Security Onion: An Interesting Guide For 2021
Introduction
Back in the early ought’s, a typical grievance about Linux was that while it was free, it accompanied no help, and you needed to pay costly senior sysadmins to run Linux frameworks. Quick forward to now, and Linux has vanquished essentially every field except the desktop market.
A similar dynamic might be created in the log management space, network security monitoring, and enterprise intrusion detection. VC-upheld security contributions with eye-watering tags prices clash with the free Linux distribution Security Onion.
In this article let us look at:
1. What is Security Onion?
Security Onion is an open-source and free Linux distribution for log management, enterprise security monitoring, and intrusion detection. It incorporates NetworkMiner, CyberChef, Squert, Sguil, Wazuh, Bro, Suricata, Snort, Kibana, Logstash, Elasticsearch, and numerous other security onion tools. The simple-to-utilise wizard Setup permits you to build a multitude of sensors distributed for your enterprise in minutes.
2. How does Security Onion work?
Security Onion is at its centre a Kibana (ELK), Logstash and Elasticsearch stack, in addition to a huge load of different whistles and bells, including the Wazuh fork of the open-source host-based intrusion detection system, both the Suricata and Snort rule-based network intrusion detection system, just as the analysis was driven network intrusion detection system Zeek (once known as Bro).
Logstash gathers every one of the logs, Elasticsearch files them to make them effectively accessible, and Kibana allows you to analyse and visualise what’s happening from the wellbeing of your SOC or Security Operation Centre. Kibana incorporates the capacity to pivot to full packet catch and dive into the points of interest of a presumed security incident.
That is still a ton of information to burrow through for IoCs, so Security Onion also accompanies Sguil, which lets Security Operation Centre examiners see all Wazuh, Suricata, and Snort alerts in one spot and permits pivoting from alert into the pertinent packet catch.
If each one of those alternatives makes the choice loss of paralysis, the site flaunts that the “simple to-utilise wizard setup permits you to assemble a multitude of dispersed sensors for your undertaking in minutes!” Your situation will be unique.
The large test in Security Operation Centre today, but, is a torrential slide of bogus positives. Sniffing every one of the things on your devices and networks is achievable utilizing Security Onion. So is analysis and visualization can your Security Operation Centre. Endure the bogus positive rate? That is an inquiry that undertaking security groups should consider cautiously before choosing to send Security Onion in an occupied and alarm uproarious creation climate.
With all due respect, Security Onion appropriately calls attention to in their documentation that security observing is an interaction, not an item, and spending a lot of cash on an item won’t make your security misfortunes mystically vanish.
While correlation and automation can improve knowledge and aid in figuring out bogus positives and noxious pointers, the Security Onion documentation states, there is no trade for human awareness and intelligence. Security Onion is certifiably not a silver shot that you can set up, leave and have a sense of security. Nothing is. Also, if that is the thing that you’re searching for, you’ll never discover it.
3. What’s next for Security Onion?
Security Onion is under the dynamic turn of events. Their public guide incorporates a move away from Debian package arrangement to utilising Docker to help Community Enterprise Operating System or Red Hat Enterprise Linux frameworks all the more without any problem. What made us liven up, in any case, was the alpha arrival of their new Hybrid Hunter programming, which incorporates an open-source Hive response platform.
When Hybrid Hunter Security Onion’s code becomes creation prepared, Combination of The Hive will make it workable for Security Operation Centre experts to heighten occasions in Kibana to dynamic episode reaction cases. The Hive obviously flaunts coordination with the project MISP, the open-source danger intel sharing stage, basically a free form of Virus that any association can set up to share indicators of compromise.
From packet raw capture to incident response, analysis, visualization, searching, indexing, and at last sharing intel threat, the open-source swaps for costly business security items flaunting AI. Indeed, we’re nearly there, right? Security Onion comes up short on the extravagant advertising, doesn’t call “All on board!” on the promotion train, most clearly has a few bugs, and likely requires tweaking to make it work in your undertaking. In any case, recruiting greater security staff members to convey and keep up Security Onion may well end up being less expensive and more viable over the long haul.
Conclusion
Security Onion is an open-source and free intrusion detection system that is not difficult to turn up. It is an extraordinary instructive device for both students and staff. It is possibly appropriate for ventures with the resources and inclination to maintain and deploy their own monitoring solution and intrusion detection system. In the case of nothing else, turning up a Security Onion test deployment is an incredible method to have something to benchmark.
So, have you made up your mind to make a career in Cyber Security? Visit our Master Certificate in Cyber Security (Red Team) for further help. It is the first program in offensive technologies in India and allows learners to practice in a real-time simulated ecosystem, that will give them an edge in this competitive world.
