In this lecture I will introduce security union to you and explain briefly how we will work with it 1
through our lecturers 2
In this course. 3
So Security Onion is a distribution of Linux intended to support security analysts with a suite of 4
tools for network security monitoring including intrusion detection, network security monitoring and log 5
management. The security union distribution is based on the Ubuntu Linux OS and contains several 6
useful security tools that deals with the following data types. 7
Alert data that indicates a possible attack or malicious activity and includes HIDS alerts from OSSEC 8
and NIDS alerts from snort or Suricata. Asset data from bro. Full content data such as full packet captures 9
from netsniff-ng that records all the network traffic packet by packet at specific network locations. 10
Host data via Beats, OSSEC, Syslog and more. Session data from Bro, and it is a summary data that is associated 11
with network conversations. 12
Transaction data that is more than session data but less than full back it captures, since it gives 13
you the details that are associated with the requests and responses. These includes HTTP, FTP, DNS, SSL 14
and other logs from Bro. So first in this course you will create the aim of security union in virtual 15
box and configure its settings and then we will download the iso image of security union then we will 16
install the operating system run the security set up to install the tools update software and install 17
the Linux August editions for Peter integration with the host operating system and beta performance 18
and finally we will learn about how to take snapshots for our VM so that we can revert to them back 19
if something wrong happened or to revisit a previous lecture and practice again with it and I recommend 20
that we take a snapshot after each lecture while you follow me with your practicing. 21
In fact I have used that while preparing and recording discourse. 22
Then we have to analyze bigger files which you can find sample of included with the secret union or 23
download from the Internet and I will show both ways to you 24
and to import or replay those files. 25
We can use either the TCB replay command which changes timestamps of the logs resulted to be of the 26
date of running the comment or we can use the Sue and pickup script that will preserve the original 27
timestamps 28
and then we will work with security information and event management products that provides centralized 29
log management. 30
So first we will learn about Elsa which will be end of life soon. 31
But I found it very useful to learn about how to use and then we will upgrade to key banner and learn 32
about it. 33
And for NSM or network security monitoring we will use squealed so that we can see alerts coming from 34
snort. 35
For example categorize those events and by what into other tools and we can also use script which acts 36
as the web based version of screen so in this lecture I have introduced security union to you and explained 37
briefly how we will work with it through our lectures. 38
In this course.