SOC

stable

Table of Contents

About This Documentation
Introduction
Use Cases
Hardware Requirements
Download/Install
ISO Release Notes
Quick Evaluation using Security Onion ISO image
Quick Evaluation on Ubuntu
Production Deployment
After Installation
UTC and Time Zones
Services
VirtualBox Walkthrough
VMWare Walkthough
Videos
Architecture
Cheat Sheet
Conference

Update/Upgrade

Updating
HWE
Upgrading from 14.04 to 16.04
MySQL Upgrade Errors
EOL

Analyst Tools

Kibana
CapME
CyberChef
Squert
Sguil
NetworkMiner
Wireshark

Network Visibility

NIDS
Snort
Suricata
Bro
netsniff-ng

Host Visibility

Beats
Wazuh
Sysmon
Autoruns
Syslog

Elastic Stack

Elastic Stack
Elasticsearch
Logstash
Kibana
ElastAlert
Curator
FreqServer
DomainStats
Docker
Redis
Data Fields
Alert Data Fields
Bro Fields
Elastalert Fields
Beats
ELSA to Elastic
Re-Indexing

Customizing for your network

Network Configuration
Proxy Configuration
Firewall
Email Configuration
Changing IP Addresses
NTP

Tuning

Managing Alerts
Managing Rules
Adding Local Rules
Disabling Processes
BPF
PF_RING
AF-PACKET
MySQL Tuning
Adding a new disk
High Performance Tuning
Trimming PCAPs

Tricks and Tips

Airgapped Networks
Analyst VM
Automating Setup
Best Practices
Cloud Client
Connecting to Sguild
Disabling Desktop
DNS Anomaly Detection
ICMP Anomaly Detection
Metapackages
PCAPs for Testing
Removing a Sensor
Salt
Sensor Stops Seeing Traffic
SSH

Integrations

AlienVault-OTX
Critcal Stack Intel Client
Etherpad
FIR
GRR
MISP
NtopNG
RITA
Strelka
Integrating with other systems

Help

Support
Help
FAQ
Passwords
Mailing Lists
Help Wanted
Secure Boot
Security
Booting Issues

Other

Directory Structure
Tools

Utilities

jq
so-allow
so-import-pcap

SOC

»
Index
Edit on GitHub

Index

© Copyright 2022. Revision f3e7e527.

Built with Sphinx using a theme provided by Read the Docs.