2.1 What is Security Onion?

00:00

Welcome to Lesson two of intro to Security Onion. I'm your instructor, Carl, and this lesson is all about what security Onion is.

00:10

So for the agenda. First we'll talk about what we're going to talk about in this course. We'll start with a discussion on what security Onion actually is, including a short history and the functionality. Next, we'll discuss the tools that are included in security Onion.

00:25

Then we'll discuss the architecture, and we'll wrap up by discussing deployment types.

00:32

So what is security? Onion?

00:35

This excerpt here is taken from the security Onion website

00:39

Security. Onion is a free and open source. Lennix distribution for intrusion detection, enterprise security monitoring and log management. It includes elasticsearch logs, Dash Cabana Snort Sarah Kata

00:53

Rowe was, ah, Squeal, Squirt, Cyber Chef, Network Minor and many other security tools.

00:59

The easy to use setup wizard allows you to build an army of distributed sensors for your enterprise in minutes

01:07

to build on that description. From the security Onion website Security Onion is an open source network security monitoring and network forensics tool. It was built with ease of deployments and tool interoperability in mind. It's not just a bunch of tools on a No West. They are configured to work together.

01:26

I appreciate this as it makes it much easier to deploy

01:30

Auntie, and the interoperability allows for more fluid investigations, and we'll dig into both of these ideas later on in the course.

01:38

So when people ask me what security Onion is, I like to compare to Cali, Lennox Kelly Lennox. Of course, being it is Lennox distribution that is largely used for penetration testing.

01:49

Well, well. Kelly has used her pen testing security. Onion is used to monitor for attacks from tools like Kelly. They're both similar distributions, but they have very differing ideologies.

02:02

The tool itself is the creation of Doug Burkes. He began the project in 2008 with the first open release in 2009. Over time, it gained a following, and Doug continue to build and rebuild the project.

02:15

In 2014 he founded Security Onion Solutions, which is the business arm of Security onion.

02:23

While the project is free and open source, this comes with a cost of knowing how to maintain a fairly complex piece of software.

02:30

Using open source technologies and a corporate environment might be attractive because that it's free,

02:37

you'll likely end up paying as much, if not more in time spent learning to deploy and maintain the tool.

02:44

Security Onion Solutions offers paid support, training and other service is for corporations that use the tool to help hops at the time sink. That may come from doing everything on your own.

02:54

That may be something to check out. If you're looking at security onion for your business,

03:00

there are several websites. They're maintained by the Security Onion team, the first to hear our security onion dot net and Security Onion solutions dot com. These give information on the project as a whole and what service's are available through security. Onion Solutions

03:17

while they

03:19

they have good info for this course, will spend more time on the documentation site and the Google Group.

03:24

These have more information on deploying and using security onion and there a good place to look when things are broken.

03:35

Security. Onion can be used either as a forensics tool or for continuous monitoring as a network security monitoring tool.

03:42

When using it as a forensics tool, you can configure it as a standalone server, frequently as a V M on your desk top that you can replay P caps on two.

03:52

If you're ever in triage mode after an incident and someone hands you a pea cap that likely contains evidence of a compromise, it can be hard to know where to start by replaying it onto a standalone instance of security Onion, you can have the pea cap parsed out into network classifications. So think of

04:10

D. N s SMTP FTP things like that

04:13

and ran through Ah, ideas such a snort. And this will give you a very good starting place for your investigation.

04:19

When using it as a network security monitoring tool, you deploy multiple servers across your enterprise and gather the traffic in real time via a network tap.

04:30

The traffic is then run through. The same parcel is used in a standalone instance, but the traffic is coming and continuously.

04:38

This allows you to see what is coming in and going out of your network. Since all of the traffic is run through an I. D. S, you can then see what types of attacks are being thrown at you.

04:46

If you were, if you ever wanna have some fun at home, set up an instance to monitor what is hitting your home network. You may be surprised what's coming in.

04:56

Both types of installations will gather all the network traffic and stored in a searchable format. The amount of data stored will obviously depend on how much stored you have on your server and how much traffic you're throwing at it.

05:09

For example, a fully saturated, one gigabit per second pipe will require you to store seven and 1/2 gigabytes per minute