Security Onion Essentials 2.3 - Detection Engineering

[@SkreenGG]

Great video. The playbook tool is very powerful and allows for unlimited customization. Thanks for this video!

[@security-onion]

Thanks, glad you like it!

[@PaulBenedict22]

This was an awesome way to understand detection engineering. I’m going to use and implement those 4 steps myself

[@security-onion]

Thanks, glad you like it!

[@UnwanaEssien]

Can I write this for data source of netflow ? Being that netflow is not processed by suricata etc

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@faizankhd]

Do you cover ELk kibana siem to detect different network attacks, lateral movement, ransomware attack, phishing attack , incident response ,etc

[@security-onion]

Not sure what you're asking. Security Onion includes the Elastic stack and Kibana. You can use Kibana or our own web interfaces (Alerts and Hunt) to detect these kinds of attacks.
If you have further questions or problems, please start a new discussion at securityonion.net/discuss.
Thanks!

[@lonewaffle]

I notice that they are all set to draft by default. Would it be a bad idea to turn most of them on? How big of an impact would that have on the server?

[@security-onion]

From docs.securityonion.net/en/2.3/playbook.html#putting-a-play-into-production:
"Performance testing is still ongoing. We recommend avoiding the Malicious Nishang PowerShell Commandlets play as it can cause serious performance problems. You may also want to avoid others with a status of experimental."
If you have further questions or problems, please start a new discussion at securityonion.net/discuss
Thanks!

[@absemperor7095]

very good

[@security-onion]

Thanks!