securityonion
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek. (by Security-Onion-Solutions)
arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system. (by arkime)
| securityonion | arkime | |
|---|---|---|
| 7 | 13 | |
| 2,924 | 6,154 | |
| 2.6% | 0.6% | |
| 8.6 | 9.6 | |
| 3 days ago | 5 days ago | |
| Shell | JavaScript | |
| - | Apache License 2.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
securityonion
Posts with mentions or reviews of securityonion.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-06-29.
-
Security Onion on Proxmox with Linux Bridges and LACP Bond
I'm trying to get Security Onion running in my lab on my Proxmox server. I'm having trouble getting my WAN traffic to my SO VM. My WAN comes in on VLAN 100 to my switch and goes to my router (Virtual VyOS on the same physical host). I have a ton of VMs and really don't want to move to OVS if I don't absolutely have to. I found this discussion which included some commands for getting SO working on a Linux bridge, but this didn't work for me. Probably because my environment is different. Does anybody have SO setup this way? If so, how did you do it?
- Do I need to be concerned? Ipinfo.io says the ip adress is from Slovakia.
- Elastic Stack 8.2 and Suricata Integration
- Security Onion 2: #distro de #Linux para la caza de amenazas, la supervisión de la seguridad empresarial y la gestión de registros 💯
-
FOSS Deep Packet Inspection Options
https://securityonionsolutions.com/software/ https://github.com/Security-Onion-Solutions/securityonion
-
PFsense vs Mikrotik
I have been debating in my head whether to keep my current setup (PFsense on an old laptop) or buy a 'proper?' solution, by this I mean specialised hardware. PFsense has had a few issues like randomly dropping out, but it has been fine for around 4 days now. My question is: Should I buy a Mikrotik HEX S and use the laptop for other things, or not buy a Mikrotik and instead buy a Dell Optiplex 3020 from Ebay and run SecurityOnion (https://github.com/Security-Onion-Solutions/securityonion) or pfELK (https://github.com/pfelk/pfelk) on it.
-
SecurityOnion
Community support is here. You can also purchase support from the developers on their website.
arkime
Posts with mentions or reviews of arkime.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-01-25.
-
Where can I get hands on practice for cybersecurity as a beginner over internet for free?
Arkime: https://arkime.com/ Packet capture and search
- NSA CSI IPv6 Security Guidance (2023) [pdf]
-
how did i do? Just a quick Mock up, and i know i need new switches, how im pretty happy with my very first homelab
Also consider running full PCAP collection with https://arkime.com/ so you can monitor your past network traffic. That has come in handy many times for security and troubleshooting, and doesn't require as much horsepower as you might think.
-
Most Valuable Tools
Anyone using Arkime? https://arkime.com/
- how is packet sniffing working ?
-
How would you add multiple filters on wireshark?
dns && ip.src==x.y.z.w Note that this display filter will not display the DNS replies for the requests sent by x.y.z.w if you want those as well then it will be dns && ip.addr==x.y.z.w Although DNS will be displayed in upper case in Wireshark, it has to be in lower case in the display filter, that said, like others said based on your exact needs and the size of your resulting pcap / pcapng file you may want to look at capture filters, finally if you are dealing with multiple gegabytes file(s) you may want to take a look at another tool like Arkime (formerly moloch) https://arkime.com/
-
I'm currently studying to transition from a SIEM administrator to a network forensics analyst. What's are good workflows/resources for analyzing PCAPs?
Full PCAP's? Look at https://arkime.com/ or network miner. Arkime is probably more what you're looking for. But I love network miner
-
Wireshark pcap in elastic search
I used moloch which is now https://arkime.com/. It used to be free and was a great tool for pcaps. Uses elastic underneath.
-
IT Pro Tuesday #155 - Carrier Lookup, Network Podcast, Identification Tool & More
Arkime is secure, scaleable, indexed packet capture and search tool that can improve your network security by providing greater visibility. This open-source tool stores and indexes network traffic in standard PCAP format. Our thanks for the suggestion goes to Security_Chief_Odo.
-
Cisco Network Traffic to Graylog
I would suggest instead of graylog look into something like this https://arkime.com/
What are some alternatives?
When comparing securityonion and arkime you can also consider the following projects:
Malcolm - Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Suricata - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
pfelk - pfSense/OPNsense + Elastic Stack
luci-wrtbwmon - Bandwidth tracker for OpenWRT that uses wrtbwmon
nDPI - Open Source Deep Packet Inspection Software Toolkit
pyWhat - 🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙♀️
core - OPNsense GUI, API and systems backend
nsp
AIMOD2 - Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proactively identify, engage and prevent cyber threats denying or mitigating potential damage to the organization.
node_pcap - libpcap bindings for node
hardening - Hardening Ubuntu. Systemd edition.
grafolean - Easy to use monitoring system