Peel Back the Layers of Your Enterprise with the NEW Security Onion 2.0!
summary
Security Onion 2.0 is a released, container‑based IDS+host‑logging platform that actually ships: 5,000+ commits over 34 months and a million downloads underpin a Docker + SaltStack design that runs on an ISO or atop CentOS7/Ubuntu18.04. Live demo shows Suricata, Zeek, Stenographer, Strelka, OSQuery/Fleet, Elastic/Kibana/Grafana, Hive integrations, an alerts UI and community id correlation tying network, host and firewall logs to full pcap pivots and case creation.
AI-written summary · about
chapters (33)
- 0:00Start
- 3:40Steve Jobs
- 6:29History of Security Onion
- 11:50Security Onion 2
- 12:24The Challenges of this New Security Onion 2 Platform
- 16:11Alpha Phase
- 16:49History of Security Onion 2
- 17:29How Do I Install Security Onion
- 21:27How Do I Make My Adversaries Cry with Security Onion
- 22:18East-West Visibility
- 25:35Network-Based Ids Alerts
- 27:10Context from Protocol Metadata
- 28:31Full Packet Capture
- 32:00Os Query
- 41:07Hunt Interface
- 42:36Full Packet Capture
- 43:44Cyber Chef
- 44:04Playbook
- 44:36Fleet
- 45:20Attack Navigator
- 50:10Can You Not Run Security Onion in Centos Eight
- 55:05Live Demo
- 56:54The Analyst Workstation
- 58:50Power of Community
- 59:47Sigma Rules
- 1:00:54Yara Rules
- 1:02:16Community Id
- 1:06:59Use Cases
- 1:12:37New Community Support Forum
- 1:15:50Alerts
- 1:18:17Triage
- 1:30:31Http Traffic Grouped by User Agent
- 1:33:33Threat Hunting
related talks
41mState of the Onion
44mLayers of Deception: Intrusion Detection Honeypots w/ Security Onion
33mFree SOC? — how open source tools can come to our aid
23mPeeling the Web Application Security Onion
06mOpensource Container Security: A Brief Overview
43mOpen Source Intelligence Based Intrusion Detection System
30mSOARing with Security Onion
47mContainerizing your Security Operations Center