Toosmooth

Moved to Mastadon @[email protected]

[Security Onion @securityonion]

Are you on #Mastodon?

If so, you can find us at https://t.co/LjeiXHHAKY!

[Toosmooth @Toosmooth]

@[email protected] #Mastadon

[Security Onion @securityonion]

#SecurityOnion 2.3.180 now available!

Featuring:
✅#Elastic 8.4.3
✅#Suricata 6.0.8
✅#Zeek 5.0.2
✅New and improved #sysmon dashboards!

Thanks to @markrussinovich and team for #sysmon!

Need a #sysmon config? Check out @SwiftOnSecurity's!

Blog post:
https://t.co/k7ODl0J6GE

[Toosmooth @Toosmooth]

Steam Deck is awesome! It technically has the specs to run @securityonion Might be something good for next April?!? #ESM #NSM #SecurityOnion

[Toosmooth @Toosmooth]

Please take time to read the announcement. If you have questions please see our discussions page: https://t.co/nQiDoFomjR

[Security Onion @securityonion]

Security Onion Enterprise Features and Licensing
https://t.co/qPnbVHkRwt

[Toosmooth @Toosmooth]

@scottbourne @Apple I mean they only have like $48B in cash right now so sounds like thin ice to me.....

[Toosmooth @Toosmooth]

I hate computers

[Chris Sanders 🔎 🧠 @chrissanders88]

To date, we've helped 800+ schools and 150000+ students across all 50 states. But, there's a lot more work to do. This fundraiser is a chance for you to help and win some unique prizes.

[Toosmooth @Toosmooth]

Get your Sankey diagrams on!!!!!!

[Security Onion @securityonion]

🧅#SecurityOnion 2.3.130 now available including:

☑️Dashboards
☑️Analyzers
☑️and much more!

https://t.co/3k9CVX0EIp

#dfir
#infosec
#infosecurity
#threathunting
#incidentresponse
#networksecuritymonitoring
#enterprisesecuritymonitoring

[Toosmooth @Toosmooth]

Are you really doing security if you don't have a sankey? I think next we should add a pyramid graph with royalties paid to @DavidJBianco #pyramidofpain #SecurityOnion

[Security Onion @securityonion]

Sneak Peek: #SecurityOnion 2.3.130 and New Dashboards App
https://t.co/XWYr417bY5

[Toosmooth @Toosmooth]

Joining your analyst workstations to the grid in airgap environments allows you to keep them updated with the latest packages of each release. In non AG environments it allows you to use the same schedule for updates as the rest of the grid!

[Security Onion @securityonion]

#SecurityOnion 2.3.120 now available!

✅Improvements for Cases, Analyst Desktop, and IDH!
✅Lots of bug fixes!
✅#CyberChef 9.37.3
✅#Elastic 7.17.3
✅#FleetDM 4.12.1
✅#Suricata 6.0.5
✅#Zeek 4.0.6
✅#nginx 1.20.2

For more information, please see:
https://t.co/4ipgu28P9U

[Toosmooth @Toosmooth]

@rocky_linux Issue was on my end! ca-certificates needed updated and all is good now. Keep up the good work!

[Toosmooth @Toosmooth]

@rocky_linux Getting this: ERROR: cannot verify https://t.co/3x89B5ZHDj's certificate, issued by ‘/C=US/O=Let's Encrypt/CN=R3’:

Issued certificate has expired.

[Toosmooth @Toosmooth]

Thinking about switching to a gmmk pro. Should I get the brass plate is the big question. I already use the glorious panda switches with some drop MT3 keycaps. I need that function row.

[Security Onion @securityonion]

@taosecurity @RuralTechFund #SecurityOnion 2.3.100 20220301 Hotfix Now Available!
https://t.co/o2fuWOfeKj

[Chris Sanders 🔎 🧠 @chrissanders88]

With the IDH node now a core part of Sec Onion, you can deploy intrusion detection honeypots in your network with just a few keystrokes. If an attacker touches the honeypot, the alert goes straight into your sec onion console for investigation. This is BIG!

[Toosmooth @Toosmooth]

@jayl0w yea yea

[Toosmooth @Toosmooth]

This inspires me to talk about full pcap. I always recommend 5-7 days of full pcap. 3 in a pinch. If you feel you need more than that due to dwell times and the like, you don't need to be investing in space.. You need to be investing in people and process to find it sooner. #NSM

[Security Onion @securityonion]

Today's quick #malware analysis with #SecurityOnion: #Hancitor and #CobaltStrike pcap from 2022-02-01!

Thanks to @malware_traffic for sharing this pcap!

More screenshots:
https://t.co/TzyxHTnRUQ

#infosec
#infosecurity
#ThreatHunting
#IncidentResponse

[Toosmooth @Toosmooth]

Want to work on cool stuff like this? We are looking for Go developers! 100% remote, must live in the US and be a US citizen. https://t.co/1iFFyfGq4V #golang #remote #Jobs

[Security Onion @securityonion]

ICYMI yesterday we released #SecurityOnion 2.3.100!

This includes our new #CaseManagement interface!

#FreeAndOpen
#infosec
#infosecurity
#dfir
#ThreatHunting
#IncidentResponse
#NetworkSecurityMonitoring
#EnterpriseSecurityMonitoring

[Chris Sanders 🔎 🧠 @chrissanders88]

I've been playing with this some over the past couple of weeks and updated to the new release this morning. The SO team is laying some solid ground work with the new native case management feature. Super significant and immediately useful.