Security Onion

No entries match these filters. Clear filters

1. announced Nov 2, 2026 · issue 130

   Security Onion 3.4.0 adds Agentic AI Automations for Pro users; Security Onion 2.4 reached EOL on October 1, 2026, requiring migration to Oracle Linux 9.

   • Security Onion Pro now includes Agentic AI Automations, enabling automated AI-driven workflows within the platform.

   1 detail in Everything

   • Updated supported platform Suricata updated to 8.0.8
   • Updated supported platform Zeek updated to 8.0.11
   • Updated supported platform Elasticsearch updated to 9.4.8
   • Updated supported platform ElastAlert2 updated to 2.32.0
   └──▷ BREAKING ON UPGRADE

   • !Security Onion 2.4 reached End of Life on October 1, 2026; Security Onion 3 requires Oracle Linux 9, so installations on other distributions must perform a fresh install.
2. 3.4.0-20261102 Nov 2, 2026 · issue 129

   Security Onion 3.4.0 adds unified automations, correlations support, AI model expansions, and configurable detection engine sync timeouts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.4.0-20261102 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.4.0-20261102

   • Add openai_embeddings to the YAML configuration to enable OpenAI embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add allowExternalMarkdownImages SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. setting to control rendering of external images in markdown.
   • Add custom_bind_mounts support to so-kafka and so-soc containers for custom volume mappings.
   • Add Claude Haiku as an available SOAI assistant model alongside existing options.
   • Security Onion now supports initial Correlations, enabling multi-event correlation rules in the detection engine.

   +5 more show less

   • Automations are now unified, consolidating alert and notification automation workflows into a single system.
   • Adds configurable timeouts, including per-automation turn timeouts and configurable timeouts for detection engine syncs, giving operators more control over automation and sync behaviour.
   • Sigma pipelines are now stored in a managed directory for cleaner rule organisation.
   • Metric alarms and additional notification annotations expand alerting observability.
   • Raise the SOAI Sonnet default small context limit to 1 million tokens.
   • Add openai_embeddings to the YAML configuration to enable OpenAI embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add allowExternalMarkdownImages SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. setting to control rendering of external images in markdown.
   • Add custom_bind_mounts support to so-kafka and so-soc containers for custom volume mappings.
   • Security Onion now supports initial Correlations, enabling multi-event correlation rules in the detection engine.
   • Adds configurable timeouts, including per-automation turn timeouts and configurable timeouts for detection engine syncs, giving operators more control over automation and sync behaviour.

   +1 more show less

   • Metric alarms and additional notification annotations expand alerting observability.

   4 more in Everything

3. docs update Oct 8, 2026 · issue 097

   Security Onion now has an official Azure Marketplace image supporting single-node and distributed grid deployments with Virtual Network TAPVirtual Network TAPA software-defined copy point inserted into a virtual network path that mirrors traffic to a monitoring destination without interrupting the live flow, giving cyber tools passive visibility into east-west VM traffic. monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Verify that an Azure sensor node is receiving mirrored VTAP traffic on the sniffing interface before trusting Zeek detections.
   copy

   $ sudo tcpdump -nni eth1

   Confirm Zeek is correctly decapsulating VxLAN traffic and writing connection logs on the Azure sensor.
   copy

   $ ls -la /nsm/zeek/logs/current

   • Adds official Security Onion VM image on the Azure Marketplace for deploying single-node or distributed grid architectures in Azure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Azure Virtual Network TAP (VTAP) for traffic monitoring, delivering mirrored traffic to the sniffing interface as VxLAN on port 4789.
   • Documents sensor setup using eth0 as the main interface and eth1 as the monitoring interface on Azure sensor nodes.
   • Documents verification of sniffing interface traffic via sudo tcpdump -nni eth1 and Zeek log generation at /nsm/zeek/logs/current.
   • Documents VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-connected remote sensor setup using tun0 as the management interface for sensors outside the Azure VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware..

   5 details in Everything

4. 3.3.0-20260911 Sep 11, 2026 · issue 072

   Security Onion 3.3.0-20260911 adds an x86-64-v3 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. compatibility pre-flight check to the soup updater.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.3.0-20260911 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.3.0-20260911

   • Adds an x86-64-v3 CPU pre-flight check to soup to catch incompatible hardware before an upgrade proceeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. announced Sep 8, 2026 · issue 070

   Security Onion 3.3.0 adds Agent Studio with agentic memory, AI Reports Tools, Logstash tuning, and MoM subgrid roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Adds log.level and log.format tuning for Logstash via SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports tuning multiple Logstash pipelines in SOC ES.
   • Introduces Agent Studio with agentic memory for Pro users.
   • Adds Onion AI Reports Tools (Pro feature).
   • Adds subgrid roles for Manager of Managers (MoM) grids (Pro feature).

   +5 more show less

   • Adds ES Troubleshoot capability accessible from the Grid Screen.
   • Supports drag-and-drop ordering for config lists such as custom queries.
   • Updates Zeek to 8.0.10.
   • Updates CyberChef to 11.3.0.
   • Updates Telegraf to 1.39.3.
   • Adds log.level and log.format tuning for Logstash via SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Agent Studio with agentic memory for Pro users.
   • Adds Onion AI Reports Tools (Pro feature).
   • Adds ES Troubleshoot capability accessible from the Grid Screen.

   6 more in Everything

6. 3.3.0-20260908 Sep 8, 2026 · issue 069

   Security Onion 3.3.0 adds Logstash pipeline tuning and log-level controls in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared., agentic memory with vector support, and Elasticsearch 9.4.5.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.3.0-20260908 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.3.0-20260908

   • Adds tuning of multiple Logstash pipelines directly in SOC, including exposed log.level and log.format settings.
   • Adds agentic memory capability with a vector extension for Agent Studio.
   • Upgrades Elasticsearch to 9.4.5.
   • Detects hand-placed local/salt files during Auto State Apply to surface conflicts before they break state runs.
   • Adds log rotation for hypervisor logs.

   +2 more show less

   • Pushes a grid-wide highstate to remote nodes after a soup upgrade to ensure all nodes converge immediately.
   • Allows airgap installs to reuse previously extracted Docker images, reducing re-extraction time.
   • Adds tuning of multiple Logstash pipelines directly in SOC, including exposed log.level and log.format settings.
   • Adds agentic memory capability with a vector extension for Agent Studio.
   • Adds log rotation for hypervisor logs.

   4 more in Everything

7. 3.2.0-20260729 Jul 29, 2026 · issue 030

   Security Onion 3.2.0 adds agentic AI (Gemma-backed Investigator/Engineer), Sigma playbooks, ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. defaults, data stream lifecycle management, and UEK8 kernel support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.2.0-20260729 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.2.0-20260729

   • Adds agentic AI capability with Gemma-backed Investigator and Detection Engineer agents for automated analysis workflows.
   • Supports Sigma playbooks (including airgap environments), enabling SigmaHQSigmaHQAn open community repository on GitHub that maintains the Sigma generic signature format and its growing library of detection rules, giving cyber tools a vendor-neutral rule set they can convert to any SIEM query language. rules against Elastic Defend logs.
   • Adds data stream lifecycle management support for Elasticsearch index management.
   • Upgrades to Elasticsearch 9.3.7.
   • Adds UEK8 kernel support across install and grid, with UEK8 set as the boot default.

   +4 more show less

   • Adds cluster health monitoring option to telegraf.conf for Elasticsearch observability.
   • Makes failed soup upgrades and hotfixes resumable instead of requiring a full restart.
   • Adds toggleable PostgreSQL metrics collection.
   • Supports multiple capinfos versions for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. analysis compatibility.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The icsnpp-modbus parser is removed from defaults.yaml; grids relying on the default Modbus protocol parser will no longer have it enabled after upgrade.
   • !The Detection Engineer agent configuration key is renamed to DetectionEngineer; existing configurations using the old key will need to be updated.
8. 3.1.0-20260521 May 21, 2026 · release notes

   Security Onion 3.1.0 adds Sigma rules for M365/Fortigate, JA4D ingest pipeline, RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. monitoring for VMs, ingest latency metrics, and upgrades to Elasticsearch 9.3.3.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.0-20260521 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.1.0-20260521

   • Adds Sigma rules pipeline mapping for Microsoft 365 and Fortigate log sources.
   • Adds zeek.ja4d ingest pipeline for JA4D fingerprint processing.
   • Adds ingest latency metrics collection.
   • Adds RAID monitoring for virtual machine deployments.
   • Adds so-postgres Salt states and supporting infrastructure.

   +8 more show less

   • Upgrades to Elasticsearch and Elastic Agent 9.3.3.
   • Adds fleet package registry health check.
   • Supports bond1 interface for management network configuration.
   • Supports minion node descriptions containing spaces.
   • Adds per-OS-type process creation (proc_creation) Sigma rule handling.
   • Enables read-only SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. and Kratos modes.
   • Syncs Elastic Agent packages to fleet nodes automatically.
   • Verifies Elasticsearch version compatibility across all nodes in the cluster.

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Telegraf output changed from BOTH to INFLUXDB only — deployments relying on the previous dual-output behavior will no longer write to the non-InfluxDB target after upgrade.
9. 3.0.0-20260331 Mar 31, 2026 · release notes

   Security Onion 3.0.0 adds Gemini AI integration, OpenAI protocol support, AI session reports in cases, and removes Stenographer in favor of Suricata-based PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.0.0-20260331 https://github.com/Security-Onion-Solutions/securityonion.git
   # already have the repo? check out this version:
   $ git checkout 3.0.0-20260331

   • Adds Google Gemini AI model support for the Assistant.
   • Adds OpenAI protocol support for AI Assistant integrations.
   • Introduces an AI Session Report Template in the Assistant for summarizing investigation sessions.
   • Attaches AI session transcripts to Case Reports via Case Report Update for AI Session Attachments.
   • Adds an Investigated Query Toggle Filter in the Assistant to filter by investigated status.

   +10 more show less

   • Exposes login form lifespan as a configurable setting in the Security Onion Console.
   • Removes Stenographer (steno); PCAP capture and cleanup now handled by Suricata.
   • Enables and disables PCAP capture for Suricata directly from the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. interface.
   • Removes the 10 TB virtual disk limit for VM deployments.
   • Supports additional Subject Alternative Names (SANs) in the web certificate.
   • Upgrades to Elasticsearch 9.0.8.
   • Upgrades Salt to version 3006.19.
   • Adds upgrade path support from 2.4.x to Security Onion 3.0.
   • Switches Elastic Agent log ingestion from the deprecated logs integration to filestream.
   • Includes all so-grid-nodes_* policies in automatic Elastic Agent upgrades.

   15 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Stenographer (steno) is removed; any configuration or workflows depending on Stenographer for PCAP capture will break — PCAP is now handled by Suricata.
   • !The QWEN 235B model is removed from defaults.yaml; any AI Assistant configurations referencing that model ID will no longer function.
   • !The Elastic Agent logs integration is replaced by filestream; any custom configurations using the deprecated logs integration will need to migrate to filestream.
10. 2.4.211-20260312 Mar 12, 2026 · release notes

    Security Onion 2.4.211 removes the 10 TB virtual disk limit for VM deployments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.211-20260312 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.211-20260312

    • Removes the 10 TB virtual disk size limit for virtual machine hosts, enabling larger storage allocations.

    1 detail in Everything

11. 2.4.210-20260302 Mar 2, 2026 · release notes

    Security Onion 2.4.210 adds Gemini AI integration, OpenAI protocol support, AI session reports in cases, and a path to upgrade to 3.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.210-20260302 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.210-20260302

    • Adds Google Gemini as a supported AI backend for the Assistant.
    • Adds OpenAI protocol support for the Assistant AI integration.
    • Introduces an AI Session Report template in the Assistant for structured session summaries.
    • Attaches AI session transcripts to Case Reports, enriching incident documentation.
    • Adds an Investigated Query Toggle Filter in the Assistant for focused alert triage.

    +4 more show less

    • Exposes login form session lifespan as a configurable option in the Security Onion console.
    • Adds upgrade path support for migrating to Security Onion 3.0.
    • Upgrades Elasticsearch to 9.0.8.
    • Upgrades Salt to 3006.19.

    9 details in Everything

12. 2.4.200-20251216 Dec 16, 2025 · release notes

    Security Onion 2.4.200 adds advanced ILM controls in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. UI, PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. annotations, JA4D fingerprinting, AI assistant model management, and Suricata 8.0.2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.200-20251216 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.200-20251216

    └──▷ HOW TO FIND IT
    Enable JA4D TLS fingerprinting in Zeek to get richer client classification beyond standard JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies..
    📍In the SOC console, go to Administration › Configuration › zeek › config.zeek.ja4 and enable the JA4D option.
    • Adds Advanced ILM (Index Lifecycle Management) actions accessible directly from the SOC UI.
    • Adds PCAP annotations, enabling analysts to annotate packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. data within the interface.
    • Adds JA4D fingerprinting option via config.zeek.ja4 for enhanced TLS client fingerprinting.
    • Upgrades Suricata to version 8.0.2.
    • Adds AI Assistant model availability listing and per-model enabled/disabled flag in the assistant configuration.

    +5 more show less

    • Adds context prompt compression for the AI Assistant.
    • Adds Elasticsearch retention estimation capability (so-elasticsearch-retention-estimate).
    • Renames forward node to sensor node throughout the platform.
    • Adds so-yaml support for using YAML file content as values.
    • Introduces hypervisor environment support with virtual disk management and a new nsm_total grain.

    10 details in Everything

13. 2.4.190-20251024 Oct 24, 2025 · release notes

    Security Onion 2.4.190 adds BYOH hypervisor support, exclusion toggles, CSV delimiter config, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. detection, and upgrades Elasticsearch to 8.18.8.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.190-20251024 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.190-20251024

    • Adds Bring Your Own Hypervisor (BYOH) support, enabling users to create VMs that mount a virtual disk for /nsm.
    • Introduces a new nsm_total grain for tracking total NSM storage across virtual disk mounts.
    • Adds an exclusion toggle in the UI for managing detection exclusions.
    • Adds OOM (out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.) check to so-log-check for proactive health monitoring.
    • Adds CSV delimiter configuration and query name support for data export workflows.

    +7 more show less

    • Adds a new field for assistant health check status.
    • Adds filter support in the relevant UI views.
    • Adds new configuration entries for expanded service customization.
    • Implements host OS overhead calculation based on node role for more accurate resource planning.
    • Upgrades Elasticsearch to version 8.18.8.
    • Supports non-async Salt state apply for synchronous configuration management operations.
    • Updates the default AI investigation prompt for improved analyst guidance.

    12 details in Everything

14. 2.4.180-20250916 Sep 17, 2025 · release notes

    Security Onion 2.4.180 adds hardware virtualization support, NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. channel customization, configurable per-agent realert thresholds, and Zeek DNS resolved IP logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.180-20250916 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.180-20250916

    • Adds hardware virtualization support for manager/search and standalone nodes, including hypervisor firewall rules.
    • Adds NIC channel customization for network interface tuning.
    • Adds configurable realert threshold per elastic agent.
    • Adds so-elastic-agent-monitor for monitoring elastic agent health.
    • Adds support for a custom FQDN on receiver nodes.

    +5 more show less

    • Adds Zeek dns.resolved_ip field logging.
    • Adds additional Fleet Node state visibility in the UI.
    • Adds Ruleset Name UI element for improved rule management display.
    • Upgrades Elasticsearch to 8.18.6.
    • Changes Suricata metadata index rollover from 1 day to 30 days, reducing index churn.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fleet Nodes will need to be reinstalled after upgrading to this release.
15. 2.4.170-20250812 Aug 12, 2025 · release notes

    Security Onion 2.4.170 adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. fingerprinting, hardware virtualization support, Playbooks with airgap support, and an Elasticsearch troubleshooting script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.170-20250812 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.170-20250812

    └──▷ TRY IT
    Monitor Elasticsearch index growth to identify storage pressure before running out of disk space.
    copy

    $ so-elasticsearch-index-growth

    • Adds JA4 TLS fingerprinting support for enriched network traffic analysis.
    • Adds hardware virtualization support, including libvirt states and salt.cloud state execution on standalone and managersearch nodes.
    • Adds Playbooks feature with support for airgap environments and configurable ruleset repos.
    • Adds so-elasticsearch-index-growth command for monitoring Elasticsearch index growth.
    • Adds dns.resolved_ip field support for DNS log enrichment.

    +7 more show less

    • Adds network.community_id from Zeek when available, improving cross-log correlation.
    • Upgrades Elasticsearch to 8.18.4.
    • Upgrades Zeek EtherCAT plugin.
    • Enables HTTP Strict Transport Security (HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks./STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) for browser redirects.
    • Adds user.name field to Kratos identity queries.
    • Adds RulesetName to rule repository configuration.
    • Simplifies and updates UniFi dashboards.

    12 details in Everything

16. 2.4.160-20250625 Jun 25, 2025 · release notes

    Security Onion 2.4.160 adds Playbooks with airgap support, a new index-growth tool, and expanded ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. field mapping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.160-20250625 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.160-20250625

    └──▷ TRY IT
    Check Elasticsearch index growth to identify data sources consuming storage faster than expected.
    copy

    $ so-elasticsearch-index-growth

    • Adds Playbooks feature with a dedicated repo config and parsing support for automated response workflows.
    • Adds airgap support for Playbooks, enabling Playbook functionality in isolated/offline deployments.
    • Adds so-elasticsearch-index-growth command to monitor Elasticsearch index growth trends.
    • Adds RulesetName field to Rule Repos for improved rule repository identification.
    • Adds support for dns.resolved_ip ECS field in parsing.

    +3 more show less

    • Uses Zeek's network.community_id when available for improved correlation across data sources.
    • Enables HTTP Strict Transport Security (STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) for browser redirects.
    • Upgrades internal registry to version 3.0.0.

    8 details in Everything

17. 2.4.150-20250512 May 12, 2025 · release notes

    Security Onion 2.4.150 adds external Kafka access with auth, background config UI actions, subgrid support, and Strelka scanner improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.150-20250512 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.150-20250512

    • Enables external access to Kafka topics via username/password authentication for remote clients.
    • Supports background actions via the config UI, allowing long-running operations without blocking the interface.
    • Adds additional grid and subgrid support in the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. UI for richer data display.
    • Adds missing Strelka scanners and restarts Strelka containers automatically on config change.
    • Displays user.name instead of internal identity ID across the SOC UI via Kratos user.name lookup.

    +3 more show less

    • Collects Elasticsearch index sizes as a new storage metric.
    • Adds url_base to the web certificate for more flexible deployment configurations.
    • Automatically runs so-rule-update when rule configuration changes.

    8 details in Everything

18. 2.4.140-20250324 Mar 24, 2025 · release notes

    Security Onion 2.4.140 adds PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. import support for sensors in distributed grids and improves Zeek file extraction handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.140-20250324 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.140-20250324

    • Supports PCAP imports for sensors in distributed grid deployments.
    • Adds Zeek file_extraction forcedType handling for single-line edge cases.
    • Includes observer.name in ldap_search results for richer event context.
    • Applies specified role when adding new users instead of defaulting.

    4 details in Everything

19. 2.4.130-20250311 Mar 11, 2025 · release notes

    Security Onion 2.4.130 adds a Sankey chart to the Elastic Agent API dashboard, Zeek traceroute & NTP support, and upgrades Elasticsearch to 8.17.3.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.130-20250311 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.130-20250311

    • Adds a Sankey chart to the Elastic Agent API dashboard visualizing the relationship between process.name and process.Ext.api.name.
    • Adds Zeek traceroute and NTP log integrations.
    • Adds TLSv1.3 support to the nginx configuration.
    • Enables installation of Elastic integrations that require an Elastic license.
    • Adds multiline input support for managed integration configuration fields.

    +1 more show less

    • Updates osquery index templates for v1.15.0.

    6 details in Everything

20. 2.4.120-20250212 Feb 12, 2025 · release notes

    Security Onion 2.4.120 adds Trend Micro & OpenCTI integrations, Zeek 7 with HTTP/2 and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking., local lookup support, and a Connect API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.120-20250212 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.120-20250212

    • Adds Trend Micro integration support.
    • Adds OpenCTI threat intelligence (ti_opencti) integration support.
    • Adds Cloudflare Logpush integration support.
    • Upgrades to Zeek 7 with HTTP/2 protocol parsing and logging.
    • Adds OpenVPN and IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. protocol support to Zeek.

    +21 more show less

    • Adds QUIC protocol support and field mappings to Zeek.
    • Introduces initial local lookup support for enriching events.
    • Introduces a Connect API for external integrations.
    • Adds process and file creation event mappings.
    • Adds a so-ip-mappings index for IP enrichment.
    • Enables adding annotations to existing detections.
    • Adds tuning notes capability to detections.
    • Adds detection status hunt view.
    • Adds ignored SIDs management in the UI.
    • Adds source dates display for detection rule sources.
    • Provides more flexibility for AutoEnable Sigma rules.
    • Generates MSI installer for the Security Onion agent.
    • Adds a local custom Logstash pipeline template support.
    • Adds a new limit on bulk creating related events to improve scalability.
    • Enables ILM (Index Lifecycle Management) on managed indices.
    • Adds HTTP/2 support to the Elastic Agent Logstash pipeline.
    • Invalidates user sessions when an admin changes a user's password.
    • Allows the CA certificate to be downloaded from the UI.
    • Makes MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. issuer name a standard (non-advanced) setting.
    • Refactors ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator for detections, including airgap support.
    • Keeps imported data in a dedicated logs-import-so index.

    26 details in Everything

21. 2.4.110-20241004 Oct 7, 2024 · release notes

    Security Onion 2.4.110 adds Barracuda/Imperva integrations, Elastic Defend filter management, PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. support, and custom IDH skins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.110-20241004 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.110-20241004

    • Adds Barracuda and Imperva log source integrations.
    • Adds initial support for managing Elastic Defend Filters through Security Onion.
    • Adds PKCE OIDC authentication support.
    • Enables automatic upgrades of Elastic integrations when new versions are available.
    • Enables Suricata for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. on Standalone installs.

    +4 more show less

    • Supports custom IDH (Interactive Defense Hub) skins.
    • Adds external support for Detections management.
    • Adds destination IP visibility for so-system.
    • Enables STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. hardening for Security Onion desktop installs.

    9 details in Everything

22. 2.4.100-20240829 Aug 29, 2024 · release notes

    Security Onion 2.4.100 adds AI-powered alert summaries, mandatory OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. enforcement, and Tenable.io integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.100-20240829 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.100-20240829

    • Adds AI-generated summaries for alerts via new ai summaries capability in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared..
    • New setting to require OTP (one-time password) for user authentication.
    • Adds Tenable.io integration for ingesting vulnerability data.
    • Adds SSH warning to the soup upgrade tool to alert administrators before proceeding.
    • Adds support for new appliance RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. controllers.

    +2 more show less

    • Upgrades Elastic stack to version 8.14.3.
    • Upgrades Salt to version 3006.9.

    7 details in Everything

23. 2.4.90-20240729 Jul 29, 2024 · release notes

    Security Onion 2.4.90 adds custom SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. actions, Suricata regex support, Kafka InfluxDB metrics, and a faster detection refresh interval.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.90-20240729 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.90-20240729

    • Adds a new action to the SOC Actions list so users can more easily add their own custom actions.
    • Supports regex in Suricata rule management within the Detections interface.
    • Adds Kafka InfluxDB metrics collection and pillar configuration support.
    • Introduces new configuration values for the Detections Bulk Indexer.
    • Reduces detection refresh interval to 1 second for near-real-time detection index updates.

    +1 more show less

    • Disables Logstash on heavy nodes to streamline pipeline architecture.

    6 details in Everything

24. 2.4.80-20240624 Jun 25, 2024 · release notes

    Security Onion 2.4.80 adds Kafka integration, separate Suricata alerts stream, and proxy/TLS config keys

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.80-20240624 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.80-20240624

    • Add initial Kafka support for message transport
    • Separate Suricata alerts into a specific data stream
    • Add SOC_PROXY setting to configure proxy connections
    • Add AdditionalCA and InsecureSkipVerify options to enable custom CA and TLS verification control
    • Add detections_without_license option to allow detections without a license key

    5 details in Everything

25. 2.4.70-20240529 May 29, 2024 · release notes

    Security Onion 2.4.70 adds Kismet WiFi integration, manual sync settings, auto-enabled Sigma rules, and new UI column layouts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.70-20240529 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.70-20240529

    • New kismet integration for collecting WiFi device logs
    • New Add manual sync settings in the Detections panel for controlling rule updates
    • Auto-enabled Sigma rules based on user role or default configuration
    • Added event.module, event.dataset, process.command_line, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. columns to Events table layouts
    • New individual dashboards for Zeek SSL, Suricata SSL, SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Login Failures, and Elastic Agent status

    +1 more show less

    • Lowered EVAL memory requirement to 8GB RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed.

    6 details in Everything

26. 2.4.60-20240320 Mar 20, 2024 · release notes

    Initial Support for Detections Module with auto-update and airgap capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.60-20240320 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.60-20240320

    • Add Detection AutoUpdate config enables automatic detection rule updates in the new Detections module
    • Airgap Support - Detections module allows the Detections module to operate in offline/air-gapped environments
    • Add Exclusion toggle provides a UI control to exclude specific items from detections within the Detections module

    3 details in Everything

27. 2.4.50-20240220 Feb 20, 2024 · release notes

    Adds Suricata IKE pipeline, manage custom ES/L pipelines in UI, and process ancestry SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. action

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.50-20240220 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.50-20240220

    └──▷ HOW TO FIND IT
    View the full parent-child relationship of a process from a SOC case view.
    📍In the SOC Actions menu, select Process Ancestry on an event to visualize the process tree.
    Deploy and manage custom pipeline configurations directly through the web interface.
    📍In the Security Onion UI, navigate to the Pipelines section to add or edit Elasticsearch/Logstash pipelines.
    Monitor network traffic using Community IDCommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources. hashing and firewall authentication logs.
    📍Access the new community_id and firewall auth dashboards from the Security Onion dashboard list.
    • Add Suricata IKE pipeline for IKE protocol detection
    • Manage custom Elasticsearch and Logstash pipelines via the UI
    • New Process Ancestry action on the SOC Actions menu to show process tree
    • Add new dashboards for community_id and firewall auth

    4 details in Everything

28. 2.4.40-20240116 Jan 17, 2024 · release notes

    Security Onion 2.4.40 adds threat intelligence analyzers, eml observable type, certificate fingerprints and grid UI enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.40-20240116 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.40-20240116

    • Adds support for nested keys in observable data structures
    • Adds certificate fingerprinting capabilities for endpoint/identity correlation
    • Adds new integrations with ThreatFox, MalwareBazaar, Echotrail, and Elasticsearch as analyzer sources
    • Adds grid page enhancements to display last highstate date/time on grid metrics screen and expose max upload metrics

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removal of Curator configuration and associated logic, which may affect manual index management scripts if they relied on previous Curator state.
29. 2.4.30-20231113 Nov 13, 2023 · release notes

    Security Onion 2.4.30 adds Sublime, Checkpoint, VSphere integrations and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.30-20231113 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.30-20231113

    • Adds oidc authentication support for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via Identity Providers.

    1 detail in Everything

30. 2.4.20-20231006 Oct 6, 2023 · release notes

    Security Onion 2.4.20 adds syslog ingestion on heavy nodes and regex/transform roles for log processing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.20-20231006 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.20-20231006

    • Add syslog to heavynode
    • Regex & Transform Role
    • New Config Default: longRelayTimeoutMs

    3 details in Everything

31. 2.4.10-20230815 Aug 15, 2023 · release notes

    Security Onion 2.4.10 enables agent upgrade checks during highstate, moves base_url to cert SAN, and upgrades integration packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.10-20230815 https://github.com/Security-Onion-Solutions/securityonion.git
    # already have the repo? check out this version:
    $ git checkout 2.4.10-20230815

    • Enable so-agent-upgrade check during Salt highstate execution via PR #10997
    • Move base_url configuration into the certificate Subject Alternative Name (SAN) via PR #11002
    • Upgrade integration packages to latest versions via PR #11014

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !base_url is no longer a standalone configuration field; it must now be defined within the certificate Subject Alternative Name (SAN) list.
32. 2.4.5 Aug 7, 2023 · release notes

    Security Onion 2.4.5 RC2 adds NetworkMiner to Desktop, Elastic Defend CommunityID support, SO-Import-EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. timeshift, Heavy Node and Soup log rotation.

    • Enables CommunityID for Elastic Defend Logs
    • Adds so-import-evtx with timeshift capability
    • Adds support for Heavy Nodes in the grid architecture
    • Adds log file rotation for the soup service

    4 details in Everything

33. 2.4.4 Jul 28, 2023 · release notes

    Security Onion 2.4.4 RC1 adds Oracle Linux support, dynamic observable extraction in Cases, and new Hunt URL parameters.

    • Adds Oracle Linux as a supported platform for Security Onion installation
    • Enables dynamic observable extraction in Cases with a new configuration option
    • Adds timeframe and refresh_interval as URL parameters to the Hunt interface

    3 details in Everything

34. 2.4.3 Jul 12, 2023 · release notes

    Security Onion 2.4.3 Beta 4 adds PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic./EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. UI import, WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. login, and time zone selection.

    └──▷ USE IT
    Import EVTX files directly from the command line for forensics or analysis.
    shell copy

    so-import-evtx /path/to/logs.evtx

    Configure multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for SOC users using WebAuthn hardware keys.
    📍Enable WebAuthn in the SOC Configuration › Authentication settings.
    Import network capture data into Security Onion for packet analysis.
    📍Navigate to SOC Config › Data Ingestion and select PCAP/EVTX Import to upload .pcap files.
    • Adds so-import-evtx subcommand to allow importing EVTX logs
    • Allow import of PCAP and EVTX via SOC UI
    • Add webauthn support to SOC
    • Add time zone selection to Grid page

    4 details in Everything

35. 2.4.2 Jun 1, 2023 · release notes

    Security Onion 2.4.2 Beta 3 adds Apple Silicon support, EQL in playbooks, Elastic Defend integration, and airgap switching.

    • Adds Add support for Apple Silicon Elastic Agent Installer to allow deployment on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. endpoints.
    • Adds EQL to Playbook support enabling Event Query Language queries within automated response workflows.
    • Adds Elastic Defend Integration on Endpoints Policy to manage endpoint protection via the platform.
    • Adds capability to Allow for any docker container to have extra hosts and custom binds via configuration.
    • Adds Airgap mode switching via UI, allowing users to toggle between airgap and non-airgap configurations.

    +9 more show less

    • Adds Dedicated Elastic Fleet Node role for separating fleet management traffic.
    • Adds Integrate Elastic Artifact Repo for accessing external artifacts within the platform.
    • Adds Integrate Elastic Package Registry for managing packages centrally.
    • Adds support for creating a ISO image installer distribution.
    • Adds grid interface link to Docker container log files for debugging.
    • Adds DNS record verification prompt during setup if a DNS record is found for manager nodes.
    • Adds Quicklinks to common configs in the UI.
    • Adds support for processing multiline config lines individually with regex when multiline: True is set in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. config UI.
    • Adds authentication rate limiting capabilities.

    14 details in Everything

36. advisory CVE-2020-27985 Nov 30, 2020 · issue 128
    ⤢
    • CVE-2020-27985: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects < 2.3.10)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠