brief description of security onion their services and agent registration

1. SECURITY ONION
Muhammad Jalal Shah

2. Version
• Security Onion (16.04.5.4)
• Oracle VM Virtual Box Manager (15.04)
• Wazuh Windows Ossec Agent (v3.7.2)

3. Security Onion

4. Necessary Services

5. Security Onion - Performance
• High Performance
oSnort,Suricata,Bro running on PF_RING
• ELK (Elastic Search, Logstach, Kibana)
oCollectively called ELK
oLogstach: contain logs from different sources
oElastic Search: provide storage and indexes to logstach
oKibana: is used to visualized the data

6. Data Types

7. Data Flow (Agent to Manger )

8. Agent Registration

9. Continue…

10. Monitoring Tool
• Squert
oSquert is a web application that is used to query and view
event data stored in a Sguil database (typically IDS alert
data)

11. Kibana
o is an open source data visualization tool

12. Continue…

13. Where do we go?