Security Onion
3h 10mBeginner2024-06-10
Authors
Cybrary
Course details
Security Onion is an open-source network security monitoring and log management Linux distribution. In this course, explore the history, components, and architecture of the distribution to improve your networking skills. Learn how to install and deploy server architectures, as well as how to replay or sniff traffic.
Skills covered
Incident ResponseCybersecurityOne-Off
Concepts
Introduction
- Introduction
What Is Security Onion
- What is Security Onion
- Monitoring and analysis tools
- Security Onion architecture
- Deployment types
Installing a Standalone Server
- Security Onion download and installation, part 1
- Security Onion download and installation, part 2
Installing a Distributed Environment
- Server configuration demo, part 1
- Server configuration demo, part 2
- Server configuration demo, part 3
Reviewing the Installation
- Server installation review
- Checking system services with sostat
- Security Onion web browser tools
- Security Onion terminal
Resources
- Resources, part 1
- Resources, part 2
Replaying Traffic on a Standalone Server
- Tcpreplay, part 1
- Tcpreplay, part 2
- Tcpreplay, part 3
- Review
Sniffing Traffic in a Distributed Environment
- Sniffing traffic
- Traffic overview in Kibana
- SSH success
Management Tips and Best Practices
- Lesson overview
- Salt tips
- Proxy settings
- IDS rules management
- Autocat rules management
- Other helpful commands and tips
Other Functionalities
- Lesson overview
- Wazuh OSSEC functionality
- DNS anomaly detection script
- Domain stats and frequency server
Conclusion
- Course wrap-up