Quick Data Exfiltration Exercise with Security Onion - 2021-07-14

[@kevinellis9239]

I for one really appreciate what you guys have done and seconion 2.0 still impresses me even months after being announced. And these short videos are great definitely keep them coming. Helps give me training ideals for my team

[@security-onion]

Thanks, glad you like it!

[@DONBIZZY3]

Thanks for the video, do you have any resources available for security onion without the GUI, just linux?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@chromefinch]

Awesome walkthrough! Thank you! I tested this with a chrome.exe download, but the hash didn't match. Is that expected?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss. Thanks!

[@brianmattingly8419]

I know this is a bit elementary ... but what installation are you running that you get a GUI? I'm trying to follow along by installing SO in a VMware Workstation VM. I've imported the PCAP (I had to turn it into an .img file and add as a CD-ROM) but can't click on the "You've imported the PCAP, use this very long link" in order to paste it into a browser. Any tips?

[@security-onion]

You can get a GUI by installing the Analyst environment: docs.securityonion.net/en/2.3/analyst-vm.html If you have further questions or problems, please start a new discussion at: securityonion.net/discuss Thanks!

[@ryoka1g]

Greetings i have a question. I have cisco 9200 switch and i have created a span port that i have sent it directly to my esxi (to security onion port for traffic sniffing) and works really good. But i have decided that i dont want the whole payload and total packet capturing. Instead i want NetFlow but i cant find a way to send NetFlow to Security Onion. Is there a way??

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss Thanks!

[@virtual-riot]

A question, how i create custom alerts please help me uu

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@cesaralejandrocalle6959]

Como puedo liberar espacio en mi servidor onion?, que debo borrar?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss