We recently released Security Onion 2.3: https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.htmlToday, we are releasing Security Onion 2.3.21, which resolves a few issues: https://docs.securityonion.net/en/2.3/release-notes.htm…
Special thanks to all our folks working so hard to make this release happen!
Josh Brower
Jason Ertel
Wes Lambert
Josh Patterson
Mike Reeves
Bryant Treacle
William Wernert
Training
Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training, including our new Developing Your Detection Playbook class!
We know Security Onion’s hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what’s important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!
If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM!
Security Onion 2.3.21 ISO Boot Menu
ISO Installer
ISO Install Complete
Welcome to Setup
Choose the Setup type
Choose Standard or Airgap
Set hostname
Select management NIC
Configure management NIC
Configure networking
Configure networking
Configure networking
Configure networking
Configure networking
Initialize networking
Configure HOME_NET
Create user account
Set password
Confirm password
Choose how you want to access the web interface
Optionally run so-allow
Specify IP address or range to allow through firewall
Confirm options
Setup complete
After rebooting and logging in, optionally run so-analyst-install
so-analyst-install complete
Enter username to login to GNOME
Enter password to login to GNOME
GNOME Desktop
Analyst Workstation includes Chromium, NetworkMiner, Wireshark, and many other analyst tools
Login to Security Onion Console (SOC)
SOC Overview Page
Use so-import-pcap to import one or more pcap files
Use the hyperlink provided by so-import-pcap to view all alerts and logs
SOC’s right-click menu has been updated and now includes a new Correlate option to find related logs
Correlate found several related logs
PCAP overview
Download the pcap and open directly in NetworkMiner for file extraction