Security Onion Lab: How to Install/Configure/Troubleshoot *NEW*

The following is the link to my NEW course with coupon applied - Hands-on Penetration Testing Labs 3.0:
www.udemy.com/hands-on-penetr...
www.udemy.com/hands-on-penetr...
Here's my other courses with coupons applied if interested:
www.udemy.com/kali-linux-hand...
www.udemy.com/kali-linux-web-...
www.udemy.com/network-securit...
www.udemy.com/snort-intrusion...
Commands:
sudo reboot
cd Desktop
gedit terminal.desktop
[Desktop Entry]
Name=Terminal
Exec=/usr/bin/x-terminal-emulator
Terminal=true
Type=Application
Icon=/usr/share/icons/gnome/48x48/apps/gnome-terminal.png
sudo chmod +x terminal.desktop
sudo soup
sudo sostat | less
sudo nsm_sensor_ps-restart
locate zeus
sudo tcpreplay -l 20 -i enp0s8 -t /opt/samples/zeus-sample-1.pcap
URLs:
virtualbox.org
securitonion.net

[@kwesikemet4829]

You are one of the best ever teacher with such clarity that I have ever listen on utube! Millions thanks for this great share!

[@JesseKurrus]

Thanks Kewsi, appreciated.

[@metasploited5790]

Thank you for your time and clear walkthrough :)

[@stephannvibkronsk7690]

Great video. Pretty clear and useful. But, at the end of the process, I am not getting alerts on Squert, having run the exact same steps. Any help with this would be appreciated. Thanks!

[@rewantmehta1]

Hi Jesse Thanks for this wonderful video. I have installed security onion and everything seems to be working fine. When we run the demo av file in it we can see the logs packets and all the relevant information. What do we have to do to use security only to capture live traffic via a spanned port and display traffic details on the kabana dashboard. We have tried everything and unfortunately we are unable to see any live traffic information. Or we can to capture file on a separate PC using wireshark and upload that .pcap ?

[@jorgedelucas3650]

Best tutorial i seen so far!

[@JesseKurrus]

Thanks Jorge.

[@holyindian]

Sir this is fantastic. You made me take my lab to the next level. I was wondering if you could make more videos for beginners like us to take us to the next level after installing the SO. More inclined towards advance setup, and how to monitor, analyze etc stuff. This will not only fill confidence in new users, but will also attract new enthusiasts to try out SO for their lab and enterprises.

[@JesseKurrus]

Thanks @I am Root. Glad you found it helpful. Additional labs will be forthcoming. :)

[@FranGrandees]

Awesome, thanks Jesse!

[@ranjithdoosa]

Can you show how we can access Securityonion Console webpage, In latest version we have lot of ools included in SOC page

[@kenatali9272]

I will be trying it out tonight

[@MarryJane2000]

great tutorial

[@mohbra]

Awesome tutorial I have subd

[@ajaidx]

Can anybody tell how can i put my network interface to promiscuous mode in my vmware workstation pro15

[@idogat3519]

i didn't understand how Security Onion communicate with the host. how data from the host flows to Security Onion - without sharing data from host how sguil for example can show alerts? (i'm new so sorry if the question is not clear enough)

[@piagetblix]

Do you have anymore Videos on Security Onion? Is there an Udemy that focuses on Security Onion you teach?

[@jillianstella]

I've followed every step, up to 'sudo tcpreplay -l 20 -i enp0s8 -t /opt/samples/zeus-sample-1.pcap ', however, Squert is not picking up on trojan alerts. Running on Hyper-V, advice is appreciated.

[@JesseKurrus]

@J, I believe we figured this out earlier. Used an upgrade command which messed up the OS. Only 'sudo soup' should be used to update Security Onion.

[@rewantmehta1]

Hi Jesse Thankyou for this great video. Everything is working fine but I am not able to locate peek app using locate zeus and thus subsequent command is not running. How to resolve this?

[@JesseKurrus]

Hmm, does the PCAP exist in the file system?

[@carlosmoya8909]

Hi Jesse, How are you doing? I really liked your video and full of great information and easy steps to follow. I did have some issues though and I would like some help solving them. I have tried to solve them I have not not had success yet. For instance, I had issues with seeing the quert alerts at the end and I think is because of the two issues. First issue is I couldn't set the network adapter from manual to automatic, once I press "apply" I receive an error" and the second issue is the "so-logstash" service keeps failing on me. I reset the services as you indicated in the video and this is the only service it keeps failing. I hope I could get some feedback and guidance, thank you in advance! Carlos Moya

[@JesseKurrus]

Carlos, completely reinstalling SO. Sounds like something went wrong with the installation.

[@jasonh4329]

Jesse. Good Stuff for noobs. Question about bridging my LAN interface on my laptop to make it the sniffing interface. I'm running VB 6.0 on my laptop (testing) per your setup instructions. Windows 10, Wifi interface connected to my LAN segment (just did NAT inside the VM), physical NIC on the laptop is not configured, but I have it in bridged mode connected to a SPAN of my internet WAN interface on my firewall. enp0s3 - mgmt nic enp0s8 - sniffer nic my win10 physical machine running Wireshark can see all traffic - promiscuously in the VM, tcpdump on the enp0s8 interface can only see broadcast and multicast, the VB settings for Adapter 2 is set to Bridged promiscuous mode - Allow ALL. I don't understand why VB/Ubuntu isn't seeing all traffic. help? also, will the SecOnion tools app see this traffic without additional configuration?

[@JesseKurrus]

Jason, Try posting your question in the SO Google group - groups.google.com/forum/#!forum/security-onion

[@gaganasri8450]

Unable to connect localhost on port 3374 . when I am starting sguil this error was occurring what I have to do?

[@JesseKurrus]

Have you tried restarting the sguil server? sudo nsm_server_ps-restart

[@brycesnevadatrapline3712]

When doing the locate zeus, and the 'sudo tcpreplay -l 20 -i enp0s8 -t /opt/samples/zeus-sample-1.pcap' , the trojan activity did not pop up in squert. after 20 minutes of troubleshooting, I was able to figure out that I didn't necessarily have enough RAM, and that the logstash wasn't working properly. I then tried the 'sudo sosetup-minimal' command, which seemingly fixed everything. Can you make any sense of this?

[@brycesnevadatrapline3712]

absolutely amazing video by the way!

[@JesseKurrus]

Sounds like a coincidence to me.

[@securityroute5254]

I installed SO successfully, and update it, but nothing show on SGUIL, I checked all the services, all OK. I am running SO on VMware fusion (MAC). Any hint?

[@JesseKurrus]

@Security Route, did you run the PCAP through tcpreplay using the correct sniffing interface? Did you try all troubleshooting steps outlined in this video? If so, I'd suggest you wipe out your Security Onion VM and reinstall it, following this video very carefully to rule out any mistakes in your setup. I haven't tested it on VMware Fusion personally. You can use VirtualBox on OS X, so you may want to try using that if you're following my guide.

[@iIovegames]

Good video, thank you!

[@iIovegames]

Not to my self: Security Onion needs 8 GB of memory. Otherwise Logstash cannot run properly.

[@JesseKurrus]

You're welcome @ilovegames.

[@JesseKurrus]

@ilovegames, it's recommended that you have at least 16 GB dedicated to SO.

[@user-wp2hr1bk1p]

so nice, very kind! thanks ^____^

[@4cupsx01]

Very clear instructions thank you. What would you do if you have no domain name? Can't get past this part of the install.

[@JesseKurrus]

Np. Not sure what you mean. No domain name for what?

[@4cupsx01]

@@JesseKurrus on your demo you selected Dhcp during for IP assignment on enps03 but I chose static and inputed the IP info. The next requirement was to enter a domain name.

[@JesseKurrus]

Any reason you can't choose DHCP? If you're not sure what to put for domain, you probably are safe to skip that part. It's only for if you have DNS set up I believe.

[@4cupsx01]

@@JesseKurrus the setup won't allow me to skip. My theory against Dhcp was every the system I might assign a new IP. For setting an interface for monitoring doesn't it need to have a static IP ?

[@niteshthakur2237]

Hi Jesse, Recently i have started my project under which i am configuring SO on AWS to monitor mirror traffic. But unfortunately i am also facing Below issues. >Internet is not working post installation: I am using Ubuntu 16.04, t2.large instance there are 2 interfaces on the instance eth0 and eth1 with no wireless interface. >Somehow elastic stack is also in failed state after installation. During installation i haven't encountered any issues or error which may result in elastic stack failure. I tried restarting ELK stack but it's not working. >AWS mirror events are reaching SO and i am able to see events through tshark on monitoring interface 1(eth1) Not able attach SS for your reference hence pasting output of /etc/network/interfaces and service status for your reference. Need your support to mitigate these issues. **************************************************************************************************** /etc/network/interfaces root@ip-10-1-2-84:~# cat /etc/network/interfaces # This configuration was created by the Security Onion setup script. # # The original network interface configuration file was backed up to: # /etc/network/interfaces.bak. # # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # loopback network interface auto lo iface lo inet loopback # Management network interface auto eth0 iface eth0 inet static address 10.1.2.84 gateway 10.1.2.1 netmask 255.255.255.0 dns-nameservers 10.1.2.84 dns-domain lab.com auto eth1 iface eth1 inet manual up ip link set $IFACE promisc on arp off up down ip link set $IFACE promisc off down post-up for i in rx tx sg tso ufo gso gro lro; do ethtool -K $IFACE $i off; done post-up echo 1 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6 # You probably don't need to enable or edit the following setting, # but it is included for completeness. # Note that increasing beyond the default may result in inconsistent traffic: # taosecurity.blogspot.com/2019/04/troubleshooting-nsm-virtualization.html # post-up ethtool -G $IFACE rx ********************************************************************************************************** SO service outcome root@ip-10-1-2-84:~# sudo so-status sudo: unable to resolve host ip-10-1-2-84: Connection refused Status: securityonion * sguil server [ OK ] Status: HIDS * ossec_agent (sguil) [ OK ] Status: Bro Name Type Host Status Pid Started bro standalone localhost running 6901 19 Sep 12:41:39 Status: ip-10-1-2-84-eth1 * netsniff-ng (full packet data) [ OK ] * pcap_agent (sguil) [ OK ] * snort_agent-1 (sguil) [ OK ] * snort-1 (alert data) [ OK ] * barnyard2-1 (spooler, unified2 format) [ OK ] Status: Elastic stack * so-elasticsearch/usr/sbin/so-elasticsearch-status: line 22: docker: command not found [ FAIL ] * so-logstash/usr/sbin/so-logstash-status: line 25: docker: command not found [ FAIL ] * so-kibana/usr/sbin/so-kibana-status: line 22: docker: command not found [ FAIL ] * so-freqserver/usr/sbin/so-freqserver-status: line 22: docker: command not fo und [ FAIL ] * so-curator/usr/sbin/so-curator-status: line 22: docker: command not found [ FAIL ] * so-elastalert/usr/sbin/so-elastalert-status: line 22: docker: command not fo und [ FAIL ] ************************************************************************************************************************* Thanks in Advance, Nitesh

[@JesseKurrus]

Hey Nitesh. I've never installed it manually over Ubuntu so unfortunately I have no idea. You can try your question in the SO Google group - groups.google.com/forum/#!forum/security-onion

[@tuyenpham7118]

hello, i'm researching through security onion, i see SO apply the alert in download.conf, Can i create the alert in local.conf and use it ? and Can i ignore the alerts in the download.conf? thanks

[@JesseKurrus]

@Tuyen Pham, what I think you're asking is if you can disable all the rules in downloaded.rules and only use the ones in local.rules. There's a few options to disable rules by sid, category, etc. You can disable all sids in downloaded.rules (using a PCRE), leaving only the sids in local.rules enabled. You could also disable all categories and not include any categories in local.rules, or make a new category which pertains to your local.rules and only leave that enabled. Check the following link for further details. github.com/Security-Onion-Solutions/security-onion/wiki/ManagingAlerts

[@tuan23-nguyen96]

@@JesseKurrus nice comment! Thank you sir.

[@postdaddy1236]

How can we import syslog and AV logs in the security onion. Is there a way to import these files without connecting devices? Jesse K

[@JesseKurrus]

Without connecting devices, I'm not sure. Check out the forums in the Security Onion Google group, they can give you an official answer - groups.google.com/g/security-onion?pli=1

[@ringsticker5201]

how do i configure elastalert to send emails in security onion ?

[@JesseKurrus]

@ring Sticker, check this resource - github.com/Security-Onion-Solutions/security-onion/wiki/ElastAlert

[@steveleeminhui1982]

hi. how do i block ftp 21 and smtp 25 using SO?

[@JesseKurrus]

If you mean incoming traffic to SO, it's already blocked by default with iptables. If you're referring to blocking the ports on the network, SO is a passive network security monitoring tool, not an IPS or a firewall.

[@ashwinkumarkandasamy5011]

excellent Video!!!!!!!!!!!! sir now i am started as noob in security monitoring now i want to know how security onion monitor other machines in the network?? is it all other machines in my network need any packages to install?? and how can i make my security onion monitor all my systems in the network.

[@JesseKurrus]

@Ashwinkumar Kandasamy, glad you liked it. If you followed this tutorial, it'll only monitor what's in your Local Area Network (LAN) in your host-only virtual network. If you want to monitor everything, you'll need a more advanced setup with real hardware (core switch, physical Security Onion server, etc.).

[@ashwinkumarkandasamy5011]

@@JesseKurrus thanks for the reply but I want to know it can discover automatically all machines in my LAN or we need do some setup in all machines.

[@JesseKurrus]

Yes, add a virtual machine in the LAN that SO is monitoring and test it.

[@cassiebarker718]

we did everything step by step till time frame of 7:18 minutes. and im getting Fatal : no bootable medium found. can you help with this?

[@JesseKurrus]

askubuntu.com/questions/413594/what-does-no-bootable-medium-found-mean-in-virtualbox

[@babitarimal7693]

Plz help. Cant use wireshark and network miner in sguil.

[@JesseKurrus]

@Babita Rimal, you sure there's a PCAP associated with the alert? I'd have to know details like what error you're seeing (if any) when attempting to view the PCAP with Wireshark/Network Miner from sguil/squert.

[@BananasAreG00d]

Hi, I recently instaled SO, and everything seems to work, except when I try to run curl testmyids.com, I don't get any alerts, I checked if the rule is enabled and it seems to be, so I don't know what could be the problem. I'm totally new to all of this and would appreciate any suggestions

[@JesseKurrus]

Did you try all the troubleshooting steps outlined in this video? Restart sensor, reboot system, check sostat, etc.

[@BananasAreG00d]

@@JesseKurrus yes I did, and the tcpreplay also works and generates alerts, but testmyids doesn't do anything, also I get no alerts while doing anything online. Is there some speciffic way I need to generate traffic?

[@JesseKurrus]

Well if you followed the steps outlined in the video, the sniffing interface is host-only, which would not monitor any traffic via the NAT'd interface utilized to access public-facing websites (e.g. tedsmyids.com). Try replaying one of the malicious sample PCAPs in Security Onion with tcpreplay like I showed at the end of the video.

[@BananasAreG00d]

@@JesseKurrus yes I did and like I said that works perfectly, however I would like to utilize SO to monitor my home network. Do I need to install the production mode, or can I do something like port mirroring on this curent setup that you described in your video, so that I can monitor traffic happening when I visit various sites? If you could help with this or point me in a right direction I would be very grateful. Also I don't know if this is a stupid question or not but is it a problem if I'm using only WiFi connection, does SO work fine with that or does it striclty need to be ethernet connection?

[@JesseKurrus]

So, as far as I know, it needs to be wired. For a home network monitoring setup you can use a switch that has port mirroring or a network tap that'll get all traffic fed to it, and plug in a dedicated SO box. Personally I just have experience installing, configuring, and monitoring it on other people's already existing network infrastructures. You can get a plethora of resources in the SO Google group here if you have any specific questions related to SO setups - groups.google.com/forum/#!forum/security-onion

[@haseeburrehman7981]

can i install SO on centOS 7 ?

[@JesseKurrus]

Security Onion is only compatible with Ubuntu.

[@jadecox4956]

I know this may be tedious, but if possible, can you make a video on how to set up Security Onion with Proxmox? i.e. Mirroring traffic from a switch to a VM on Proxmox?

[@JesseKurrus]

Hey Jade. Never used Proxmox before, but it doesn't appear to be a feasible idea to me. Security Onion works best on real hardware in live environments. Although it may be possible to set up successfully, I've heard there's issues when using SO over virtualization. Why are you trying to mirror switch traffic on Proxmox exactly?

[@jadecox4956]

@@JesseKurrus thanks for the quick reply. I'm just trying to monitor network traffic on my home network for practice. I have an IBM server with promox installed that was given to me, along with a Tp-link switch. I'm planning on installing SO on the server using Proxmox and mirroring traffic from my switch to the SO vm. I've seen a few documentations about using openvswitch, but not 100% sure of the method. I know it's probably easier just to install SO on the server without virtualization, but I did not want to erase Proxmox from the server just yet.

[@JesseKurrus]

Np. That makes sense. There's nothing wrong with doing it for practice, but I think it would be more relevant training to set it up on actual hardware and sniff the SPAN port or get a network tap for the switch and do it that way.

[@jadecox4956]

@@JesseKurrus So I was able to set up SO on Proxmox, and I found a way to mirror traffic from my network to the VM. I tested everything and it works fine (i.e. testmyids and the tcpreplay worked; however the events only showed in squert but not sguil). Any reason why this may be happening? I'm getting all "Ok"s sudo nsm_sensor_ps-restart as well. It's just strange to me that I'm seeing the alert in Squert but nothing in Sguil. Sguil is just empty.

[@JesseKurrus]

Hey Jade. So, Squert pulls alerts from the sguil database, so if one works the other should also. I'm assuming you already tried rebooting. I'd need more information to adequately troubleshoot your problem. Do me a favor and post your issue and the results from "sudo sostat" command to the following Google group so that me and the Security Onion community can assist you better: groups.google.com/forum/#!forum/security-onion

[@Upriva]

Great tutorial. Followed every step, installed and verified smoothly. Still, I cannot log in to any tool. For instance when I log to sguil, it says invalid user name or pass. And I am inputting correct one. I did restart server, everything is OK, but still cannot log in. Anyone has same issue?

[@JesseKurrus]

@Upriva, your user/pass should be what you selected in the Security Onion setup wizard. Either re-run setup or create a new sguil user - sudo nsm_server_user-add

[@andrewoborn4732]

I've got a noob question. At the end of the tutorial when opening Squert, I get a privacy error NET::ERR_CERT_AUTHORITY_INVALID. Should I worry about this? I didn't see it in your video. Any tips?

[@JesseKurrus]

@Andrew Oborn, self signed certificate. Non issue.

[@baohoang3769]

@@JesseKurrus When I have the above problem, what should I do to be able to connect>

[@JesseKurrus]

@bao hoang, click advances and proceed to page.

[@darkspace5762]

I found myself having to baby SO, if I just let it run for a while, something would break and some service would stop.

[@JesseKurrus]

Hey Darkspace, Sorry to hear that. You use Security Onion in production mode in a live environment? My experience has been pretty great by majority regarding Security Onion's performance and reliability.

[@darkspace5762]

@@JesseKurrus No, in a lab environment. Although I used production mode with all features enabled. I wouldn't want to deploy SO in a live environment. I like the idea of being able to do threat hunting with logstash and kibana but, unfortunately I do not view SO as reliable. That's my personal experience.

[@JesseKurrus]

​@@darkspace5762​ just curious, how much RAM and how many processors/cores do you have in your lab setup? If you don't have the proper hardware, SO isn't going to be reliable.

[@jimducroiset1628]

@@JesseKurrus Have used SO in both lab, single and distributed. Sometimes takes a little love to maintain but overall it's an absolutely awesome system to deploy in production.

[@JesseKurrus]

@Jim Ducroiset, same here. SO rocks if you know what you're doing and have good enough hardware.

[@zosmanovic9763]

I installed this on my mums laptop

[@instructormax7888]

please who can help , i need to run command below , how to fix , thanks 1 max@max-VirtualBox:~$ sudo service nsm status ● nsm.service Loaded: not-found (Reason: No such file or directory) Active: inactive (dead) max@max-VirtualBox:~$

[@JesseKurrus]

Try sudo so-status