Security Onion Documentation

Table of Contents

About
- Security Onion
- Security Onion Solutions, LLC
- Documentation
Introduction
- Network Visibility
- Host Visibility
- Analysis Tools
- Workflow
- Deployment Scenarios
- Conclusion
License
First Time Users
Getting Started
- Best Practices
- Use Cases
- Architecture
- Hardware Requirements
- Download
- VMware
- VirtualBox
- Proxmox
- Booting Issues
- Airgap
- Installation
- Amazon Cloud Image
- Azure Cloud Image
- Google Cloud Image
- Configuration
- After Installation
Security Onion Console (SOC)
- Alerts
- Dashboards
- Hunt
- Cases
- Detections
- PCAP
- Grid
- Downloads
- Administration
- Kibana
- Elastic Fleet
- Osquery Manager
- InfluxDB
- CyberChef
- ATT&CK Navigator
Security Onion Desktop
- Chromium
- NetworkMiner
- Wireshark
Network Visibility
- AF-PACKET
- BPF
- Stenographer
- Suricata
- Zeek
- Strelka
- Intrusion Detection Honeypot
Additional Network Visibility
- NetFlow
- pfSense
- OPNsense
Host Visibility
- Elastic Agent
- Syslog
- Sysmon
Third Party Integrations
- Adding an Integration
- Adding a Custom Integration
- Supported Integrations
- More Information
Rules
- NIDS
- Sigma
- YARA
Logs
- Ingest
- Logstash
- Redis
- Elasticsearch
- ElastAlert 2
- Data Fields
- Alert Data Fields
- Elastalert Fields
- Zeek Fields
- Community ID
- SOC Logs
Updating
- soup
- End Of Life
Accounts
- Passwords
- MFA
- Adding Accounts
- Listing Accounts
- Disabling Accounts
- Role-Based Access Control (RBAC)
- Kratos
Services
Customizing for Your Environment
- SOC Customization
- nginx
- Proxy
- Firewall
- Email
- NTP
- Console
- SSH
- Hostname
- IP Address
- DNS
- Web Access URL
Tricks and Tips
- Backup
- Docker
- Jupyter Notebook
- Adding a new disk
- Network Installation
- PCAPs for Testing
- High Performance Tuning
- Removing a Node
- Salt
- Syslog Output
- UTC and Time Zones
- Endgame
Utilities
- jq
- so-allow
- so-elastic-auth-password-reset
- so-elasticsearch-query
- so-import-pcap
- so-import-evtx
- so-monitor-add
- so-status
- so-test
- so-user
Help
- FAQ
- Directory Structure
- Tools
- Support
- Community Support
- Help Wanted
Security Onion Pro
- OpenID Connect (OIDC)
- LUKS
- FIPS
- STIG
- Notifications
- Kafka
Security
- Vulnerability Disclosure
- Product and Supply Chain Integrity
Telemetry
- SOC Telemetry
- Operating System Updates Telemetry
- Airgap
Release Notes
- Known Issues
Appendix
Cheat Sheet