Security Onion

5:01

Security Onion Essentials 2024 Course Wrap Up

4 ай бұрын

16:19

Security Onion Essentials 2024 Detection Engineering

4 ай бұрын

17:20

Security Onion Essentials 2024 Threat Hunting

4 ай бұрын

16:11

Security Onion Essentials 2024 Alert Triage and Case Creation

4 ай бұрын

8:11

Security Onion Essentials 2024 Updating

4 ай бұрын

20:20

Security Onion Essentials 2024 Intro to Analyst Tools

4 ай бұрын

10:28

Security Onion Essentials 2024 Installation Part 2

4 ай бұрын

6:34

Security Onion Essentials 2024 Installation Part 1

4 ай бұрын

12:32

Security Onion Essentials 2024 Introduction

4 ай бұрын

7:56

Sneak Peek: New Detections Feature coming in Security Onion 2.4.70!

7 ай бұрын

13:42

Collecting Endpoint Logs with Elastic Agent

9 ай бұрын

13:14

Ingesting PFSense Logs with Security Onion 2.4

10 ай бұрын

46:52

Introduction to Security Onion 2.4

Жыл бұрын

37:36

State of the Onion 2023

Жыл бұрын

1:05:42

Achieving PEAK Performance: Introducing the PEAK Threat Hunting Framework

Жыл бұрын

31:53

Defensive Intel with Security Onion

Жыл бұрын

25:02

Enrich Your Data and Your Life

Жыл бұрын

31:57

They're digging in the wrong place: Diagnosing and dealing with one-sided traffic

Жыл бұрын

46:08

Phish Fights and Not So Long Nights with Security Onion and Sublime Platform

Жыл бұрын

58:22

Security Onion Conference 2023 Keynote

Жыл бұрын

5:17

What's New in Security Onion 2.4

Жыл бұрын

13:44

Introduction to Analyzers in Security Onion

2 жыл бұрын

51:36

Detecting Suspicious Activity on Linux Endpoints Using Security Onion

2 жыл бұрын

30:18

Watching the Watchers: Layering Detection and Deception to Defend Visibility

2 жыл бұрын

52:04

SOAR, SOC, and Scholars - How UofSC Develops its Security Operations Processes, Staff, and Students

2 жыл бұрын

38:27

Increasing your Situational Awareness with SOC Dashboards

2 жыл бұрын

41:03

Tuning ICS Security Alerts: An Alarm Management Approach

2 жыл бұрын

31:11

State of the Onion

2 жыл бұрын

15:35

Security Onion Dashboards

2 жыл бұрын

Пікірлер

@SimplyAwesomeness Ай бұрын

Every homelab needs this.

@nico3006 Ай бұрын

is it okay if i install to a external SSD?

@security-onion Ай бұрын

You can try it, but we do not recommend or support it. If you have further questions or problems, please start a new discussion at securityonion.net/discuss

@and_still. Ай бұрын

Can you help me? I am not seeing any alert nor any data in any tools like kibana , etc... Iam trying to find out for more than 1 week.

@security-onion Ай бұрын

If you have questions or problems, please start a new discussion at securityonion.net/discuss and provide detailed information.

@waseemalkurdi759 Ай бұрын

Thank you, It's very useful video.

@security-onion Ай бұрын

Thanks, glad you like it!

@swaterstsiafadray329 2 ай бұрын

Hi! how to do this with a Eval mode? Thank you!

@security-onion 2 ай бұрын

It should work the same for Eval mode. If you have further questions or problems, please start a new discussion at securityonion.net/discuss. Thanks!

@Dyosef95 3 ай бұрын

i try to install the nachine as shown in the video , in the end of the installation there is no way to access the web interface , i got the directory of the security onion on the machine but dont know what to do

@security-onion 3 ай бұрын

If you have questions or problems, please start a new discussion at securityonion.com/discuss. Thanks!

@Sa-bk8cl 23 сағат бұрын

I'm facing the same problem. Were you able to solve this problem?

@hariomojha2729 3 ай бұрын

Hello sir , I am stuck at : 0curl: (6) Could not resolve host:sigs.securityonion.net , So can you please help me with this issue

@AngeliteEntyshak 3 ай бұрын

I am extremely excited to get my home lab set up. Thanks for the concise series, dude!

@security-onion 3 ай бұрын

Happy hunting!

@Bike1337 3 ай бұрын

Excellent work

@TheSoliver84 4 ай бұрын

Hello, now I ask again: in the evaluation version, are the results under Alert real or placeholders?

@security-onion 3 ай бұрын

The alerts are real. If you have further questions or problems, please start a new discussion at securityonion.com/discuss. Thanks!

@TheSoliver84 4 ай бұрын

Are there real alarms in the evaluation or are the placeholders not real?

@security-onion 3 ай бұрын

The alerts are real. If you have further questions or problems, please start a new discussion at securityonion.com/discuss. Thanks!

@TheSoliver84 3 ай бұрын

@@security-onion OK, how do I find the corresponding computers or devices? Only IP addresses are displayed but no MAC addresses.

@security-onion 3 ай бұрын

You may be able to find MAC addresses by pivoting to PCAP and then opening that PCAP in Wireshark or some other PCAP utility. However, depending on how you're monitoring traffic, the MAC addresses shown may not actually be the MAC addresses of the actual endpoints. For this reason, most folks focus on IP addresses rather than MAC addresses. Depending on your network, you may be able to correlate an IP address to an actual device via DNS, DHCP, or other means. If you have further questions or problems, plese start a new discussion at securityonion.com/discuss rather than replying here on KZbin. Thanks!

@ibejoe7719 4 ай бұрын

My adversaries will grid their teeth after weeping....there's a need for a cert of completion to proof the understanding on how to peel the onion

@security-onion 3 ай бұрын

Thanks for watching Security Onion Essentials 2.3. Please keep in mind that Security Onion 2.3 has reached End Of Life and so we recommend watching Security Onion Essentials 2.4 for the latest and greatest. Regarding certificate of completion, we do offer that for our paid training classes at securityonion.com/training. We also offer the SOCP (Security Onion Certified Professional) at securityonion.com/certification.

@ibejoe7719 4 ай бұрын

Good stuff....thanks for sharing

@security-onion 4 ай бұрын

Thanks for watching!

@L3af0553 4 ай бұрын

I have watched the install videos and you installed the eval version, i plan on installing the desktop version and am wondering if i will still need to use the web interface to monitor traffic

@security-onion 4 ай бұрын

You will need some kind of web browser whether its inside the Security Onion Desktop or on some other machine. If you have further questions or problems, please start a new discussion at securityonion.net/discuss. Thanks!

@AbuFaizal 4 ай бұрын

thanks for video

@security-onion 4 ай бұрын

You're welcome!

@callmebigpapa 4 ай бұрын

Thank you so much this is great. You are a gifted teacher.

@security-onion 4 ай бұрын

Thanks for your kind words!

@WatsonInfosec 4 ай бұрын

Thanks

@security-onion 4 ай бұрын

You're welcome!

@fatushcorner 4 ай бұрын

Thank u ☺️

@security-onion 4 ай бұрын

You're welcome!

@edvloesungen 5 ай бұрын

Thank you very much!

@security-onion 5 ай бұрын

You're welcome!

@andreantunes7310 6 ай бұрын

miss the suricata and logs of apps of pfsense, but great work, keep doing more, and integrations with flux

@fuzzyEuclid 6 ай бұрын

An osquery video would be awesome :)

@CageYim 6 ай бұрын

I saw "Evaluation installs and Import installs do not support remote elastic agents. The links below are shown for demonstration purposes only." after I installed the eval version security onion following your installation guide video, is that means I have to install to other mode? Thank you.

@security-onion 6 ай бұрын

If you want to deploy the Elastic Agent to remote devices, then you will need to install in STANDALONE mode or do a full distributed deployment. For more information, please see the documentation at docs.securityonion.net/en/2.4/architecture.html. If you have further questions or problems, please start a new discussion at securityonion.com/discuss. Thanks!

@CageYim 6 ай бұрын

@@security-onion Thank you very much. Let me try again.

@flyingbyalexeiroudnev9750 6 ай бұрын

I do not see a way to change severity by one click, or to suppress alert temporarily, or to automatically get IP etc from alert. So it looks as a good step but it is ONLY a FIRST STEP. For example,. we reclassify events in Zabbix all the time, we set up timed reclassifications often, we may need to update a GROUP of Detection rules at once. Idea is great but it looks as very first implementation yet. (Of course I can clone the rule, then change severity in the cloned rule and disable original rule. but why to do it so complicated? or we want to suppress all alerts 'traffic with ... group' whch we do by re: expression today - it's not implemented yet (looks this way) and there are 50+ IP groups and about 10 alerts per group... so what disable can do by single re: rule, detection will require 100 updates (looks like this).

@security-onion 6 ай бұрын

Yes, we have lots of improvements coming. If you have further comments or questions, please start a new discussion at securityonion.com/discuss.

@GarethLedger-pz6wl 6 ай бұрын

Any chance you paste the various command line inputs

@capitalreg318 7 ай бұрын

Oh this will be very useful. Cool feature indeed, thank you!! Two things: 1. Any possibility of adding an optional Elastic Defend/Predefined Rules integration to that Detections menu? Currently it is buried in Kibana and requires some additional digging to add the Predefined Rule integration, then unhide the Security tab Kibana Spaces? 2. Any chance of upgrading the OSquery Manager to the Velociraptor platform to integrate that amazing tool's DFIR capabilities with the SOC/Elastic Agent?