How to install a Security Onion

Installing an all-in-one Security Onion node with endpoint agents.

This how-to is part of a bigger guide Building the secured self-hosted Nextcloud, which is about creating an encrypted and SIEM monitored Nextcloud instance.

Installation

• During the ISO boot, chose the first option:

• Confirm that you agree to delete all data on selected drive and set the admin user:

The base OS and default applications will now be installed. It may take a while. Grab a cup of tea/coffee and maybe check some of CybrainZ artworks.

• Once it asks to reboot, stop the VM, unmount the ISO from the VM, proceed the reboot, and log in with the created admin account:

The setup will start automatically. If for some reason you'll have to exit the setup and need to restart it, you can log out/log back in and it should start automatically this time. If it still doesn’t work, you can try run it manually as follows: sudo SecurityOnion/setup/so-setup iso.

• Confirm the welcome notice:

• Chose the standard Security Onion installation:

• We want to install all the components on a single node, so we'll select the "Standalone Production Installation" type.:

• You must accept an elastic license to continue:

• Set the hostname:

• The Management NIC is the network interface on which the SO web application and other SO integration services like Wauzh will listen. Select the first option - the one in the default KVM network:

• Select DHCP to configure the IP address by KVM and confirm your selection in the following warning screen:

• Confirm the system has an internet access:

• Confirm the direct connection to the internet:

• Now select the interface on which Suricata will be "sniffing".:

• Set the automatic updates for the underlying operating system:

• Define "home networks" so Security Onion knows which networks are actually being monitored and protected. In our case it is KVM default network 192.168.122.0/24:

• Leave BASIC for the management node settings:

• For the sake of simplicity, choose 'Suricata':

• Now we need to choose which intrusion detection system threat signatures to use. Here is a comparison between ETPRO (1000/year) and ETOPEN (free):

The third one, Snort, may have great potential as it is known to be as comprehensive as ETPRO. A personal license costs only 30 USD per year, but unfortunately, it is not yet fully optimized for Suricata. See the SO Managing Rules for more details. So for now, we'll set it to ETOPEN:

• Also, we remove OSQUERY from the set of tools to be installed. At the time of writing this guide, Linux endpoint support wasn't too good and it could not collect information about installed software (if it's already working it may be worth giving a try):

• Keep the default Docker IP range:

• Chose the admin account and set the password:

• To keep things simple again, we will access the web interface using IP addresses:

• Configure the password for connecting remote sensors. We do not plan to connect any of them yet, but we will at least set the password and save it in the password manager:

• We will keep recommended settings of the Network Security Monitoring components that we selected before:

• We will keep 3 processes by default. We can change this in case Suricata encounters increased packet loss:

• Confirm the default NTP servers and leave the recommended settings of Search Node components:

• so-allow is a firewall management tool for the SO stack. Here we want to configure that access to the SO web service is allowed by the IP from the network 192.168.122.0/24:

Can be done also later by the command so-allow.

• The installation is now completed:

• After the restart, log in and use the so-status command to wait until the services (docker containers) are 'green':

• Wait for all services to become green:

• Open the web interface and log in:

• Go to Alerts. There should be some alerts already waiting for us.:

At this point, we see events from two modules:

In the next chapter, we will deploy the Wazuh across all remaining hosts and join them to the Wazuh server in Security Onion.

Deploy Endpoint Security Monitoring Agents Across The Environment

We will install the Wazuh agent on all other systems - vpn, nextcloud, and host and connect them all to the Wazuh server running on onion.

But first, we have to prepare the Wazuh server for new agents to be added. Run this command as root on onion:

so-wazuh-agent-manage

Add [a] future agents, their names, and IP addresses. Then extract the [e] key for each of them. We will enter the key during the client configuration. Also, we have to allow incoming Wazuh traffic:

so-allow

Set the default KVM-made network for the Wazuh agents [w] and for Wazuh registration service [s] as well.

Navigate to the Downloads page in Security Onion Console (SOC) and download the Wazuh agent software packages.

Using these (version) is important as different versions might be not compatible. Install on all other systems - vpn, nextcloud, and host:

rpm -ivh wazuh-agent-3.13.1-1.x86_64.rpm

# or

apt install ./wazuh-agent_3.13.1-1_amd64.deb

Update the server section in the Wazuh configuration file /var/ossec/etc/ossec.conf, in our case:

    <server>
      <address>192.168.122.150</address>
      <port>1514</port>
      <protocol>udp</protocol>
    </server>

Then, import the key you previously exported on Wazuh server:

/var/ossec/bin/manage_agents

  ****************************************
  * Wazuh v3.13.1 Agent manager.         *
  * The following options are available: *
  ****************************************
     (I)mport key from the server (I).
     (Q)uit.
  Choose your action: I or Q:

Start the client and watch for a message 'Connected to the server' in the ossec.log - tail -f /var/ossec/logs/ossec.log. If message appears, the agent is connected and you can enable the agent to start on boot:

systemctl start wazuh-agent && systemctl enable wazuh-agent

This needs to be done on all three VMs: vpn, nextcloud and host.

At this point, all endpoints and related network events will be visible in the Security Onion.