U-anyanisi Wokuvikeleka: Umhlahlandlela ophelele wale distro yezokuphepha ehambisana namanye ama-pentesting-type distros.

I-Security Onion isibe ngelinye lamapulatifomu okufanele noma ubani osungula noma osebenzisa i-SOC ajwayelene nawo. Imahhala, ivulekile, futhi ihlanganisa ukuqapha inethiwekhi, ukuzingela izinsongo, kanye nokuphathwa kwamalogi endaweni eyodwa , kanye neqoqo lamathuluzi aqinisekisiwe okukhiqiza asheshisa umsebenzi weBlue Team.

Ngaphambi kokungena ngaphakathi, kubalulekile ukubeka amathemba angokoqobo: akuyona inkinobho yomlingo noma inkinobho "yokulungisa konke" . Amandla ayo alele endleleni ehlanganisa ngayo izingxenye eziningi kanye nokwahlulela kwethimba eliyisebenzisayo. Idinga ukufunda indlela yokuyisebenzisa, ukuyivumelanisa nendawo ngayinye, kanye nokwandisa amakhono ayo; uma senza kanjalo, ipulatifomu iletha inani elikhulu.

Uyini U-anyanisi Wokuvikeleka futhi yini oyixazululayo?

I-Security Onion iwukusatshalaliswa kwe-Linux okugxile ekutholeni izinsongo kanye nokuphendula, okuhlanganisa i-IDS/IPS, ukuhlaziywa kwethrafikhi, ukuphathwa kwemicimbi, nokuningi, okufana nokunye ukusatshalaliswa kokuphepha . Yenzelwe ukuzingela izinsongo, ukuqapha ukuphepha kwebhizinisi, kanye nokuphathwa kwamalogi , ngezixhumanisi ezenziwe ngokwezifiso zezaziso, amadeshibhodi, ukuzingela, i-PCAP, ukutholwa, kanye nokuphathwa kwamacala. Iphinde ifake amathuluzi anjenge-osquery, i-CyberChef, i-Elasticsearch, i-Logstash, i-Kibana, i-Suricata, kanye ne-Zeek.

Ngemuva kwephrojekthi kukhona i-Security Onion Solutions, LLC. Bakha futhi balondoloze ipulatifomu futhi baxhase intuthuko yayo ngemikhiqizo nezinsizakalo zezentengiselwano ; lapho inkampani ibhalisela ukwesekwa kwayo noma izinhlelo zayo zobungcweti, inikela ekuguqukeni okuqhubekayo kwephrojekthi ngokuhambisana nesimo sengozi esishintsha njalo.

U-anyanisi Wokuvikela Izingxenye Ezifakiwe Namathuluzi

Enye yamandla ayo amakhulu ukukhetha kwayo izinjini ezakhelwe ngaphakathi kanye nezinsiza ezilungele ukuhlanganiswa. I-suite ihlanganisa ukubanjwa kwephakethe, i-IDS esekelwe emithethweni, kanye nokuhlaziywa kwethrafikhi okujulile , kanye ne-HIDS kanye ne-stack yokusesha/yokubona eqinile.

Thatha ithrafikhi nge-netsniff-ng

Phakathi kwezingxenye ezisebenza ezingeni eliphansi kukhona i-netsniff-ng. Le ngxenye ibamba ithrafikhi futhi iphatha kahle isitoreji se-PCAP , isusa idatha endala uma kudingeka ukuze kugwenywe ukugcwala kwediski. Lokhu kuthwebula kubalulekile ekubukezeni ubufakazi bokuhluzwa, imikhankaso yobugebengu bokweba imininingwane ebucayi, noma ukungena okudinga ukuphinda kubuyelwe iphakheji ukuze kuqondwe ukuthi yini, kanjani, futhi nini.

I-IDS/IPS esekelwe kumthetho: I-Suricata ne-Snort

I-Security Onion ihlanganisa amathuluzi amabili okuthola asekelwe esiginesha asebekhulile, womabili afakwe ohlwini lwama -IDS aphezulu e-Linux : i-Suricata ne-Snort. Lawa mathuluzi asebenza ngemithetho evusa izexwayiso ngokusekelwe kumaphethini aziwayo . Athembele "ezigxivizweni zeminwe" ezigcinwe ezisekelweni zawo zomthetho futhi ayindlela yokuqala yokuzivikela yokuthola imindeni ye-malware, izinsongo ze-C2 ezaziwayo, ukuxhashazwa, kanye nokuziphatha okuchazwe ngaphambilini.

Ukuhlaziywa kwenethiwekhi no-Zeek

Ngaphezu kwalokhu okungenhla, i-Zeek (eyayikade iyi-Bro) isebenzisa indlela ehlukile. Yenza ukuhlola okungenamsebenzi futhi ikhiqiza amalogi anemininingwane yokuxhumana (conn, dns, http, ssl/tls, phakathi kwezinye). Ngaphandle kwama-IP, amachweba, namaphrothokholi, inikeza izimfanelo ezicebile njengemibuzo ye-DNS, imininingwane ye-TLS, kanye nolwazi lwe-Layer 7 lwamaphrothokholi amaningi: i-HTTP, i-FTP, i-IRC, i-SMTP, i-SSH, i-SSL, kanye ne-Syslog, phakathi kwezinye.

Isibonelo esisebenzayo sokuguquguquka kwayo: imithombo esekelayo efana namafayela e-CSV aqukethe ulwazi lwenkampani ingangeniswa futhi ibhekiselwe kumicimbi yokulanda, ukungena ngemvume, noma eminye imisebenzi. Lokhu kuxhumana kungasetshenziswa ukondla i-antivirus, i-antimalware, noma uhlelo lwe-SIEM ukuhlela impendulo esheshayo.

I-HIDS kuma-endpoints no-Wazuh

Ukubonakala kuthuthukiswa kakhulu yi-IDS esekelwe ku-host. I-Wazuh iqapha indawo ngayinye yokugcina ngama-ejenti e-Windows, Linux, kanye ne-macOS , ihlaziya amalogi esistimu, iqinisekisa ubuqotho befayela, izinqubomgomo zokuqapha, kanye nokuthola ama-rootkit. Ngezixwayiso zayo zesikhathi sangempela kanye nezenzo zokuphendula, ingeza ungqimba olusebenzayo kusu lakho lokuphepha. Ihlanganiswe ngokugcwele ne-Elastic Stack yokusesha nokubona ngeso lengqondo.

Sesha Amathuluzi Wesitaki Nokuhlaziya

I-Security Onion iletha i-Elasticsearch kanye ne-Kibana ukuze kutholakale imibuzo namadeshibhodi, kanye nezinsiza ezenzelwe umsebenzi wansuku zonke womhlaziyi. I-Sguil isebenza njengebhuloho phakathi kwe-IDS/IPS kanye nokubanjwa kwamaphakethe , isheshisa ukuhlaziywa kwezibalo kanye nophenyo oluhlanganyelwe. Kufakwe ne-Squert, i-CapMe, kanye namanye amadeshibhodi azimele okuzingela, i-PCAP, kanye nokuphathwa kwamacala.

Ezinye izinsiza ezakhelwe ngaphakathi

Ukuze kwenziwe imisebenzi yokuhlaziya okusheshayo kanye nokubhala ikhodi, ipulatifomu ifaka i-CyberChef. Ingummese we-Swiss Army wokuguqula nokuhlola izinto ezisetshenzisiwe ngaphandle kokushiya imvelo ye-SOC. Kanye ne-osquery, ikuvumela ukuthi ubuze yonke indawo yokugcina ngezimo kanye nezimfanelo ngobuningi.

I-Meerkat/Snort vs. Zeek: Izindlela Ezihambisanayo

Kubalulekile ukuhlukanisa phakathi kwamamodeli amabili okuthola avame kakhulu epulatifomu. I-Suricata ne-Snort ziqala izexwayiso ezisekelwe emithethweni futhi zingahlola noma zivimbele ngaphandle kokwenza (kuye ngokuthi kusetshenzisweni), kuyilapho i-Zeek ibeka phambili ukukhiqiza i-telemetry ecebile ukuze kwakhiwe kabusha izindaba zokuhlasela. Le nhlanganisela isiza kokubili ukuthola izinsongo ezaziwayo nokuphenya ezingaziwa.

Ukubonakala nokuhlaziya ku-Anyanisi Wokuphepha: Sguil, Squert, Kibana kanye neCapMe

I-SOC enhle ayigcini nje ngokubangela izexwayiso; idinga umongo, ukubambisana, kanye nomsebenzi. I-interface ka-Sguil ihlanganisa imicimbi futhi ikuvumela ukuthi ushintshele ku-PCAP ukuze ubone kahle ukuthi kwenzekeni kukhebula. I-Squert inikeza imibono eguquguqukayo, i-Kibana inikeza usesho olungokwezifiso namadeshibhodi, kanti i-CapMe yenza kube lula ukukhipha amaphakethe afanele ekesini elithile.

Le mibono ehlanganisiwe inciphisa ukungezwani phakathi kwamaqembu: abahlaziyi bangabela ngokushesha, bandise, futhi babhale phansi isigameko ngasinye, bagweme ukunqamuka okuvamile phakathi kokutholwa, ukusesha, kanye nokuhlolwa kwe-forensics kwenethiwekhi.

Ukuqalisa Ngo-anyanisi Wokuvikela: Ukulanda, Ukubhalwa Kwemibhalo, kanye Nokwenza izinto ezibonakalayo

Indawo evamile yokuqala yindawo yokugcina esemthethweni. Ungalanda i-ISO kusuka ku-GitHub futhi, ngaphambi kwanoma yini enye, ubuyekeze amadokhumenti , afaka isigaba esibanzi kakhulu "Sokuqalisa" esinezindlela eziningana zokusebenzisa.

Uma ungenayo i-Linux host etholakalayo, ungakhathazeki: umhlahlandlela uhlanganisa izimo ze-virtualization nge-VirtualBox kanye ne-VMware , okuhlanganisa nokudala imishini ethile ebonakalayo yokusetha i-suite nokuqala ukuhlolwa kwenethiwekhi.

Izidingo ezincane ezinconyiwe

Ukuze uqale ngendlela efanele, amadokhumenti ngokwawo asikisela isisekelo esincane: i-CPU engama-64-bit enama-core amabili noma ngaphezulu, i-RAM engu-8 GB, isikhala sediski esingu-80 GB, kanye ne-NIC kwimodi yokuzilibazisa . Ezindaweni ezinabantu abaningi, kunengqondo ukwandisa i-RAM ibe ngu-16 GB noma ngaphezulu bese wengeza amakhulu amaningana esitoreji (noma okungcono nakakhulu, isitoreji esisheshayo) ukuze uphathe i-PCAP kanye nochungechunge lwamalogi.

Izinqamuleli eziwusizo: ishidi lokukopela

Esinye isisetshenziswa esiwusizo yithempulethi elisemthethweni leshidi lelogi. Leli shidi lokukhohlisa lihlanganisa imiyalo yokulungisa kanye nezindlela zamafayela eziyisihluthulelo , elifanele ukuthola amalogi esevisi uma isikhathi sifushane.

Izindaba nokuziphendukela kwemvelo njalo

Le phrojekthi ihamba ngokushesha ngoba nomncintiswano nawo uyaqhubeka. Enye yezibuyekezo zakamuva ezinkulu inguqulo 2.4.120 (uFebhuwari 2025) , efike igcwele intuthuko.

• Isixhumi esibonakalayo sezaziso esinezifinyezo ezinamandla ze-AI ukuqonda izenzakalo ngokubuka nje kanye nokusheshisa impendulo.
• I-Zeek 7 ihlanganisiwe, ngokusekelwa okunwetshiwe kwezivumelwano ezifana ne-QUIC, HTTP/2, OpenVPN noma i-IPsec, ukuthuthukisa ukutholwa nokuhlaziya.
• I-ATT&CK Navigator eyakhelwe kumephu imicimbi kuhlaka lwe-MITER ATT&CK futhi ubeke phambili izinsongo ngobuhlakani.
• I-API yangaphandle ku-Security Onion Pro, iwusizo ekuhlanganiseni ngokwezifiso noma ukuxhumana okungokwezifiso.
• Ukubheka ikheli le-IP yendawo ngezincazelo zangokwezifiso ezibonakala ku-SOC, zisebenza kakhulu uma ama-PTR engekho noma ama-IP abalulekile azoqashelwa.

Ngaphezu kuka-2.4.120, i-cadence yokukhululwa iqhubekile no-2.4.130, 2.4.140, 2.4.141, 2.4.150, 2.4.160 kanye no-2.4.170 kulo lonke u-2025, okuqinisekisa ukuthi umjikelezo wokuthuthukisa uyaqhubeka nokuthi kuyafaneleka ukuhlala usesikhathini.

Amacala okusetshenziswa okuvamile

I-Security Onion ifanelana nezimo eziningi. Kusukela ekutholeni imizamo yobugebengu bokweba imininingwane ebucayi kuya ekuzingeleni izinsongo ze-C2, ukuphenya ukukhishwa kwemininingwane, noma ukufaka izingodo ndawonye ukuze kubonakale ngokuhlangene. Imvelo yayo evulekile neyi-modular iyasiza ekuzivumelaniseni namabhizinisi amancane naphakathi nendawo kanye nezikhungo ezinkulu zedatha.

Kunini lapho kwenziwa ukuhlolwa kwenethiwekhi nge-Security Onion?

Ukuhlolwa okuvamile kuyingxenye ebalulekile yanoma yiluphi uhlelo lokuphepha. Akudingeki ulinde kuze kube yilapho ukwephulwa kwemithetho kubukezwa inethiwekhi yakho , kodwa kunezimo lapho ukukubeka phambili kubalulekile khona.

• Izinguquko kwingqalasizinda: amasistimu amasha, izinhlelo zokusebenza, noma izixazululo ze-IT; qinisekisa ukuthi konke kusebenza kahle futhi ngaphandle kwamagebe amasha.
• Izigameko zokuphepha: Ngemva kokuhlasela okuyimpumelelo, ukuhlola kubalulekile ukuze uqonde i-vector futhi uqinise lapho kunesidingo.
• Izinkinga zokusebenza: Ukunensa noma ukunqanyulwa kungafihla ukwehluleka noma ukuhlukumeza okuvezwa ucwaningo.
• Ukunwetshwa kwebhizinisi: izindawo eziningi, iminyango, noma amaphethini okushintsha abasebenzi; ukulinganisa kabusha kuyadingeka.
• Ukuhlola okuhleliwe: : ngaphandle kwesizathu esizwakalayo, ukuhlela ukuhlolwa okuvamile kukusiza ukuthi uthuthuke ngaphambi kokuthusa.

Kunoma ikuphi, uma ungenalo ulwazi, kuwukuhlakanipha ukuthembela ezinkampanini ezikhethekile ezivumelanisa ukuhlolwa nezimo ezizungezile futhi zigweme izindleko ezifihliwe ezibangelwa ukungasebenzi kahle.

Ukuthunyelwa nokumisa

Ukufakwa kwesistimu kungaphezu kokufaka nokusebenzisa uhlelo. Kudinga ukuchaza izixhumi zenethiwekhi, izinzwa, ukuphathwa kwezixwayiso, kanye nemithetho ukuze kuhambisane nezidingo ezithile zenhlangano. Umphakathi kanye nemibhalo esemthethweni kuhlinzeka ngamathempulethi nezincomo zokwakha ukuze kukusize uqalise ngendlela efanele.

Ukuboniswa okungokoqobo: uphenyo lokucwiliswa

Ukuze siqonde indlela yokusebenza, siphakamisa umsebenzi osebenzayo: ukuhlaziya icala lokukhipha idatha sisebenzisa amathuluzi e-Security Onion.

Ngenisa i-PCAP futhi ulungise imvelo

Ngaphambi kokulayisha i-PCAP, kungumqondo omuhle ukuhlanza izexwayiso kanye nokuboniswa ku-Elasticsearch ngemiyalo embalwa yokulungisa. Ngemuva kwalokho, ngenisa ifayela le-.pcap usebenzisa insizakalo efanele.

Uma okuthile kungaqali ekuqaleni kokuzama, zama ukuqala kabusha umshini wakho. I-Security Onion ihlela izinsizakalo zayo kuma-Docker containers , futhi kungathatha isikhashana ukuqala konke ukusebenza ngemva kokuqalisa. Ungabuka isimo sesikhathi sangempela sama-containers usebenzisa umyalo othi `uhlu`.

Ungakhathazeki uma izitsha ezintathu zokugcina zibonakala sengathi zi-DISABLED : lokho kusho ukuthi akukho ukuthwebula ngesikhathi sangempela; i-PCAP isazohlaziywa nge-Suricata kanye ne-Zeek.

Ithrafikhi Enonya: Ihlola Ukugeleza Ngo-anyanisi Wokuvikela

Ukugeleza kwe-TCP yokuqala

1. Hlunga izexwayiso ngokulandelana kwazo kusukela kulolo chungechunge lwesikhathi, kusukela kokuncane kuya kwakamuva kakhulu, ukuze ubone ukulandelana okuphelele.
2. Khomba I-IP yomthombo, i-IP yendawo kanye nezimbobo abathintekayo kulokhu kushintshana kokuqala okuya kwi-Intanethi.
3. Qaphela isexwayiso esifisa ukwazi: i-PDF icelwa ngokuqondile ku-IP esikhundleni sesizinda; iyini isignesha eyenza?
4. Ngaphambi kwaleso sicelo, siyavela i-ejenti yomsebenzisi eziveza njenge-curl; qaphela ukuhlobana kwakamuva.
5. Isexwayiso sakamuva sokugeleza, sibonisa ukuthi kwenzekeni? Ichaza isimo esidala umcimbi.
6. Vula noma yiziphi lezo zixwayiso futhi layisha ukusakaza okugcwele ukuze ubuyekeze yonke imilayezo ngokuningiliziwe.
7. Ngaphakathi kwalokho kwakhiwa kabusha, yini umsebenzisi-umenzeli uyabona ngempela?
8. Ingabe uyabona okuthile okusolisayo emzimbeni wempendulo ye-HTTP?
9. Thumela le thrafikhi ku imvelo ekhishini njengoCyberChef ukudlala naye.
10. Lapho, hamba ukususa izendlalelo nokuguqulwa kuze kube yilapho eveza okuqukethwe okuthakazelisayo.
11. Lapho ufinyelela umnyombo, ingabe avele izinkomba ezingavamile noma izinkomba ufanele i-IOC?

Ukugeleza kwe-TCP yesibili

1. Nge amachweba kanye namapheya e-IP Njengomhlahlandlela, khomba ukuthi yiziphi izexwayiso ezingezalokhu kugeleza kwesibili.
2. phinda i ukwakhiwa kabusha kwethrafikhi njengangaphambili ukuze ubone umongo kanye nemithwalo ekhokhelwayo.
3. Ingabe uthola Okuthile okungajwayelekile ekuhwebeni?

Ukugeleza kwe-TCP yesithathu

1. Thola izexwayiso ezimbili ezichaza ukugeleza kanye iphawula amapharamitha angukhiye (ama-IP, amachweba, iphrothokholi).
2. vula kabusha intambo yephakethe ukuze uhlolwe kabanzi.
3. Yini umsebenzisi-umenzeli isetshenziswa futhi yisiphi isenzo isicelo esizama ukusenza?
4. Ngemva kwalokhu kushintshana kuvela enye Isexwayiso sethrafikhi ye-HTTPS; ngokwalokho esikubonile, bekuzohambisana nani?

Ukusakaza kwe-TCP yesine

1. Kusenjalo badubule izexwayiso eziningi ezahlukene; ngephethini yakho, kubonakala sengathi kwenzekile?
2. Ungakwenza kanjani uya ujula kusukela izexwayiso ukubona kahle ukuthi kwenzekeni?
3. Ekubukeni kokugeleza, yini izinkomba ezibalulekile baziswa?

1. Vula ithebhu Hunt.
2. Phonsa a umbuzo ochazwe ngaphambilini ehlunga nge-event.module kanye ne- event.dataset.
3. Ku-Group Metrics, hlola ukuthi yini izinhlobo zamalogi u-Zeek aziqoqile.
4. Kokudonsela phansi kwemibuzo, khetha umbukiso zonke izixhumanisi ngomthombo we-IP, i-IP yendawo, iphrothokholi yenethiwekhi kanye nembobo okuyiwa kuyo.
5. Manje iqembu by Ukuxhumeka kwe-HTTP kanye nembobo yendawo.
6. Ingabe kukhona okuvelayo imbobo engajwayelekile ye-HTTP?
7. Uma kunjalo, yimake njenge Faka ukugxila kuye.
8. Emicimbini, uyayibona into okufanele ihlaziyweIvule ngokuningiliziwe njengoba wazi kakade.
9. Yini ukuthola kuvela lapho?

Eminye imizila yokuthola

1. Iqembu nge Ukuxhumana kwe-HTTP, indlela kanye ne-ejenti yomsebenzisi.
2. Yeka iphethini elithakazelisayo ingavumela ukuhlonzwa kwethrafikhi enonya nge-ejenti yomsebenzisi?
3. Iqembu nge I-HTTP host virtual.
4. Noma yimuphi umsingathi obonakalayo okungajwayelekile noma okusolisayo lokho kukhomba izenzo ezinonya?
5. Iqembu nge isaziso sedathasethi (Zeek).
6. Yini isignali esolisayo uyagqama?
7. Emicimbini, iqembu ngenkundla isaziso.umlayezo_ongaphansi.
8. Iyiphi inhlangano iningi labo eliphuma kuyo? Izitifiketi ze-TLSUcabangani?

Ukusekela U-anyanisi Wokuvikeleka, Umphakathi, kanye Nelayisensi

Umphakathi we-Security Onion usebenza kakhulu: amaforamu, amaqembu, kanye namadokhumenti abuyekeziwe kusiza ukuphendula imibuzo nokwabelana ngemikhuba emihle kakhulu. Ezinhlanganweni ezidinga okwengeziwe, kukhona ukwesekwa kwezentengiselwano kanye nohlelo lwe-Pro olunezici ezengeziwe zokuhlanganisa.

Ngokuphathelene nokunikezwa kwelayisense, le phrojekthi iyisofthiwe yamahhala futhi evulekile . Imininingwane kanye nezincazelo zelayisensi zingatholakala kuwebhusayithi esemthethweni kanye nasezindaweni zokugcina.

Izinsiza zangasese nezangaphandle

Uma ucwaninga, kuvamile ukubonisana ngezingxoxo ezisekelweni zezinkampani zangaphandle. Isibonelo, i-Reddit kanye nabalingani bayo basebenzisa amakhukhi kanye nobuchwepheshe obufanayo ukuze basebenzise isayithi, bathuthukise izinsizakalo, benze okuqukethwe/ukukhangisa kube ngokwakho, futhi balinganise ukusebenza. Ungamukela wonke amakhukhi noma wenqabe angabalulekile ngenkathi ugcina ukusebenza okuyisisekelo; ubuyekeze izaziso zamakhukhi kanye nobumfihlo babo lapho uphequlula izinsiza zabo.

Uma ungathanda ukufunda kabanzi noma ukuhlola izinketho zebhizinisi, sicela uvakashele iwebhusayithi yethu esemthethweni: securityonionsolutions.com . Uma unemibuzo noma iziphakamiso, sicela ungangabazi ukuxhumana nathi , futhi sizokusiza ukuqondisa inqubo yokuqalisa kumongo wakho othize.

I-Security Onion ihlanganisa ukubanjwa kwenethiwekhi, ukutholwa komsingathi, kanye nokuhlaziya—okubalulekile kwi-SOC yesimanje—kube yi-stack eyodwa. Nge-Suricata, Snort, Zeek, Wazuh, Elastic, Sguil, Squert, CapMe, kanye ne-CyberChef, ukubonakala kukhula ububanzi nokujula. Engeza kuleyo dokhumenti ephelele, izinketho ze-virtualization, ishidi lokukhohlisa eliwusizo, kanye nesheduli yokukhishwa eqinile equkethe ukuthuthukiswa okufana ne-interface entsha yezaziso, i-Zeek 7, kanye ne-ATT&CK Navigator, futhi unesisekelo esiqinile sokuzingela izinsongo kanye nokuphendula izigameko kumabhizinisi abo bonke osayizi.