Security Onion: Difference between revisions

From RARForge
Jump to navigation Jump to search
No edit summary
No edit summary
Line 14: Line 14:


* Disable vs Suppress: http://seclists.org/snort/2011/q3/583
* Disable vs Suppress: http://seclists.org/snort/2011/q3/583


Security Onion uses PulledPork (a perl script maintained by JJ Cummings) that downloads new signatures every night and processes them against a set list of user generated configurations.
Security Onion uses PulledPork (a perl script maintained by JJ Cummings) that downloads new signatures every night and processes them against a set list of user generated configurations.

Revision as of 01:13, 23 April 2013

Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's based on Ubuntu and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!

https://code.google.com/p/security-onion/

http://securityonion.blogspot.com/


noteworthy

https://code.google.com/p/security-onion/wiki/ManagingAlerts


Disable an SID (alert)


Security Onion uses PulledPork (a perl script maintained by JJ Cummings) that downloads new signatures every night and processes them against a set list of user generated configurations.

In a Server/Slave Security Onion environment, you only need to change the configuration file on the server and the rule-update script will sync with the signatures from the Server. As mentioned before, take care in disabling signatures as it can be likely that a more appropriate response is warranted.


  • Edit the disablesid.conf configuration file:

<source lang=text> sudo vi /etc/nsm/pulledpork/disablesid.conf #Security Onion 12.04 sudo vi /etc/pulledpork/disablesid.conf #Security Onion 10.04 </source>

You can also access the disablesid.conf file by clicking Applications->IDS Rules->Disable Downloaded Rules. You will need to provide your password.


  • Append the signature you wish to disable in the format gid:sid. The generator ID is most likely going to be a "1" in most cases. You can check the generator ID by checking the exact signature. If a gid is not listed, it is assumed to be "1".

<source lang=text>

    # Disable the GPL SNMP public access udp signature
    1:2101411

</source>


  • Run the rule update on the server:

<source lang=text>

    sudo /usr/bin/rule-update                #Security Onion 12.04
    sudo /usr/local/bin/pulledpork_update.sh #Security Onion 10.04

</source>


  • Run the rule update on the slave machines:

<source lang=text>

    sudo /usr/bin/rule-update                #Security Onion 12.04
    sudo /usr/local/bin/pulledpork_update.sh #Security Onion 10.04

</source>