Securityonion Versions Save

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

2.3.300-20240401

1 month ago

2.4.60-20240320

1 month ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.60-20240320.iso

What's Changed

Cogburn/detection playbooks by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12296
2.4/dev by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12357
Update VERSION by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12385
replace correlate icon to avoid confusion with searcheng.in by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12386
Update soup by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12348
add lock threads by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12396
add missing template by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12408
Initial Support for Detections Module by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12412
nest under policy by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12411
Fix Loss Calculation for Stenographer by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12416
convert x to . for soc ui to config by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12423
Feature/sigma pipeline by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12430
Add Detection AutoUpdate config by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12431
Update pattern for endpoint diagnostic template by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12432
Add multiple endpoint features by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12434
Airgap Support - Detections module by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12437
Issue/12391 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12449
Roll Suricata logs daily to prevent alerts from being deleted when not meeting size threshold by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12450
Feature/detections airgap by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12456
Manage the repo files by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12405
FIX: EA installers not downloadable from SOC & fix logging by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12469
2.4/sigma pipeline by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12482
Fix FIM by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12487
Suricata PCAP by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12271
fix sensoroni for non sensor by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12497
Update so-minion by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12502
Additional Integrations #5 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12500
fix oinkcodes with leading zeros by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12507
fix pcapspace function by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12508
PCAP annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12511
Add Exclusion toggle by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12510
detections annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12514
Change Factoring for so-minion pcap disk space by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12513
Add error.message mapping for system.syslog by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12519
gracefully handle status check failure on ubuntu by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12521
unswap files by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12526
allow managersearch to receiver redis and 5644 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12537
FIX: Update SOC annotations for Stenographer PCAP #12539 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12540
Fix Space Free for Steno by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12527
Updated RulesRepo for New Strelka Structure by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/12542
Update soc_pcap.yaml by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12545
Run scan against default scap security guide so that resulting score is accurate by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12553
Create local salt directory by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12555
pcap improvements by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12544
auto-convert email addresses to lowercase during setup by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12560
transitional pcap by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12561
Add yara update back by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12563
2.4/detections defaults by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12565
Update soc_suricata.yaml by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12564
Update so-saltstack-update to use 2.4/main by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12567
Gen packages post-SOUP by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12576
remove modules if detections disabled by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12577
Update init.sls by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12579
removed unused property by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12581
handle airgap when detections not enabled by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12584
Update soc_suricata.yaml by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12587

Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.4.50-20240220...2.4.60-20240320

2.3.290-20240229

2 months ago

2.4.50-20240220

2 months ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.50-20240220.iso

What's Changed

Update VERSION by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12197
Add Suricata IKE pipeline by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12201
Add stig state by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12202
Remove need for stig script by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12206
Update metrics for telegraf by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12208
Update soup by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12213
Add stig pillar dir during soup by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12214
Update suricata.common by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12216
Disable stigs setting/verifying umask is set to 077. Known issue with … by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12220
Additional integrations #4 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12221
Handle non-zero by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12230
RITA Logs by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12227
Exclude specific Strelka key values by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12241
UPGRADE: Strelka 0.24.01.18 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12240
Fix quote by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12242
standardize feature names by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12248
Fix PE Flags by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12250
Add template for endpoint.diagnostic.collection by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12260
Update soup by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12267
Remove remediate from initial oscap scan by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12283
fix salt lock for airgap version mismatches by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12293
Manage custom Elasticsearch and Logstash pipelines in UI by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12297
Jppffa by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12294
FEATURE: Improve Correlate and Hunt actions on SOC Actions menu #12315 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12316
FEATURE: Add new dashboards for community_id and firewall auth #12323 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12324
Salt3006.6 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12325
Fixup shell by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12333
Salt3006.6v2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12337
Add putty to SOD by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12332
Wait for ES to be ready by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12343
Feature/fleet artifacts by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12268
FIX: Remove intca symlink on reinstall by @petiepooo in https://github.com/Security-Onion-Solutions/securityonion/pull/12290
FEATURE: Check for mountpoint during Elastic size limit calculations by @petiepooo in https://github.com/Security-Onion-Solutions/securityonion/pull/12308
Remove unused file by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12346
Fix conflicting id by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12349
FEATURE: Add new SOC action to show process ancestry #12345 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12350
Add table columns to process dashboard in defaults.yaml by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12355
modify soup to update soup scripts using salt by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12354
`2450soup by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12360

Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.4.40-20240116...2.4.50-20240220

2.4.40-20240116

3 months ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.40-20240116.iso

What's Changed

Update VERSION by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/11778
FIX: SOC Hunt HTTP EXE query #11784 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/11785
avoid startup error by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11792
improve timing of responses by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11809
Merge hoftix back to 2.4/dev by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11832
add support for nested keys by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11835
Jertel/hfm by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11855
Ignore analyzer log by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11891
Add certificate fingerprints by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11896
FIX: Update NIDS rule.reference in common.nids pipeline #11846 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/11897
Sublime Platform Analyzer by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11945
Add eml observable type by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11950
Fix indentation for rule_results by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11954
Sublime Analyzer Documentation by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11955
Merge Main into Dev by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/11957
FIX: Documentation links under SOC - Administration - Configuration need updating #11828 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/11960
Remove Curator close configuration by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11967
grid page enhancements by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11970
fix import stats by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11981
Remove Curator by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11990
upgrade cla action by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11998
FIX: Update clear scripts #11991 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12001
Additional Integrations #2 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12000
more log false alarms by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12012
fix extra_hosts by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12019
Add force option to integrations by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12020
FIX: Update dashboard and hunt query for firewall logs #12021 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12023
Fix receivers by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12037
exclude log false positives by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12047
2.4/dev Analyzers for Threatfox, MalwareBazaar, Echotrail, Elasticsearch by @HoangLongVu in https://github.com/Security-Onion-Solutions/securityonion/pull/12003
FIX: Update dashboard and hunt query for firewall logs #12021 by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/12048
Fix analyzer images by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12052
2.4/main by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12053
Curator Remove Changes by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12062
Ignore Curator logs by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12063
only run the file.absent state if there are files to delete by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12067
exclude transient influxdb error by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12071
show last highstate date/time on grid metrics screen; expose maxUploa… by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12090
Change salt-minion startup_states by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12095
2.4/main by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12102
Add brasero to packages list for SOD by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/12109
Issue/12033 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12116
enable startup_states: highstate on managers during setup and not wit… by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12118
Update so-raid-status for SM based appliances by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12120
Fix/fim by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12138
Fix/fleet reset by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12141
Salt3006.5 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12144
exempt transient license check errors by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/12149
Update so-functions by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12154
Fix reinstall & reset stability by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12151
Update soup by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/12155
Upgrade Navigator and fix Playbook layer by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12156
Additional Supported Integrations #3 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12160
Check Kibana API not Web by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12161
Make sure optional integration pillar values are merged with defaults by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12164
Remove old nav layers by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/12170
Merge 2.4 dev by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12171
Add endpoint metrics templates by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12173
FIX: OTX pulses template by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/12176
Needsrestarted by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/12192

New Contributors

@HoangLongVu made their first contribution in https://github.com/Security-Onion-Solutions/securityonion/pull/12003

Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.4.30-20231228...2.4.40-20240116

2.4.30-20231228

4 months ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231228.iso

2.4.30-20231219

4 months ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231219.iso

2.4.30-20231204

5 months ago

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231204.iso

What's Changed

Update HOTFIX by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11902
Update import-evtx-logs.json by @chateaulav in https://github.com/Security-Onion-Solutions/securityonion/pull/11890
move wait_for_salt_minion for hotfix by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11923
avoid exiting salt when ca state applied in post for 2.4.30 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11929

New Contributors

@chateaulav made their first contribution in https://github.com/Security-Onion-Solutions/securityonion/pull/11890

Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.4.30-20231121...2.4.30-20231204

2.3.280-20231128

5 months ago

What's Changed

Update VERSION by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/11506
Zeek 6 upgrade by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/11561
Update soup by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/11749
Add EOL warning to README.md by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/11771
Elastic 8.10.4 by @weslambert in https://github.com/Security-Onion-Solutions/securityonion/pull/11772
Update soup by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11798
Update signing_policies.conf by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/11831
Update signing_policies.conf by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/11834
suricata interface None if so-import by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11864
enable highstate after starting minion by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11873
so-nginx watch managerssl to restart if changed by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/11874

Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.3.270-1006...2.3.280-20231128

2.4.30-20231121

5 months ago