Security Onion 16.04.6.6 ISO image now available featuring Zeek 3.0.5, Suricata 4.1.8, Elastic 6.8.8, CyberChef 9.20.3, and more!

Our Security Onion 16.04.6.6 ISO image is now available!

Security Onion 16.04.6.6 boot menu

Major Changes Since Last ISO Image

• Zeek 3.0.5
• Suricata 4.1.8
• Elastic 6.8.8
• CyberChef 9.20.3

Thanks
Thanks to Wes Lambert for testing this ISO image!

Package Updates
This release also includes the following updated packages:
securityonion-web-page - 20141015-0ubuntu0securityonion107
pinguybuilder - 20180514-1ubuntu1securityonion23

These packages resolve the following issues:

Docs: add warnings and notes #1744
https://github.com/Security-Onion-Solutions/security-onion/issues/1744

Update docs and cheat sheet for 16.04.6.6 #1758
https://github.com/Security-Onion-Solutions/security-onion/issues/1758

CyberChef 9.20.3 #1747
https://github.com/Security-Onion-Solutions/security-onion/issues/1747

pinguybuilder: increment version to 16.04.6.6 #1748
https://github.com/Security-Onion-Solutions/security-onion/issues/1748

Issues Resolved
For a list of all issues resolved in this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/projects/12

Release Notes
For more information about this release, please see:
https://securityonion.net/docs/release-notes.html

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://securityonion.net/docs/installation.html

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image.  You can simply continue using our standard update process to install updated packages as they are made available:
https://securityonion.net/docs/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://securityonion.net/docs/upgrading-from-14.04-to-16.04.html

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Training
Security Onion Solutions is the only official authorized training provider for Security Onion:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Screenshot Tour

ISO boot menu 

Once the Live Desktop appears, double-click the Install icon and follow the prompts

Once you've completed the installer and rebooted, login using the username and password you created in the installer

After logging in, you are prompted to run Setup

Setup can now run interactively via CLI and sosetup-minimal can be used to minimize RAM and CPU usage

Welcome to Setup

Configure network interfaces

If your hostname is securityonion, Setup gives you the opportunity to rename it

Configure your network interfaces, reboot, then log back in

Launch Setup again and skip network configuration to go to service configuration

sosetup-minimal can run Evaluation Mode in 4GB RAM

Confirm sniffing interface

Create username

 

Create Password

Confirm Password

Confirm all options

Setup complete

Desktop no longer prompts to run Setup and includes icons for analyst applications 

 

The README shortcut includes links to the cheat sheet and online and offline documentation

CyberChef 9.20.3

Single Sign On (SSO) for Squert, CapMe, and Kibana

 

sosetup-minimal can run Evaluation Mode in only 4GB RAM

Analyze IDS alerts using Squert

Retrieve full packet capture with CapMe

Kibana Overview Dashboard

Help

Zeek Notices

HIDS Alerts from OSSEC/Wazuh

NIDS Alerts from Snort or Suricata

 

Zeek Connections

Zeek Total Bytes

Zeek DCERPC

Zeek DHCP

 

Zeek DNP3

Zeek DNS

Zeek Files

Zeek FTP

Zeek HTTP

Zeek Intel

Zeek IRC

Zeek Modbus

Zeek MySQL

Zeek NTLM

Zeek PE

 

Zeek RADIUS

Zeek RDP

Zeek RFB

Zeek SIP

Zeek SMB

Zeek SMTP

Zeek SNMP

Zeek Software

Zeek SSH

Zeek SSL

Zeek Syslog

Zeek Tunnels

Zeek Weird

Zeek X.509

OSSEC/Wazuh Logs

Security Onion Hybrid Hunter 1.2.2 now available!

We recently released Security Onion Hybrid Hunter 1.2.1 Beta 1:
https://blog.securityonion.net/2020/04/security-onion-hybrid-hunter-121-beta-1.html

Today we are releasing Hybrid Hunter 1.2.2, which is still considered part of the Beta 1 cycle, but resolves a few issues:

• Updated Saltstack to 2019.2.4 to address CVE-2020-11651
• Updated Suricata to 4.1.8 to address some possible security issues
• Fixed an issue that was preventing Strelka from functioning properly
• ISO installs should now use the built in docker containers instead of re-downloading them

To read more and download Hybrid Hunter, please see:
https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/ISO
https://github.com/Security-Onion-Solutions/securityonion-saltstack/blob/master/README.md

If you have any questions about Hybrid Hunter, please post a message on our reddit community and prefix the title with [Hybrid Hunter]!
https://www.reddit.com/r/securityonion/

SaltStack CVE-2020-11651 and CVE-2020-11652

Two vulnerabilities in SaltStack were recently announced:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11651

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11652

In the current Security Onion 16.04 platform, we use the standard SaltStack packages from the standard Ubuntu repositories.  Ubuntu is currently tracking these as follows:

https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11651.html

https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11652.html

We would expect that as soon as Ubuntu updates its packages, then a standard "soup" update would completely remove the vulnerabilities.

UPDATE 2020/08/14 - Ubuntu has released updated packages:

https://ubuntu.com/security/notices/USN-4459-1

In the meantime, please keep in mind that Security Onion locks down the host-based firewall to only allow connections to the salt ports from known good salt minions.  If you feel the need for additional compensating controls, you may wish to add firewall restrictions to your network firewalls as well.