issues with mysql 5.7 and systemd #1283
https://github.com/Security-Onion-Solutions/security-onion/issues/1283

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Please note that if you run the older version of soup to install this new package, then you may still experience the MySQL errors and thus may need to use the workaround here:
https://securityonion.net/wiki/MySQL-Upgrade-Errors

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Tuesday, July 31, 2018

MySQL Upgrade Errors

Ubuntu released new MySQL packages for Ubuntu 16.04 on July 30, 2018:
https://usn.ubuntu.com/3725-1/

If you have a Security Onion 16.04 installation and run soup to install these new MySQL packages, you may see a few error messages. We'll be releasing a new version of soup that will avoid these issues for future MySQL upgrades.  In the meantime, please see the following for more information and workarounds:
https://securityonion.net/wiki/MySQL-Upgrade-Errors

Tuesday, July 24, 2018

Suricata 4.0.5 now available for Security Onion!

Suricata 4.0.5 was released recently:
https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/

We've packaged Suricata 4.0.5 and the following packages are now available:
securityonion-suricata - 4.0.5-1ubuntu1securityonion1 (16.04)
securityonion-suricata - 4.0.5-1ubuntu1securityonion2 (14.04)

These packages should resolve the following issue:

Suricata 4.0.5 #1281
https://github.com/Security-Onion-Solutions/security-onion/issues/1281

Thanks
Thanks to the Suricata team for Suricata 4.0.5!
Thanks to Wes Lambert for testing these packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Security Onion 16.04.4.3 now available!

Security Onion 16.04.4.3 is now available!



Issues Resolved

16.04.4.3 ISO image #1278
https://github.com/Security-Onion-Solutions/security-onion/issues/1278

Release Notes

For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/16.04.4.3

Security Onion 14.04 EOL Notice
As a reminder, all new development is now on Security Onion 16.04 and Security Onion 14.04 will reach EOL on November 30, 2018:
https://blog.securityonion.net/2018/06/6-month-eol-notice-for-security-onion.html

After that date, we will not provide any support for Security Onion 14.04.  Please plan to upgrade or replace any existing 14.04 systems before that date.

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Installation

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image.  You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrading-from-14.04-to-16.04

Want us to upgrade your deployment for you?  Please contact Security Onion Solutions for pricing and scheduling:
https://securityonionsolutions.com

Thanks
Thanks to Wes Lambert for testing this new ISO image!

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

pinguybuilder - 20180514-1ubuntu1securityonion8 now available for Security Onion 16.04!

pinguybuilder - 20180514-1ubuntu1securityonion8 is now available for Security Onion 16.04 and should resolve the following issues:

pinguybuilder: some installs are missing /etc/apt #1273
https://github.com/Security-Onion-Solutions/security-onion/issues/1273

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-samples-mta - 20150103-0ubuntu0securityonion3 now available for Security Onion 16.04!

securityonion-samples-mta - 20150103-0ubuntu0securityonion3 is now available for Security Onion 16.04 and should resolve the following issues:

securityonion-samples-mta: Add 2018 samples #1279
https://github.com/Security-Onion-Solutions/security-onion/issues/1279

Thanks
Thanks to Brad Duncan for providing the pcap samples!
Thanks to David Szili and Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Thursday, July 12, 2018

Introducing our new Security Onion Solutions online training platform!

We've just finished updating our online training based on our latest 16.04.4.2 release (including the Elastic Stack).  These new classes are now available on our new online training platform!
https://onlinetraining.securityonionsolutions.com

Use the following coupon code for 10% off!
10OFF-15193

Please act fast as this coupon expires 7/13/2018 at 11:55 PM!

Thanks!

Monday, July 9, 2018

securityonion-squert - 20161212-1ubuntu1securityonion42 now available for Security Onion 16.04!

securityonion-squert - 20161212-1ubuntu1securityonion42 is now available for Security Onion 16.04 and should resolve the following issues:

Squert: Priority counts incorrect #1277
https://github.com/Security-Onion-Solutions/security-onion/issues/1277

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Thursday, July 5, 2018

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion177 now available for Security Onion 16.04!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion177 is now available for Security Onion 16.04 and should resolve the following issues:

NSM: improper confirmation of password should throw an error #1271
https://github.com/Security-Onion-Solutions/security-onion/issues/1271

Thanks
Thanks to Wes Lambert for his work on this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion273 now available for Security Onion 16.04!

securityonion-setup - 20120912-0ubuntu0securityonion273 is now available for Security Onion 16.04 and should resolve the following issues:

sosetup -w not writing answer file correctly in some cases #1270
https://github.com/Security-Onion-Solutions/security-onion/issues/1270

sosetup: move elasticsearch and logstash jvm.options out of the way and write new ones #1272
https://github.com/Security-Onion-Solutions/security-onion/issues/1272

Thanks
Thanks to Steve Baker for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Monday, July 2, 2018

securityonion-pfring-module - 20121107-0ubuntu0securityonion31 now available for Security Onion 16.04!

securityonion-pfring-module - 20121107-0ubuntu0securityonion31 is now available for Security Onion 16.04 and should resolve the following issues:

securityonion-pfring-module: compile on kernel 4.15 #1274
https://github.com/Security-Onion-Solutions/security-onion/issues/1274

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Ubuntu 16.04 with HWE and PF_RING

Introduction
This blog post only applies to you if you installed our Security Onion 16.04 ISO images OR if you installed Ubuntu 16.04 with the HWE stack:
https://wiki.ubuntu.com/Kernel/LTSEnablementStack
https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack

As of this morning, it appears that Ubuntu has rolled the Ubuntu 16.04 HWE stack to 18.04 which means a 4.15 Linux kernel.

Problem
Our current PF_RING module will not compile on kernel 4.15.  If you upgrade to 4.15, you will have a failed PF_RING module and services that use PF_RING such as Snort, Suricata, and Bro, may not work properly.

Solution
We will be building new PF_RING packages to ensure compatibility with this new HWE stack.  In the meantime, please use the following guidance.

If you haven't already updated, we recommend avoiding updates until we have the new PF_RING packages available. 

If you've already updated, you can boot your machine(s) to the previous kernel by choosing "Advanced options" at the grub boot menu and then selecting the 4.13 kernel.

Updated 2018/07/02 12:27 PM Eastern
We've released an updated securityonion-pfring-module package that should resolve this issue, so you should now be able to install updates normally.
https://blog.securityonion.net/2018/07/securityonion-pfring-module-20121107.html

Wednesday, June 27, 2018

securityonion-sostat - 20120722-0ubuntu0securityonion107 now available for Security Onion 16.04!

securityonion-sostat - 20120722-0ubuntu0securityonion107 is now available for Security Onion 16.04 and should resolve the following issues:

sostat: support Bro logs in JSON and TSV #1263
https://github.com/Security-Onion-Solutions/security-onion/issues/1263

sostat: fix netsniff-ng packet loss info #1264
https://github.com/Security-Onion-Solutions/security-onion/issues/1264

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Monday, June 25, 2018

Security Onion 16.04.4.2 now available!

Security Onion 16.04.4.2 is now available!


Issues Resolved

16.04.4.2 ISO image #1262
https://github.com/Security-Onion-Solutions/security-onion/issues/1262

Release Notes

For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/16.04.4.2

Security Onion 14.04 EOL Notice
As a reminder, all new development is now on Security Onion 16.04 and Security Onion 14.04 will reach EOL on November 30, 2018:
https://blog.securityonion.net/2018/06/6-month-eol-notice-for-security-onion.html

After that date, we will not provide any support for Security Onion 14.04.  Please plan to upgrade or replace any existing 14.04 systems before that date.

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Installation

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image.  You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrading-from-14.04-to-16.04

Want us to upgrade your deployment for you?  Please contact Security Onion Solutions for pricing and scheduling:
https://securityonionsolutions.com

Thanks
Thanks to Wes Lambert for testing this new ISO image!

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

pinguybuilder - 20180514-1ubuntu1securityonion5 now available for Security Onion 16.04!

pinguybuilder - 20180514-1ubuntu1securityonion5 is now available for Security Onion 16.04 and should resolve the following issues:

pinguybuilder: make BIOS and EFI boot menus consistent #1254
https://github.com/Security-Onion-Solutions/security-onion/issues/1254

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-iso - 20151016-1ubuntu1securityonion22 now available for Security Onion 16.04!

securityonion-iso - 20151016-1ubuntu1securityonion22 is now available for Security Onion 16.04 and should resolve the following issues:

so-iso-build: need to disable services in /etc/nsm/securityonion.conf #1261
https://github.com/Security-Onion-Solutions/security-onion/issues/1261

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Tuesday, June 19, 2018

securityonion-squert - 20161212-1ubuntu1securityonion41 now available for Security Onion 16.04!

securityonion-squert - 20161212-1ubuntu1securityonion41 is now available for Security Onion 16.04 and should resolve the following issues:

Squert: turning grouping off results in no alerts #1259
https://github.com/Security-Onion-Solutions/security-onion/issues/1259

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

tcpflow - 1.4.5+repack1-1ubuntu1securityonion1 now available for Security Onion 16.04!

tcpflow - 1.4.5+repack1-1ubuntu1securityonion1 is now available for Security Onion 16.04 and should resolve the following issues:

tcpflow -c should print a dot for non-printable chars #1260
https://github.com/Security-Onion-Solutions/security-onion/issues/1260

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Monday, June 18, 2018

securityonion-sostat - 20120722-0ubuntu0securityonion106 now available for Security Onion 16.04!

securityonion-sostat - 20120722-0ubuntu0securityonion106 is now available for Security Onion 16.04 and should resolve the following issues:

soup: install HWE metapackages if necessary #1258
https://github.com/Security-Onion-Solutions/security-onion/issues/1258

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Wednesday, June 13, 2018

securityonion-setup - 20120912-0ubuntu0securityonion270 now available for Security Onion 16.04!

securityonion-setup - 20120912-0ubuntu0securityonion270 is now available for Security Onion 16.04 and should resolve the following issues:

Setup: remove ELSA references from so-email #1257
https://github.com/Security-Onion-Solutions/security-onion/issues/1257

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Tuesday, June 12, 2018

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion176 now available for Security Onion 16.04!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion176 is now available for Security Onion 16.04 and should resolve the following issues:

NSM: securityonion.service should set TimeoutStartSec=300 #1253
https://github.com/Security-Onion-Solutions/security-onion/issues/1253

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Monday, June 11, 2018

Bro 2.5.4 now available for Security Onion 14.04 and 16.04!

Bro 2.5.4 was released recently:
https://twitter.com/Bro_IDS/status/1004136143384764416
https://www.bro.org/download/NEWS.bro.html
https://www.bro.org/download/CHANGES.bro.txt

The following 14.04 packages are now available:
securityonion-bro - 2.5.4-1ubuntu1securityonion1
securityonion-bro-scripts - 20121004-0ubuntu0securityonion57

The following 16.04 packages are now available:
securityonion-bro - 2.5.4-1ubuntu1securityonion2
securityonion-bro-scripts - 20121004-0ubuntu0securityonion58

These new packages should resolve the following issues:

Bro 2.5.4 #1255
https://github.com/Security-Onion-Solutions/security-onion/issues/1255

Thanks
Thanks to the Bro team for Bro 2.5.4!
Thanks to Wes Lambert for testing these new packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Friday, June 8, 2018

Security Onion is over 600,000 downloads!

We recently surpassed 600,000 downloads of our Security Onion ISO image!  Of course, this number does not include folks who install their preferred flavor of Ubuntu and then install our packages on top of that.

Thanks to the entire community for your support!

Tuesday, June 5, 2018

Security Onion Conference 2018 CFP

This year's Security Onion Conference will be held in Augusta, GA on Friday, October 19, 2018 (please mark your calendar!). Registration will open in August.

CFP

Want to speak at Security Onion Conference? We want to hear from you!

How are you...
...using Security Onion to fight evil?
...handling lots of traffic using Security Onion?
...consuming host telemetry with Security Onion?
...integrating Security Onion with other technologies?
...automating common tasks with your own scripts?

Each talk should be 30 minutes with an additional 10 minutes for questions.

Submit your talk here!
https://securityonion.net/cfp

Schedule

June 5 - CFP open
July 5 - CFP closes
July 29 - Speakers selected and notified
August 2 - Registration opens
October 15-18 - Security Onion 4-day training in Augusta
October 19 - Security Onion Conference
October 20 - BSidesAugusta

Friday, June 1, 2018

6 month EOL notice for Security Onion 14.04

Yesterday we released Security Onion 16.04 and announced that all new development will now be on 16.04:
https://blog.securityonion.net/2018/05/security-onion-160441-iso-image-now.html

Security Onion 14.04 will reach EOL on November 30, 2018.  After that date, we will not provide any support for 14.04.  Please plan to upgrade or replace any existing 14.04 systems before that date.

If you have existing installations of 14.04, you can upgrade to 16.04:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrading-from-14.04-to-16.04

Want us to upgrade your deployment for you?  Please contact Security Onion Solutions for pricing and scheduling:
https://securityonionsolutions.com

Thursday, May 31, 2018

Security Onion 16.04.4.1 ISO image now available!

We're pleased to announce that Security Onion 16.04.4.1 RC2 has been promoted to RELEASE status!


This release resolves the following issues:

Issue 1247: Ubuntu 16.04 Xenial Support
https://github.com/Security-Onion-Solutions/security-onion/issues/1247

Issue 1202: CapMe: purge pcap symlinks older than 24 hours
https://github.com/Security-Onion-Solutions/security-onion/issues/1202

Issue 1169: Squert: remove search link from context menu
https://github.com/Security-Onion-Solutions/security-onion/issues/1169

Issue 875: Allow mysql root password
https://github.com/Security-Onion-Solutions/security-onion/issues/875

Release Notes
ELSA, Argus, and PRADS are no longer included in Security Onion.

For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/16.04.4.1

Security Onion 14.04 EOL Notice
All new development will now be on Security Onion 16.04.  Security Onion 14.04 will reach EOL on November 30, 2018.  After that date, we will not provide any support for Security Onion 14.04.  Please plan to upgrade or replace any existing 14.04 systems before that date.

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Installation

Existing Deployments
If you have existing installations of Security Onion 14.04, you can upgrade to 16.04:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrading-from-14.04-to-16.04

Want us to upgrade your deployment for you?  Please contact Security Onion Solutions for pricing and scheduling:
https://securityonionsolutions.com

Training
We also offer onsite and online training!  For pricing and availability, please see:
https://securityonionsolutions.com

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://github.com/Security-Onion-Solutions/security-onion/wiki/MailingLists

Thanks!

Monday, May 14, 2018

securityonion-rule-update - 20151201-1ubuntu1securityonion13 now available for Security Onion!

The following package is now available:
securityonion-rule-update - 20151201-1ubuntu1securityonion13

This package should resolve the following issues:

rule-update: update distro in pulledpork.conf #1250
https://github.com/Security-Onion-Solutions/security-onion/issues/1250

Thanks
Thanks to ledingtech for notifying us of this issue!
Thanks to Wes Lambert for testing the new package!

Conference
Our annual Security Onion Conference will be Friday October 19, 2018:
https://securityonion.net/conference

Training
We offer onsite and online training:
https://securityonionsolutions.com

We have onsite classes scheduled in Columbia MD and Augusta GA with an Early Bird discount good until May 21!
https://blog.securityonion.net/2018/04/security-onion-basic-and-advanced.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Wednesday, May 2, 2018

Security Onion Presentation and Demo in Portsmouth, NH on Wednesday 5/23

Doug Burks will be presenting a case study using the latest version of Security Onion at SEA-TUG in Portsmouth, NH on Wednesday 5/23.  The event is free, but please register here:
https://www.meetup.com/SEA-TUG/events/249384026/

This presentation will NOT be recorded, so we hope to see you there!

Tuesday, May 1, 2018

Security Onion 14.04.5.13 ISO image now available!

We have a new Security Onion 14.04.5.13 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of April 25, 2018!  This includes Elastic Stack 6.2.4 (and all related Docker images).  Also, gedit has been added to this release.


This resolves the following issue:

Issue 1243: 14.04.5.13 ISO image
https://github.com/Security-Onion-Solutions/security-onion/issues/1243

This new ISO image has been tested by Wes Lambert.  Thanks, Wes!

New Installations
We've updated the Verify_ISO page for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Please remember to verify the signature of the downloaded ISO image using the instructions on that page.

Existing Deployments
If you have existing installations based on a previous 14.04 ISO image, there is no need to download the new ISO image.  You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
For more information about this release, please see:
https://securityonion.net/wiki/14.04.5.13

Conference
Our annual Security Onion Conference will be Friday October 19, 2018:
https://securityonion.net/conference

Training
We offer onsite and online training:
https://securityonionsolutions.com

We have onsite classes scheduled in Columbia MD and Augusta GA with an Early Bird discount good until May 21!
https://blog.securityonion.net/2018/04/security-onion-basic-and-advanced.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Search This Blog

Featured Post

Security Onion 3.3.0 Now Available including Agentic AI Improvements!

Security Onion 3.3.0 is now available and includes new features, updated components, and many quality of life improvements! For a full scree...

Popular Posts

Blog Archive