Time

3 hours 10 minutes

Difficulty

Beginner

CEU/CPE

Security Onion is an open source Network Security Monitoring and log management Linux Distribution. In this course we will learn about the history, components, and architecture of the distro, and we will go over how to install and deploy single and multiple server architectures, as well as how to replay or sniff traffic.

Create Free Account

NEED TO TRAIN YOUR TEAM? LEARN MORE

Already have an account? Sign In »

1.1 Introduction

2.1What is Security Onion?

2.2Monitoring and Analysis Tools

2.3Security Onion Architecture

2.4Deployment Types

3.1Security Onion Download and Installation Part 1

10m

3.2Security Onion Download and Installation Part 2

4.1Server Configuration Demo Part 1

11m

4.2Server Configuration Demo Part 2

14m

4.3Server Configuration Demo Part 3

5.1Server Installation Review

5.2Checking System Services With sostat

5.3Security Onion Web Browser Tools

5.4Security Onion Terminal

8.2Traffic Overview in Kibana

9.4IDS Rules Management

9.5Autocat Rules Management

9.6Other Helpful Commands and Tips

1 minute

10.1Lesson 10 Overview

10.2Wazuh/OSSEC Functionality

10.3DNS Anomaly Detection Script

10.4Domain Stats and Frequency Server

11.1Course Wrap Up

Overall, this course will allow you to learn how to maintain and update Security Onion.

Students should have networking knowledge (TCP/IP, Protocols, Packets, etc.), linux knowledge (mkdir, Is, vi, ifconfig, etc.), and security technology knowledge (IDS, Full Packet Capture, etc).