Using Security Onion

Security Onion consists of a set of Free Open Source Software (FOSS) tools that you can install on your own local Linux machine. It’s also offered as a pre-built Linux distro image, which is really the preferred method of installation. In the previous editions of this book, I showed you the original version of Security Onion, which was built on Xubuntu Linux. This version had a graphical desktop interface, used Snort 2 as the IDS, and included several graphical front-ends for Snort. The new Security Onion 2 is a completely different animal. It’s now built on a text-mode installation of CentOS 7, and offers way more functionality over the original version. In addition to using it as an IDS/IPS, you can now use it as a forensics analyzer, a log file aggregator, and a log file analyzer. For log file collection and analysis, it includes the ELK stack.

ELK stands for Elastic Search, Logstash, and Kibana. Logstash, used with the appropriate...