State of the Onion
summary
Announces Security Onion 2.3.80 and demos importing a pcap into the stack, surfacing a curl User‑Agent alert from Suricata, pivoting to full PCAP and sending the session to CyberChef to strip HTTP, decode binary→hex→base64 and extract an image, then correlate via community id to find the originating Windows Sysmon process. Adds a new so-import-evtx utility, role‑based access control, optional Elasticsearch clustering for new installs, Azure marketplace image, certification and portable “go now / go fast / go big” response appliances.
AI-written summary · about
chapters (16)
- 0:00Welcome and thanks
- 1:57Audience participation
- 4:04Daily malware analysis demo
- 19:31Importing host data with so-import-evtx
- 20:53Role-based access control
- 22:37Elastic clustering support
- 25:04Azure marketplace image
- 26:31Printed documentation book
- 27:55Supporting rural tech fund
- 28:17New certification announcement
- 29:04Case studies course coming
- 29:48Ubuntu 20.04 support
- 30:33Roadmap for next year
- 33:06Response ready appliances
- 38:09Company hiring plans
- 39:34Q&A
related talks
01h 45mPeel Back the Layers of Your Enterprise with the NEW Security Onion 2.0!
33mFree SOC? — how open source tools can come to our aid
04h 02mOpen-source Tools for CSIRTs
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
23mPeeling the Web Application Security Onion
01h 27mOpen-source Tools and CSIRT Success Stories
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
45mAdvanced Security Operations with Elastic Security