https://cybertoolchain.io/tools/security-onion New releases and features in Security Onion, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 16:41:48 GMT https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.4.0-20261102 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.4.0-20261102 Mon, 02 Nov 2026 16:41:48 GMT Security Onion 3.4.0 adds unified automations, correlations support, AI model expansions, and configurable detection engine sync timeouts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add `openai_embeddings` to the YAML configuration to enable OpenAI embedding support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add `allowExternalMarkdownImages` SOC setting to control rendering of external images in markdown. • Add `custom_bind_mounts` support to `so-kafka` and `so-soc` containers for custom volume mappings. • Add Claude Haiku as an available SOAI assistant model alongside existing options. • Security Onion now supports initial Correlations, enabling multi-event correlation rules in the detection engine. • Automations are now unified, consolidating alert and notification automation workflows into a single system. • Adds configurable timeouts, including per-automation turn timeouts and configurable timeouts for detection engine syncs, giving operators more control over automation and sync behaviour. • Sigma pipelines are now stored in a managed directory for cleaner rule organisation. • Metric alarms and additional notification annotations expand alerting observability. • Raise the SOAI Sonnet default small context limit to 1 million tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.3.0-20260911 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.3.0-20260911 Fri, 11 Sep 2026 20:44:11 GMT Security Onion 3.3.0-20260911 adds an x86-64-v3 CPU compatibility pre-flight check to the soup updater.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an x86-64-v3 CPU pre-flight check to `soup` to catch incompatible hardware before an upgrade proceeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.3.0-20260908 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.3.0-20260908 Tue, 08 Sep 2026 19:02:30 GMT Security Onion 3.3.0 adds Logstash pipeline tuning and log-level controls in SOC, agentic memory with vector support, and Elasticsearch 9.4.5. • Adds tuning of multiple Logstash pipelines directly in SOC, including exposed `log.level` and `log.format` settings. • Adds agentic memory capability with a vector extension for Agent Studio. • Upgrades Elasticsearch to 9.4.5. • Detects hand-placed local/salt files during Auto State Apply to surface conflicts before they break state runs. • Adds log rotation for hypervisor logs. • Pushes a grid-wide highstate to remote nodes after a `soup` upgrade to ensure all nodes converge immediately. • Allows airgap installs to reuse previously extracted Docker images, reducing re-extraction time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.2.0-20260729 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.2.0-20260729 Wed, 29 Jul 2026 18:11:36 GMT Security Onion 3.2.0 adds agentic AI (Gemma-backed Investigator/Engineer), Sigma playbooks, ES|QL defaults, data stream lifecycle management, and UEK8 kernel support. • Adds agentic AI capability with Gemma-backed Investigator and Detection Engineer agents for automated analysis workflows. • Supports Sigma playbooks (including airgap environments), enabling SigmaHQ rules against Elastic Defend logs. • Adds data stream lifecycle management support for Elasticsearch index management. • Upgrades to Elasticsearch 9.3.7. • Adds UEK8 kernel support across install and grid, with UEK8 set as the boot default. • Adds cluster health monitoring option to telegraf.conf for Elasticsearch observability. • Makes failed soup upgrades and hotfixes resumable instead of requiring a full restart. • Adds toggleable PostgreSQL metrics collection. • Supports multiple capinfos versions for PCAP analysis compatibility. Breaking changes: • The `icsnpp-modbus` parser is removed from defaults.yaml; grids relying on the default Modbus protocol parser will no longer have it enabled after upgrade. • The Detection Engineer agent configuration key is renamed to `DetectionEngineer`; existing configurations using the old key will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.1.0-20260521 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.1.0-20260521 Thu, 21 May 2026 19:43:15 GMT Security Onion 3.1.0 adds Sigma rules for M365/Fortigate, JA4D ingest pipeline, RAID monitoring for VMs, ingest latency metrics, and upgrades to Elasticsearch 9.3.3. • Adds Sigma rules pipeline mapping for Microsoft 365 and Fortigate log sources. • Adds zeek.ja4d ingest pipeline for JA4D fingerprint processing. • Adds ingest latency metrics collection. • Adds RAID monitoring for virtual machine deployments. • Adds so-postgres Salt states and supporting infrastructure. • Upgrades to Elasticsearch and Elastic Agent 9.3.3. • Adds fleet package registry health check. • Supports bond1 interface for management network configuration. • Supports minion node descriptions containing spaces. • Adds per-OS-type process creation (proc_creation) Sigma rule handling. • Enables read-only SOC and Kratos modes. • Syncs Elastic Agent packages to fleet nodes automatically. • Verifies Elasticsearch version compatibility across all nodes in the cluster. Breaking changes: • Telegraf output changed from BOTH to INFLUXDB only — deployments relying on the previous dual-output behavior will no longer write to the non-InfluxDB target after upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.0.0-20260331 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/3.0.0-20260331 Tue, 31 Mar 2026 17:48:36 GMT Security Onion 3.0.0 adds Gemini AI integration, OpenAI protocol support, AI session reports in cases, and removes Stenographer in favor of Suricata-based PCAP. • Adds Google Gemini AI model support for the Assistant. • Adds OpenAI protocol support for AI Assistant integrations. • Introduces an AI Session Report Template in the Assistant for summarizing investigation sessions. • Attaches AI session transcripts to Case Reports via Case Report Update for AI Session Attachments. • Adds an 'Investigated Query Toggle Filter' in the Assistant to filter by investigated status. • Exposes login form lifespan as a configurable setting in the Security Onion Console. • Removes Stenographer (steno); PCAP capture and cleanup now handled by Suricata. • Enables and disables PCAP capture for Suricata directly from the SOC interface. • Removes the 10 TB virtual disk limit for VM deployments. • Supports additional Subject Alternative Names (SANs) in the web certificate. • Upgrades to Elasticsearch 9.0.8. • Upgrades Salt to version 3006.19. • Adds upgrade path support from 2.4.x to Security Onion 3.0. • Switches Elastic Agent log ingestion from the deprecated 'logs' integration to 'filestream'. • Includes all so-grid-nodes_* policies in automatic Elastic Agent upgrades. Breaking changes: • Stenographer (steno) is removed; any configuration or workflows depending on Stenographer for PCAP capture will break — PCAP is now handled by Suricata. • The QWEN 235B model is removed from defaults.yaml; any AI Assistant configurations referencing that model ID will no longer function. • The Elastic Agent 'logs' integration is replaced by 'filestream'; any custom configurations using the deprecated 'logs' integration will need to migrate to 'filestream'. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.211-20260312 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.211-20260312 Thu, 12 Mar 2026 17:23:02 GMT Security Onion 2.4.211 removes the 10 TB virtual disk limit for VM deployments. • Removes the 10 TB virtual disk size limit for virtual machine hosts, enabling larger storage allocations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.210-20260302 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.210-20260302 Mon, 02 Mar 2026 20:05:49 GMT Security Onion 2.4.210 adds Gemini AI integration, OpenAI protocol support, AI session reports in cases, and a path to upgrade to 3.0. • Adds Google Gemini as a supported AI backend for the Assistant. • Adds OpenAI protocol support for the Assistant AI integration. • Introduces an AI Session Report template in the Assistant for structured session summaries. • Attaches AI session transcripts to Case Reports, enriching incident documentation. • Adds an 'Investigated Query Toggle Filter' in the Assistant for focused alert triage. • Exposes login form session lifespan as a configurable option in the Security Onion console. • Adds upgrade path support for migrating to Security Onion 3.0. • Upgrades Elasticsearch to 9.0.8. • Upgrades Salt to 3006.19. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.200-20251216 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.200-20251216 Tue, 16 Dec 2025 16:12:11 GMT Security Onion 2.4.200 adds advanced ILM controls in SOC UI, PCAP annotations, JA4D fingerprinting, AI assistant model management, and Suricata 8.0.2. • Adds Advanced ILM (Index Lifecycle Management) actions accessible directly from the SOC UI. • Adds PCAP annotations, enabling analysts to annotate packet capture data within the interface. • Adds JA4D fingerprinting option via `config.zeek.ja4` for enhanced TLS client fingerprinting. • Upgrades Suricata to version 8.0.2. • Adds AI Assistant model availability listing and per-model enabled/disabled flag in the assistant configuration. • Adds context prompt compression for the AI Assistant. • Adds Elasticsearch retention estimation capability (`so-elasticsearch-retention-estimate`). • Renames 'forward node' to 'sensor node' throughout the platform. • Adds `so-yaml` support for using YAML file content as values. • Introduces hypervisor environment support with virtual disk management and a new `nsm_total` grain. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.190-20251024 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.190-20251024 Fri, 24 Oct 2025 21:40:07 GMT Security Onion 2.4.190 adds BYOH hypervisor support, exclusion toggles, CSV delimiter config, OOM detection, and upgrades Elasticsearch to 8.18.8. • Adds Bring Your Own Hypervisor (BYOH) support, enabling users to create VMs that mount a virtual disk for /nsm. • Introduces a new `nsm_total` grain for tracking total NSM storage across virtual disk mounts. • Adds an exclusion toggle in the UI for managing detection exclusions. • Adds OOM (out-of-memory) check to `so-log-check` for proactive health monitoring. • Adds CSV delimiter configuration and query name support for data export workflows. • Adds a new field for assistant health check status. • Adds filter support in the relevant UI views. • Adds new configuration entries for expanded service customization. • Implements host OS overhead calculation based on node role for more accurate resource planning. • Upgrades Elasticsearch to version 8.18.8. • Supports non-async Salt state apply for synchronous configuration management operations. • Updates the default AI investigation prompt for improved analyst guidance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.180-20250916 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.180-20250916 Wed, 17 Sep 2025 18:18:33 GMT Security Onion 2.4.180 adds hardware virtualization support, NIC channel customization, configurable per-agent realert thresholds, and Zeek DNS resolved IP logging. • Adds hardware virtualization support for manager/search and standalone nodes, including hypervisor firewall rules. • Adds NIC channel customization for network interface tuning. • Adds configurable realert threshold per elastic agent. • Adds `so-elastic-agent-monitor` for monitoring elastic agent health. • Adds support for a custom FQDN on receiver nodes. • Adds Zeek `dns.resolved_ip` field logging. • Adds additional Fleet Node state visibility in the UI. • Adds Ruleset Name UI element for improved rule management display. • Upgrades Elasticsearch to 8.18.6. • Changes Suricata metadata index rollover from 1 day to 30 days, reducing index churn. Breaking changes: • Fleet Nodes will need to be reinstalled after upgrading to this release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.170-20250812 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.170-20250812 Tue, 12 Aug 2025 14:06:55 GMT Security Onion 2.4.170 adds JA4 fingerprinting, hardware virtualization support, Playbooks with airgap support, and an Elasticsearch troubleshooting script. • Adds JA4 TLS fingerprinting support for enriched network traffic analysis. • Adds hardware virtualization support, including libvirt states and salt.cloud state execution on standalone and managersearch nodes. • Adds Playbooks feature with support for airgap environments and configurable ruleset repos. • Adds `so-elasticsearch-index-growth` command for monitoring Elasticsearch index growth. • Adds `dns.resolved_ip` field support for DNS log enrichment. • Adds `network.community_id` from Zeek when available, improving cross-log correlation. • Upgrades Elasticsearch to 8.18.4. • Upgrades Zeek EtherCAT plugin. • Enables HTTP Strict Transport Security (HSTS/STS) for browser redirects. • Adds `user.name` field to Kratos identity queries. • Adds `RulesetName` to rule repository configuration. • Simplifies and updates UniFi dashboards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.160-20250625 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.160-20250625 Wed, 25 Jun 2025 17:49:49 GMT Security Onion 2.4.160 adds Playbooks with airgap support, a new index-growth tool, and expanded ECS field mapping. • Adds Playbooks feature with a dedicated repo config and parsing support for automated response workflows. • Adds airgap support for Playbooks, enabling Playbook functionality in isolated/offline deployments. • Adds `so-elasticsearch-index-growth` command to monitor Elasticsearch index growth trends. • Adds `RulesetName` field to Rule Repos for improved rule repository identification. • Adds support for `dns.resolved_ip` ECS field in parsing. • Uses Zeek's `network.community_id` when available for improved correlation across data sources. • Enables HTTP Strict Transport Security (STS) for browser redirects. • Upgrades internal registry to version 3.0.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.150-20250512 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.150-20250512 Mon, 12 May 2025 14:35:20 GMT Security Onion 2.4.150 adds external Kafka access with auth, background config UI actions, subgrid support, and Strelka scanner improvements. • Enables external access to Kafka topics via username/password authentication for remote clients. • Supports background actions via the config UI, allowing long-running operations without blocking the interface. • Adds additional grid and subgrid support in the SOC UI for richer data display. • Adds missing Strelka scanners and restarts Strelka containers automatically on config change. • Displays `user.name` instead of internal identity ID across the SOC UI via Kratos user.name lookup. • Collects Elasticsearch index sizes as a new storage metric. • Adds `url_base` to the web certificate for more flexible deployment configurations. • Automatically runs `so-rule-update` when rule configuration changes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.140-20250324 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.140-20250324 Mon, 24 Mar 2025 19:10:14 GMT Security Onion 2.4.140 adds PCAP import support for sensors in distributed grids and improves Zeek file extraction handling. • Supports PCAP imports for sensors in distributed grid deployments. • Adds Zeek file_extraction forcedType handling for single-line edge cases. • Includes observer.name in ldap_search results for richer event context. • Applies specified role when adding new users instead of defaulting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.130-20250311 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.130-20250311 Tue, 11 Mar 2025 17:15:38 GMT Security Onion 2.4.130 adds a Sankey chart to the Elastic Agent API dashboard, Zeek traceroute & NTP support, and upgrades Elasticsearch to 8.17.3. • Adds a Sankey chart to the Elastic Agent API dashboard visualizing the relationship between `process.name` and `process.Ext.api.name`. • Adds Zeek traceroute and NTP log integrations. • Upgrades Elasticsearch to 8.17.3. • Adds TLSv1.3 support to the nginx configuration. • Enables installation of Elastic integrations that require an Elastic license. • Adds multiline input support for managed integration configuration fields. • Updates osquery index templates for v1.15.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.120-20250212 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.120-20250212 Wed, 12 Feb 2025 16:16:11 GMT Security Onion 2.4.120 adds Trend Micro & OpenCTI integrations, Zeek 7 with HTTP/2 and QUIC, local lookup support, and a Connect API. • Adds Trend Micro integration support. • Adds OpenCTI threat intelligence (`ti_opencti`) integration support. • Adds Cloudflare Logpush integration support. • Upgrades to Zeek 7 with HTTP/2 protocol parsing and logging. • Adds OpenVPN and IPsec protocol support to Zeek. • Adds QUIC protocol support and field mappings to Zeek. • Introduces initial local lookup support for enriching events. • Introduces a Connect API for external integrations. • Adds process and file creation event mappings. • Adds a `so-ip-mappings` index for IP enrichment. • Enables adding annotations to existing detections. • Adds tuning notes capability to detections. • Adds detection status hunt view. • Adds ignored SIDs management in the UI. • Adds source dates display for detection rule sources. • Provides more flexibility for AutoEnable Sigma rules. • Generates MSI installer for the Security Onion agent. • Adds a local custom Logstash pipeline template support. • Adds a new limit on bulk creating related events to improve scalability. • Enables ILM (Index Lifecycle Management) on managed indices. • Adds HTTP/2 support to the Elastic Agent Logstash pipeline. • Invalidates user sessions when an admin changes a user's password. • Allows the CA certificate to be downloaded from the UI. • Makes MFA issuer name a standard (non-advanced) setting. • Refactors ATT&CK Navigator for detections, including airgap support. • Keeps imported data in a dedicated `logs-import-so` index. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.110-20241004 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.110-20241004 Mon, 07 Oct 2024 19:19:40 GMT Security Onion 2.4.110 adds Barracuda/Imperva integrations, Elastic Defend filter management, PKCE OIDC support, and custom IDH skins. • Adds Barracuda and Imperva log source integrations. • Adds initial support for managing Elastic Defend Filters through Security Onion. • Adds PKCE OIDC authentication support. • Enables automatic upgrades of Elastic integrations when new versions are available. • Enables Suricata for PCAP on Standalone installs. • Supports custom IDH (Interactive Defense Hub) skins. • Adds external support for Detections management. • Adds destination IP visibility for so-system. • Enables STIG hardening for Security Onion desktop installs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.100-20240829 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.100-20240829 Thu, 29 Aug 2024 20:19:17 GMT Security Onion 2.4.100 adds AI-powered alert summaries, mandatory OTP enforcement, and Tenable.io integration. • Adds AI-generated summaries for alerts via new 'ai summaries' capability in SOC. • New setting to require OTP (one-time password) for user authentication. • Adds Tenable.io integration for ingesting vulnerability data. • Adds SSH warning to the `soup` upgrade tool to alert administrators before proceeding. • Adds support for new appliance RAID controllers. • Upgrades Elastic stack to version 8.14.3. • Upgrades Salt to version 3006.9. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.90-20240729 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.90-20240729 Mon, 29 Jul 2024 16:50:06 GMT Security Onion 2.4.90 adds custom SOC actions, Suricata regex support, Kafka InfluxDB metrics, and a faster detection refresh interval. • Adds a new action to the SOC Actions list so users can more easily add their own custom actions. • Supports regex in Suricata rule management within the Detections interface. • Adds Kafka InfluxDB metrics collection and pillar configuration support. • Introduces new configuration values for the Detections Bulk Indexer. • Reduces detection refresh interval to 1 second for near-real-time detection index updates. • Disables Logstash on heavy nodes to streamline pipeline architecture. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.80-20240624 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.80-20240624 Tue, 25 Jun 2024 19:29:20 GMT Security Onion 2.4.80 adds Kafka integration, separate Suricata alerts stream, and proxy/TLS config keys • Add initial Kafka support for message transport • Separate Suricata alerts into a specific data stream • Add `SOC_PROXY` setting to configure proxy connections • Add `AdditionalCA` and `InsecureSkipVerify` options to enable custom CA and TLS verification control • Add `detections_without_license` option to allow detections without a license key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.70-20240529 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.70-20240529 Wed, 29 May 2024 20:43:17 GMT Security Onion 2.4.70 adds Kismet WiFi integration, manual sync settings, auto-enabled Sigma rules, and new UI column layouts. • New `kismet` integration for collecting WiFi device logs • New `Add manual sync settings` in the Detections panel for controlling rule updates • Auto-enabled Sigma rules based on user role or default configuration • Added `event.module`, `event.dataset`, `process.command_line`, and SSL columns to Events table layouts • New individual dashboards for Zeek SSL, Suricata SSL, SOC Login Failures, and Elastic Agent status • Lowered EVAL memory requirement to 8GB RAM Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.60-20240320 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.60-20240320 Wed, 20 Mar 2024 15:01:06 GMT Initial Support for Detections Module with auto-update and airgap capabilities • `Add Detection AutoUpdate config` enables automatic detection rule updates in the new Detections module • `Airgap Support - Detections module` allows the Detections module to operate in offline/air-gapped environments • `Add Exclusion toggle` provides a UI control to exclude specific items from detections within the Detections module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.50-20240220 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.50-20240220 Tue, 20 Feb 2024 15:06:20 GMT Adds Suricata IKE pipeline, manage custom ES/L pipelines in UI, and process ancestry SOC action • Add Suricata IKE pipeline for IKE protocol detection • Manage custom Elasticsearch and Logstash pipelines via the UI • New `Process Ancestry` action on the SOC Actions menu to show process tree • Add new dashboards for community_id and firewall auth Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.40-20240116 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.40-20240116 Wed, 17 Jan 2024 19:06:33 GMT Security Onion 2.4.40 adds threat intelligence analyzers, eml observable type, certificate fingerprints and grid UI enhancements • Adds support for nested keys in observable data structures • Adds certificate fingerprinting capabilities for endpoint/identity correlation • Adds new integrations with ThreatFox, MalwareBazaar, Echotrail, and Elasticsearch as analyzer sources • Adds `grid page enhancements` to display last highstate date/time on grid metrics screen and expose max upload metrics Breaking changes: • Removal of Curator configuration and associated logic, which may affect manual index management scripts if they relied on previous Curator state. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.30-20231113 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.30-20231113 Mon, 13 Nov 2023 20:30:05 GMT Security Onion 2.4.30 adds Sublime, Checkpoint, VSphere integrations and OIDC support. • Adds `oidc` authentication support for single sign-on via Identity Providers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.20-20231006 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.20-20231006 Fri, 06 Oct 2023 20:47:47 GMT Security Onion 2.4.20 adds syslog ingestion on heavy nodes and regex/transform roles for log processing. • Add syslog to heavynode • Regex & Transform Role • New Config Default: longRelayTimeoutMs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.10-20230815 https://github.com/Security-Onion-Solutions/securityonion/releases/tag/2.4.10-20230815 Tue, 15 Aug 2023 11:15:35 GMT Security Onion 2.4.10 enables agent upgrade checks during highstate, moves base_url to cert SAN, and upgrades integration packages. • Enable `so-agent-upgrade` check during Salt highstate execution via PR #10997 • Move `base_url` configuration into the certificate Subject Alternative Name (SAN) via PR #11002 • Upgrade integration packages to latest versions via PR #11014 Breaking changes: • `base_url` is no longer a standalone configuration field; it must now be defined within the certificate Subject Alternative Name (SAN) list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://docs.securityonion.net/en/2.4/release-notes.html https://docs.securityonion.net/en/2.4/release-notes.html Mon, 07 Aug 2023 20:31:31 GMT Security Onion 2.4.5 RC2 adds NetworkMiner to Desktop, Elastic Defend CommunityID support, SO-Import-EVTX timeshift, Heavy Node and Soup log rotation. • Enables CommunityID for Elastic Defend Logs • Adds so-import-evtx with timeshift capability • Adds support for Heavy Nodes in the grid architecture • Adds log file rotation for the `soup` service Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://docs.securityonion.net/en/2.4/release-notes.html https://docs.securityonion.net/en/2.4/release-notes.html Fri, 28 Jul 2023 20:01:39 GMT Security Onion 2.4.4 RC1 adds Oracle Linux support, dynamic observable extraction in Cases, and new Hunt URL parameters. • Adds `Oracle Linux` as a supported platform for Security Onion installation • Enables dynamic observable extraction in Cases with a new configuration option • Adds `timeframe` and `refresh_interval` as URL parameters to the Hunt interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://docs.securityonion.net/en/2.4/release-notes.html https://docs.securityonion.net/en/2.4/release-notes.html Wed, 12 Jul 2023 15:04:36 GMT Security Onion 2.4.3 Beta 4 adds PCAP/EVTX UI import, WebAuthn SOC login, and time zone selection. • Adds `so-import-evtx` subcommand to allow importing EVTX logs • Allow import of PCAP and EVTX via SOC UI • Add webauthn support to SOC • Add time zone selection to Grid page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion https://docs.securityonion.net/en/2.4/release-notes.html https://docs.securityonion.net/en/2.4/release-notes.html Thu, 01 Jun 2023 13:38:28 GMT Security Onion 2.4.2 Beta 3 adds Apple Silicon support, EQL in playbooks, Elastic Defend integration, and airgap switching. • Adds `Add support for Apple Silicon Elastic Agent Installer` to allow deployment on ARM64 endpoints. • Adds `EQL to Playbook` support enabling Event Query Language queries within automated response workflows. • Adds `Elastic Defend Integration on Endpoints Policy` to manage endpoint protection via the platform. • Adds capability to `Allow for any docker container to have extra hosts and custom binds` via configuration. • Adds `Airgap` mode switching via UI, allowing users to toggle between airgap and non-airgap configurations. • Adds `Dedicated Elastic Fleet Node` role for separating fleet management traffic. • Adds `Integrate Elastic Artifact Repo` for accessing external artifacts within the platform. • Adds `Integrate Elastic Package Registry` for managing packages centrally. • Adds support for creating a `ISO image` installer distribution. • Adds grid interface link to `Docker container log files` for debugging. • Adds DNS record verification prompt during setup if a DNS record is found for manager nodes. • Adds Quicklinks to common configs in the UI. • Adds support for processing multiline config lines individually with regex when `multiline: True` is set in SOC config UI. • Adds authentication rate limiting capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/security-onion