Customizing for Your Environment

This section covers how to customize Security Onion for your environment.

• Network Configuration
  • Management interface
  • Sniffing interface(s)
  • Sample /etc/network/interfaces
  • Wireless interfaces
• Proxy Configuration
  • Docker
  • sudo
  • PulledPork
• Firewall
  • Setup defaults to only allowing port 22 (ssh)
  • Sensors automatically add their own firewall rules to the master server
  • UFW
• Email Configuration
  • so-email
  • Sguil client
  • Manual Configuration
  • Operating System
  • Sguild
  • Wazuh
  • Zeek
  • Elastalert
  • Lack of network traffic
• Changing IP Addresses
  • Update the actual IP address of the management interface
  • Update NSM config files to reflect the new IP address
  • Files to update when changing the IP address
• NTP
  • Modifying
  • IDS Alerts