Elastic

We are currently working on integrating Elasticsearch, Logstash, and Kibana!

In addition, we've added Docker containers for the following:

Curator
DomainStats
ElastAlert
FreqServer

You can get an idea what this might look like at a high-level by viewing our proposed architecture diagram.

For more information, please see:
http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html

Hardware Requirements

Please note the following MINIMUM requirements for the Elastic stack:

• 2 CPU cores
• 8GB RAM

Warning

Our Elastic integration is currently in Alpha and so the usual warnings and disclaimers apply:

• Experimental Setup is ALPHA, BLEEDING EDGE, and TOTALLY UNSUPPORTED!
• If this breaks your system, you get to keep both pieces!
• This is a work in progress and is in constant flux.
• This is intended to build a quick prototype proof of concept so you can see what our ultimate Elastic configuration might look like. This configuration will change drastically over time leading up to the final release.
• Do NOT run this on a system that you care about!
• Do NOT run this on a system that has data that you care about!
• This should only be run on a TEST box with TEST data!
• Experimental Setup may result in nausea, vomiting, or a burning sensation.

Installation

The easiest way to try the new Elastic integration is using our 14.04.5.3 (or newer) ISO image: http://blog.securityonion.net/2017/09/elastic-stack-alpha-release-and.html

If you want to install using an ISO image other than our 14.04.5.3 (or newer), you can install using your preferred ISO image and then install the securityonion-elastic package, run so-elastic-download, and then run sosetup as follows:

sudo soup
sudo apt install securityonion-elastic
sudo so-elastic-download
sudo sosetup

If you want to TEST upgrading an ELSA VM to Elastic, then you can install the securityonion-elastic package, run so-elastic-download, and then run so-elastic-configure as follows:

sudo soup
sudo apt install securityonion-elastic
sudo so-elastic-download
sudo so-elastic-configure