Other Supported Logs¶
Once there, then select the
syslog option and allow the traffic through the firewall.
Next, configure your pfSense firewall to send syslog to the IP address of your Security Onion box. If you are using pfSense 2.6.0 or higher, make sure that
Log Message Format is set to
BSD (RFC 3164, default). You should then be able to see your firewall logs using the
Firewall query in Dashboards or Hunt.
rita: enabled: True
This will enable the following Elastic Agent inputs:
If you are installing Elastic Agent on a non-Security Onion node or your filenames differ, you will need to copy the Elastic Agent configuration from
/opt/so/saltstack/local/salt/elastic-agent/etc/elastic-agent.yml (or modify on the non-Security Onion node in the normal Elastic Agent configuration file) and emulate the path/filename accordingly.
Once ingested into Security Onion, you should be able to search for RITA logs in Dashboards or Hunt using
event.module:rita | groupby event.dataset. You should be able to see beacon, connection, and dns logs. If the value for
beacon.score in a
beacon record equals
1, an alert will be generated and viewable in Alerts.