Security-onion: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
Zeile 1: Zeile 1:
 
=Setup=
 
=Setup=
 
+
*[Security Onion Setup]]
==Security Onion Setup==
 
[[Datei:security-onion-1.png]]
 
 
 
==Skip network configuration==
 
[[Datei:security-onion-2.png]]
 
==Evolution or Production Mode==
 
 
 
[[Datei:security-onion-3.png]]
 
 
 
 
 
 
 
[[Datei:security-onion-4.png]]
 
 
 
 
 
 
 
[[Datei:security-onion-5.png]]
 
 
 
 
 
 
 
[[Datei:security-onion-6.png]]
 
 
 
 
 
 
 
[[Datei:security-onion-7.png]]
 
 
 
 
=nsm status=
 
=nsm status=
 
*service nsm status
 
*service nsm status

Version vom 11. August 2016, 08:53 Uhr

Setup

  • [Security Onion Setup]]

nsm status

  • service nsm status
Status: securityonion
  * sguil server                                                                                 [  OK  ]
Status: HIDS
  * ossec_agent (sguil)                                                                          [  OK  ]
Status: Bro
Getting process status ...
Getting peer status ...
Name         Type       Host          Status    Pid    Peers  Started
bro          standalone localhost     running   3049   0      10 Aug 13:20:10
Status: gondor-eth1
  * netsniff-ng (full packet data)                                                               [  OK  ]
  * pcap_agent (sguil)                                                                           [  OK  ]
  * snort_agent-1 (sguil)                                                                        [  OK  ]
  * snort-1 (alert data)                                                                         [  OK  ]
  * barnyard2-1 (spooler, unified2 format)                                                       [  OK  ]

test

  • cat /etc/nsm/rules/local.rules
alert icmp any any -> $HOME_NET any (msg:"ICMP test detected"; GID:1; sid:10000001; rev:001; classtype:icmp-event;)

nsm restart

  • service nsm restart