Security Onion Documentation

Table of Contents

• About
  • Security Onion
  • Security Onion Solutions, LLC
  • Documentation
• Introduction
  • Network Visibility
  • Host Visibility
  • Analysis Tools
  • Workflow
  • Deployment Scenarios
  • Conclusion
• License
• First Time Users
• Getting Started
  • Best Practices
  • Architecture
  • Hardware Requirements
  • Operating System
  • Partitioning
  • Download
  • VMware
  • VirtualBox
  • Proxmox
  • Booting Issues
  • Airgap
  • Installation
  • Amazon Cloud Image
  • Azure Cloud Image
  • Google Cloud Image
  • Configuration
  • After Installation
• Security Onion Console (SOC)
  • Alerts
  • Dashboards
  • Hunt
  • Cases
  • PCAP
  • Grid
  • Downloads
  • Administration
  • Kibana
  • Elastic Fleet
  • Osquery Manager
  • InfluxDB
  • CyberChef
  • Playbook
  • ATT&CK Navigator
• Security Onion Desktop
  • Chromium
  • NetworkMiner
  • Wireshark
• Network Visibility
  • AF-PACKET
  • Stenographer
  • Suricata
  • Zeek
  • Strelka
  • Intrusion Detection Honeypot
• Host Visibility
  • Elastic Agent
  • Syslog
  • Sysmon
  • Autoruns
• Logs
  • Ingest
  • Logstash
  • Redis
  • Elasticsearch
  • ElastAlert
  • Curator
  • Data Fields
  • Alert Data Fields
  • Elastalert Fields
  • Zeek Fields
  • Community ID
  • SOC Logs
  • Other Supported Logs
  • Related Information
• Updating
  • soup
  • End Of Life
• Accounts
  • Passwords
  • MFA
  • Adding Accounts
  • Listing Accounts
  • Disabling Accounts
  • Role-Based Access Control (RBAC)
  • Kratos
  • OpenID Connect (OIDC)
• Services
• Customizing for Your Environment
  • SOC Customization
  • nginx
  • Proxy
  • Firewall
  • Email
  • NTP
  • Console
  • SSH
  • Hostname
  • IP Address
  • Web Access URL
• Tuning
  • BPF
  • Managing Rules
  • Adding Local Rules
  • Managing Alerts
  • High Performance Tuning
  • Salt
• Tricks and Tips
  • Backup
  • Docker
  • DNS Anomaly Detection
  • ICMP Anomaly Detection
  • Jupyter Notebook
  • Adding a new disk
  • PCAPs for Testing
  • Removing a Node
  • Syslog Output
  • UTC and Time Zones
• Utilities
  • jq
  • so-allow
  • so-elastic-auth-password-reset
  • so-elasticsearch-query
  • so-import-pcap
  • so-import-evtx
  • so-monitor-add
  • so-status
  • so-test
• Help
  • FAQ
  • Directory Structure
  • Tools
  • Support
  • Community Support
  • Help Wanted
• Security
  • Vulnerability Disclosure
  • Product and Supply Chain Integrity
• Release Notes
  • 2.4.30 Hotfix [20231204] Changes
  • 2.4.30 Hotfix [20231121] Changes
  • 2.4.30 Hotfix [20231117] Changes
  • 2.4.30 [20231113] Changes
  • 2.4.20 Hotfix [20231012] Changes
  • 2.4.20 [20231006] Changes
  • 2.4.10 Hotfix [20230821] Changes
  • 2.4.10 [20230815] Changes
  • 2.4.5 RC2 [20230807] Changes
  • 2.4.4 RC1 [20230728] Changes
  • 2.4.3 Beta 4 [20230711] Changes
  • 2.4.2 Beta 3 [20230531] Changes
  • 2.4.1 Beta 2 [20230424] Changes
  • 2.4.0 Beta 1 [20230328] Changes
• Appendix
• Cheat Sheet