Quick Data Exfiltration Exercise with Security Onion - 2021-07-14

Special thanks to Brad Duncan for sharing this pcap at malware-traffic-analysis.net!
www.malware-traffic-analysis....
If you’re a blue teamer, make sure you hit that Like button and make it turn blue! Don’t forget to subscribe to the channel to help us reach 6,000 subscribers! If you have any words of encouragement for the Security Onion team, please feel free to leave them in the comments below. For questions and problems, please go to securityonion.net/discuss and start a new discussion there.
Download Security Onion:
securityonion.net/download
Documentation:
securityonion.net/docs
Questions or Problems:
If you have questions or problems, please feel free to create a discussion at securityonion.net/discuss
Training:
securityonionsolutions.com/tr...
Hardware Appliances:
securityonionsolutions.com/ha...

[@kevinellis9239]

I for one really appreciate what you guys have done and seconion 2.0 still impresses me even months after being announced. And these short videos are great definitely keep them coming. Helps give me training ideals for my team

[@security-onion]

Thanks, glad you like it!

[@brianmattingly8419]

I know this is a bit elementary ... but what installation are you running that you get a GUI? I'm trying to follow along by installing SO in a VMware Workstation VM. I've imported the PCAP (I had to turn it into an .img file and add as a CD-ROM) but can't click on the "You've imported the PCAP, use this very long link" in order to paste it into a browser. Any tips?

[@security-onion]

You can get a GUI by installing the Analyst environment: docs.securityonion.net/en/2.3/analyst-vm.html If you have further questions or problems, please start a new discussion at: securityonion.net/discuss Thanks!

[@DONBIZZY3]

Thanks for the video, do you have any resources available for security onion without the GUI, just linux?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@ryoka1g]

Greetings i have a question. I have cisco 9200 switch and i have created a span port that i have sent it directly to my esxi (to security onion port for traffic sniffing) and works really good. But i have decided that i dont want the whole payload and total packet capturing. Instead i want NetFlow but i cant find a way to send NetFlow to Security Onion. Is there a way??

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss Thanks!

[@chromefinch]

Awesome walkthrough! Thank you! I tested this with a chrome.exe download, but the hash didn't match. Is that expected?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss. Thanks!

[@gguestdub3518]

A question, how i create custom alerts please help me uu

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@cesaralejandrocalle6959]

Como puedo liberar espacio en mi servidor onion?, que debo borrar?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss