securityonion
core
| securityonion | core | |
|---|---|---|
| 7 | 241 | |
| 2,878 | 2,997 | |
| 3.9% | 2.6% | |
| 8.8 | 9.9 | |
| 4 days ago | about 23 hours ago | |
| Shell | PHP | |
| - | BSD 2-clause "Simplified" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
securityonion
-
Security Onion on Proxmox with Linux Bridges and LACP Bond
I'm trying to get Security Onion running in my lab on my Proxmox server. I'm having trouble getting my WAN traffic to my SO VM. My WAN comes in on VLAN 100 to my switch and goes to my router (Virtual VyOS on the same physical host). I have a ton of VMs and really don't want to move to OVS if I don't absolutely have to. I found this discussion which included some commands for getting SO working on a Linux bridge, but this didn't work for me. Probably because my environment is different. Does anybody have SO setup this way? If so, how did you do it?
- Do I need to be concerned? Ipinfo.io says the ip adress is from Slovakia.
- Elastic Stack 8.2 and Suricata Integration
- Security Onion 2: #distro de #Linux para la caza de amenazas, la supervisión de la seguridad empresarial y la gestión de registros 💯
-
FOSS Deep Packet Inspection Options
https://securityonionsolutions.com/software/ https://github.com/Security-Onion-Solutions/securityonion
-
PFsense vs Mikrotik
I have been debating in my head whether to keep my current setup (PFsense on an old laptop) or buy a 'proper?' solution, by this I mean specialised hardware. PFsense has had a few issues like randomly dropping out, but it has been fine for around 4 days now. My question is: Should I buy a Mikrotik HEX S and use the laptop for other things, or not buy a Mikrotik and instead buy a Dell Optiplex 3020 from Ebay and run SecurityOnion (https://github.com/Security-Onion-Solutions/securityonion) or pfELK (https://github.com/pfelk/pfelk) on it.
-
SecurityOnion
Community support is here. You can also purchase support from the developers on their website.
core
-
Dnsmasq wins the first BlueHats Prize
dnsmasq can be used for wildcard domain aliases in OPNsense firewall, https://github.com/opnsense/core/issues/4145#issuecomment-12...
- OPNsense Wildcard Support in Firewall Host Alias (2022)
-
How to bypass public IP and NAT
Firmware's like Asuswrt-Merlin or OpenWRT can support dynamic-dns, or you can do like I do and run something like OPNsense in an x86 VM with a NIC passed through, or buy an inexpensive firewall appliance (up to 500mbps/1gbps/10gbps).
-
Stop ISP from getting into my Router
The easiest solution is to buy your own router, set it up, disable the router functionality on the Fritzbox 7590 and plug your router into it. It'll be cheaper and easier than a Cisco Firewall, but if you want to go the dedicated firewall route then I would recommenced OPNsense
-
Near Constant PTR lookups from localhost
Much searching lead me to a possible patch Unbound.inc for how it was handling aliases for 23.7 -> https://github.com/opnsense/core/pull/5925
-
The world in which IPv6 was a good design
[2]: https://github.com/opnsense/core/issues/2544
-
OpenBSD Innovations
BSDs may not have a significant presence on desktops, but they're well known in the networking world for their reliability. They also were the foundation used to build OSes for specific applications. OpnSense and XigmaNAS, for example, are two excellent FreeBSD based applications aimed at firewalling/security and NAS/services.
https://opnsense.org/
https://xigmanas.com/xnaswp/
- Root user access denied when adding new users?
- OPNsense: Open-source security platform
What are some alternatives?
arkime - Arkime is an open source, large scale, full packet capturing, indexing, and database system.
docker-pihole-unbound - Run Pi-Hole + Unbound on Docker
Malcolm - Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
openwrt - Linux distribution for embedded devices
pfelk - pfSense/OPNsense + Elastic Stack
openNDS - openNDS (open Network Demarcation Service) is a high performance, small footprint, Captive Portal. It provides a border control gateway between a public local area network and the Internet.
nDPI - Open Source Deep Packet Inspection Software Toolkit
asuswrt-merlin.ng - Third party firmware for Asus routers (newer codebase)
AIMOD2 - Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proactively identify, engage and prevent cyber threats denying or mitigating potential damage to the organization.
UTMFW - UTM Firewall on OpenBSD
hardening - Hardening Ubuntu. Systemd edition.
unifios-utilities - A collection of enhancements for UnifiOS based devices