Threat Hunting with Security Onion
The basics of threat hunting utilizing Security Onion 2.4
Last updated
The basics of threat hunting utilizing Security Onion 2.4
Last updated
Security Onion comes out of the box, well configured for basic threat hunting. There are a few different avenues of approach for drilling down on an alert or suspicious activity. The first is through the SO hunt page, and the second is utilizing Kibana. They both visualize data differently and have different query languages but are ultimately displaying the same data. Please refer to the Security Onion documentation for more information. Moreover, the FREE Security onion essentials training linked at the bottom of the page is a basic overview of how to hunt through Security Onion
The below information is taken from the official Elastic Agent documentation
Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query data from operating systems, forward data from remote services or hardware, and more. A single agent makes it easier and faster to deploy monitoring across your infrastructure. Each agent has a single policy you can update to add integrations for new data sources, security protections, and more.
As the following diagram illustrates, Elastic Agent can monitor the host where it’s deployed, and it can collect and forward data from remote services and hardware where direct deployment is not possible.
A good place to start searching for malicious activity is through the "Alerts" page. This displays Suricata alerts that you can use to drill down.
The dashboards page has multiple pre-made dashboards for visualization of common data in Security Onion
The hunting page shows data metrics for hunt queries on data ingested into Security Onion.
When you find indicators of compromise, you can use the cases tab to create a case for that data. You can store information found in Alerts, Dashboards, and Hunt tab and add comments and manage the case.
In Kibana you can visualize data and create dashboards utilizing the Kibana Query Language and hunt through those dashboards. It offers an alternative to the Security Onion tools. For more information, the videos below provide a basic overview of how to utilize Kibana to hunt
