securityonion
3.4.0-20261102Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
- Maintenance
- Active235 commits in 3 months · bus factor 2
- License
- OtherUnknown
- Security
- 2 advisories2 low · Scorecard 5.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
5k stars · 684 forks · 72 open issues · last release 13 days ago · data checked 5 hours ago
Release history
All releases on GitHubBadge
[](/p/Security-Onion-Solutions/securityonion)
Download the ISO
What's Changed
- Bump version from 3.3.0 to 3.4.0 by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16216
- /login is showing an nginx failure by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16225
- fix location typo by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16229
- filterEventFields by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/16236
- Hotfix/3.3.0 by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16239
- Remove outdated HOTFIX version number by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16240
- stop Zeek gracefully preventing post-terminate logs by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16242
- FIX: prevent so-sensor-clean runaway loop and concurrent instances by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16243
- Fix/so minion install vars by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16246
- FIX: suricata.fileinfo maps boolean gaps into long file.bytes.missing by @dougburks in https://github.com/Security-Onion-Solutions/securityonion/pull/16249
- FIX: root-own /usr/sbin management scripts and the Salt default tree by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16250
- Refactor for ESQL by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16247
- notification annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16251
- Isolate the Kratos admin API on a dedicated soauth docker network by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16221
- store in db by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16252
- Fix config tree error from the docker.networks setting by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16253
- Fix user creation failing with a valid password by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16255
- upgrade whoislookup analyzer deps; notification annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16258
- FIX: Fleet scripts failing when endpoints-initial is missing by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/16260
- Add openai_embeddings to the YAML configuration by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16262
- FIX: use /sbin/nologin for service accounts by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16263
- Metric alarms and more NTF annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16264
- FIX: remove the docker socket from so-telegraf by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16261
- resolve startup errors by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16267
- Raise SOAI Sonnet default small context limit to 1M by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16266
- New Automation Fields by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/16270
- review integration-defaults weird_integrations mappings, removed unus… by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/16275
- support empty yaml files by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16277
- Unified Automations by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/16280
- upgrade docker 29.8.1 and containerd 2.3.6 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16286
- caseless for non-Defend sources by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16279
- EVTX Import cleanup by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16278
- Move Sigma pipelines into a managed directory by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16287
- Fix/auto apply state queue by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16274
- Revert "Fix/auto apply state queue" by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16297
- update tick interval desc by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16300
- ES 9.4.8 by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/16306
- new destination timeout annotation; fix fp by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16310
- regenerate elastic agent installer by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/16311
- Add allowExternalMarkdownImages SOC Setting by @mc-wright in https://github.com/Security-Onion-Solutions/securityonion/pull/16312
- Map the AlertTriage and Notifier agents to a model by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16301
- Add Claude Haiku to the SOAI assistant models by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16315
- Initial Correlations support by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16269
- eval to use Suricata for metadata by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16317
- remap enterprisesearch integration components by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/16319
- combine default and availableModels added via pillar by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16322
- Add a licensed Group By Assessment, Name alerts query by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16302
- Remove the Notifier agent mapping by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16323
- combine default and alerts queries added via pillar by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16328
- Add readonly attribute to earliest alert time field by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16331
- Change readonly to readonlyUi in YAML configuration by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/16332
- Automation Turn Timeout by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/16333
- Refactor correlation template by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/16335
- analyzer dep updates by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16341
- Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16350
- fix false positive scan results by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/16351
- Add custom_bind_mounts to so-kafka and so-soc by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/16356