Security Onion 2.4

How to install and do a basic configuration of Security Onion 2.4

Introduction

Security Onion 2.4 is the newest version of the Security Onion (SO) open-source suite of tools. It utilizes the Elastic Stack (Consisting of Elastic Search, Logstash, Kibana, Beats, and more) and is one of the primary SIEM's DCO utilizes. Here, we will go over a basic Installation of SO and deployment types. The official documentation linked below goes into more detail on how to utilize the tools.

About — Security Onion 2.4 documentation

Security Onion 2.4

Installation

Installation can be done two different ways.

• Install from the SO 2.4 ISO

• Install from a Rocky Linux machine

The preferred way is via the SO 2.4 ISO and is as simple as mounting the ISO and launching your machine, following the prompts, and finalizing your installation.

Installation via Rocky Linux is as follows (Taken from the official documentation):

If you want to install Security Onion on Rocky Linux 9 Minimal or Ubuntu 22.04 (not using our Security Onion ISO image), follow the steps below. Please note that Ubuntu is not supported for manager nodes and will be phased out in the future.

1. Review the Hardware Requirements and Release Notes sections.
2. Download the ISO image for your preferred flavor of 64-bit Rocky Linux 9 Minimal or Ubuntu 22.04. Verify the ISO image and then boot from it.

3. Follow the prompts in the installer. If you’re building a production deployment, you’ll probably want to use LVM and dedicate most of your disk space to /nsm as discussed in the Partitioning section.
4. Reboot into your new installation.

5. Login using the username and password you specified during installation.

6. Install prerequisites. If you’re using Rocky Linux 9 Minimal:

   sudo dnf -y install git

   If you’re using Ubuntu 22.04:

   sudo apt -y install git curl ethtool

7. Download our repo and start the Setup process:

   git clone -b 2.4/main https://github.com/Security-Onion-Solutions/securityonion
   cd securityonion
   sudo bash so-setup-network

8. Proceed to the Configuration section.

Deployment Architecture

There are three primary ways that DCO deploys Security Onion.

• Standalone

• Distributed

  • Three nodes - Forward, Manager, Search

  • Two nodes - Manager-Search, Forward

The following information is from the SO2.4 documentation as linked above

Standalone

Standalone is similar to Evaluation in that all components run on one box. However, instead of Elastic Agent sending logs directly to Elasticsearch, it sends them to Logstash, which sends them to Redis for queuing. A second Logstash pipeline pulls the logs out of Redis and sends them to Elasticsearch, where they are parsed and indexed.

This type of deployment is typically used for testing, labs, POCs, or very low-throughput environments. It’s not as scalable as a distributed deployment.

Standalone Deployment: https://docs.securityonion.net/en/2.4/architecture.html

Distributed (Three nodes: Forward, Manager, Search)

A standard distributed deployment includes a manager node, one or more forward nodes running network sensor components, and one or more search nodes running Elastic search components. This architecture may cost more upfront, but it provides for greater scalability and performance, as you can simply add more nodes to handle more traffic or log sources.

Distributed Deployment: https://docs.securityonion.net/en/2.4/architecture.html

Distributed (Two nodes: Manager-Search, Forward)

A manager-search node is both a manager node and a search node at the same time. Since it is parsing, indexing, and searching data, it has higher hardware requirements than a normal manager node.

Combine the manager-search with one or more forwarders.