Cyber Security: Security Onion setelah Instalasi - Revision history

Unknown user: /* so-allow */

2023-07-18T02:00:32Z

so-allow

← Older revision		Revision as of 02:00, 18 July 2023
Line 37:		Line 37:

	Please enter your selection:		Please enter your selection:


			Cek juga menggunakan so-user untuk mengetahui user yang ada di security onion

			so-user list

			User admin / superuser dari security onion.

	==Wazuh==		==Wazuh==

Unknown user at 23:23, 12 July 2023

2023-07-12T23:23:58Z

← Older revision		Revision as of 23:23, 12 July 2023
Line 1:		Line 1:
	==~~Adjust~~ firewall rules ~~using~~ so-allow==		==Tuning firewall rules menggunakan so-allow==

	~~Depending on what kind of installation you did~~, ~~the~~ Setup wizard ~~may have already walked you through adding~~ firewall ~~rules to allow your analyst~~ IP ~~address(es)~~. ~~If you need to allow other~~ IP ~~addresses~~, ~~you can manually run~~ so-allow.		Tergantung pada jenis penginstalan yang Anda lakukan, Setup wizard mungkin telah memandu Anda melalui penambahan aturan firewall untuk mengizinkan alamat IP analis Anda. Jika Anda perlu mengizinkan alamat IP lain, Anda dapat menjalankan so-allow secara manual.

	==~~Services~~==		==Service==
	~~Verify services are running with the~~ so-status ~~command:~~
			Vertifikasi service berjalan dengan perintah so-status,

	sudo so-status		sudo so-status

	==Data ~~Retention~~==		==Retensi Data==
	~~Review the Curator and Elasticsearch sections to see if you need to change any of the default index retention settings.~~
	~~Other~~
	~~Full-time analysts may want to connect using a dedicated Analyst VM.~~
	~~Any IDS/NSM system needs to be tuned for the network it’s monitoring. Please see the Tuning section.~~
	~~Configure the OS to use your preferred NTP server.~~

			* Tinjau bagian Kurator dan Elasticsearch untuk melihat apakah Anda perlu mengubah salah satu pengaturan retensi indeks default.

			* Full-time analyst mungkin ingin terhubung menggunakan VM Analis khusus. Setiap sistem IDS/NSM perlu di set untuk jaringan yang dipantaunya.

			* Konfigurasi OS untuk menggunakan server NTP pilihan Anda.


	==so-allow==		==so-allow==
	Security Onion locks down the Firewall by default. Depending on what kind of installation you do, Setup may walk you through allowing your analyst IP address(es). If you need to add other analyst IP addresses or open firewall ports for agents or syslog devices, you can run sudo so-allow and it will walk you through this process.

	~~This program allows you to add a~~ firewall ~~rule to~~ allow ~~connections from a new~~ IP ~~address~~.		Security Onion mengunci Firewall secara default. Bergantung pada jenis penginstalan yang Anda lakukan, Setup dapat memandu Anda untuk mengizinkan alamat IP analis Anda. Jika Anda perlu menambahkan alamat IP analis lain atau membuka port firewall untuk agen atau perangkat syslog, Anda dapat menjalankan sudo so-allow dan ini akan memandu Anda melalui proses ini.

			Program ini memungkinkan Anda menambahkan aturan firewall untuk mengizinkan koneksi dari alamat IP baru.

	Choose the role for the IP or Range you would like to add		Choose the role for the IP or Range you would like to add

Line 38:		Line 39:

	==Wazuh==		==Wazuh==
	~~If you choose the analyst option, so-allow will also add the analyst IP address to the Wazuh safe list. This will prevent Wazuh Active Response from blocking the analyst IP address.~~

	==~~Automation~~==		Jika Anda memilih opsi analis, izinkan juga akan menambahkan alamat IP analis ke Wazuh safe list. Ini akan mencegah Wazuh Active Response memblokir alamat IP analis.
	~~In addition to the interactive~~ menu ~~shown above~~, ~~you can pass desired options as command line arguments~~:
			==Automatisasi==

			Selain menu interaktif yang ditampilkan di atas, Anda dapat memberikan opsi yang diinginkan sebagai argumen baris perintah:

	so-allow -h		so-allow -h
Line 47:		Line 50:
	Usage: /usr/sbin/so-allow [-abefhoprsw] [ -i IP ]		Usage: /usr/sbin/so-allow [-abefhoprsw] [ -i IP ]

	~~This program allows you to add a~~ firewall ~~rule to allow connections from a new~~ IP ~~address or~~ CIDR ~~range~~.		Program ini memungkinkan Anda menambahkan aturan firewall untuk mengizinkan koneksi dari alamat IP baru atau rentang CIDR.

			Jika Anda menjalankan program ini tanpa argumen, itu akan menampilkan menu bagi Anda untuk memilih opsi Anda.

	~~If you run this program with no arguments~~, ~~it will present a menu for you to choose your options~~.		Jika Anda ingin mengotomatiskan dan melewati menu, Anda dapat meneruskan opsi yang diinginkan sebagai argumen command line.

	~~If you want to automate and skip the menu, you can pass the desired options as command line arguments.~~		==Contoh==

	~~==EXAMPLES==~~		Untuk menambahkan 10.1.2.3 sebagai analyst:

	~~To add 10.1.2.3 to the analyst role:~~
	so-allow -a -i 10.1.2.3		so-allow -a -i 10.1.2.3

	~~To add~~ 10.1.2.0/24 ~~to the~~ osquery ~~role~~:		Untuk menambahkan 10.1.2.0/24 sebagai osquery:

	so-allow -o -i 10.1.2.0/24		so-allow -o -i 10.1.2.0/24

Unknown user: /* Automation */

2023-07-11T04:15:25Z

Automation

← Older revision		Revision as of 04:15, 11 July 2023
Line 53:		Line 53:
	If you want to automate and skip the menu, you can pass the desired options as command line arguments.		If you want to automate and skip the menu, you can pass the desired options as command line arguments.

	EXAMPLES		==EXAMPLES==

	To add 10.1.2.3 to the analyst role:		To add 10.1.2.3 to the analyst role:
Line 60:		Line 60:
	To add 10.1.2.0/24 to the osquery role:		To add 10.1.2.0/24 to the osquery role:
	so-allow -o -i 10.1.2.0/24		so-allow -o -i 10.1.2.0/24






	==Referensi==		==Referensi==

Unknown user at 11:52, 10 July 2023

2023-07-10T11:52:18Z

← Older revision		Revision as of 11:52, 10 July 2023
Line 1:		Line 1:
	~~==After Installation==~~

	~~SSH Key Change~~
	~~Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes.~~

	~~_images/so-ssh-harden.png~~
	~~For more information, see the SSH section.~~

	==Adjust firewall rules using so-allow==		==Adjust firewall rules using so-allow==

Line 13:		Line 5:
	==Services==		==Services==
	Verify services are running with the so-status command:		Verify services are running with the so-status command:

	sudo so-status		sudo so-status

Unknown user at 10:20, 10 July 2023

2023-07-10T10:20:29Z

← Older revision		Revision as of 10:20, 10 July 2023
Line 1:		Line 1:
	After Installation		==After Installation==

	SSH Key Change		SSH Key Change
	Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes.		Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes.
Line 6:		Line 7:
	For more information, see the SSH section.		For more information, see the SSH section.

	Adjust firewall rules using so-allow		==Adjust firewall rules using so-allow==

	Depending on what kind of installation you did, the Setup wizard may have already walked you through adding firewall rules to allow your analyst IP address(es). If you need to allow other IP addresses, you can manually run so-allow.		Depending on what kind of installation you did, the Setup wizard may have already walked you through adding firewall rules to allow your analyst IP address(es). If you need to allow other IP addresses, you can manually run so-allow.

	Services		==Services==
	Verify services are running with the so-status command:		Verify services are running with the so-status command:
	sudo so-status		sudo so-status
	Data Retention
			==Data Retention==
	Review the Curator and Elasticsearch sections to see if you need to change any of the default index retention settings.		Review the Curator and Elasticsearch sections to see if you need to change any of the default index retention settings.
	Other		Other
Line 22:		Line 25:


	so-allow		==so-allow==
	Security Onion locks down the Firewall by default. Depending on what kind of installation you do, Setup may walk you through allowing your analyst IP address(es). If you need to add other analyst IP addresses or open firewall ports for agents or syslog devices, you can run sudo so-allow and it will walk you through this process.		Security Onion locks down the Firewall by default. Depending on what kind of installation you do, Setup may walk you through allowing your analyst IP address(es). If you need to add other analyst IP addresses or open firewall ports for agents or syslog devices, you can run sudo so-allow and it will walk you through this process.

	This program allows you to add a firewall rule to allow connections from a new IP address.		This program allows you to add a firewall rule to allow connections from a new IP address.

	Choose the role for the IP or Range you would like to add		Choose the role for the IP or Range you would like to add

			[a] - Analyst - ports 80/tcp and 443/tcp
			[b] - Logstash Beat - port 5044/tcp
			[e] - Elasticsearch REST API - port 9200/tcp
			[f] - Strelka frontend - port 57314/tcp
			[o] - Osquery endpoint - port 8090/tcp
			[s] - Syslog device - 514/tcp/udp
			[w] - Wazuh agent - port 1514/tcp/udp
			[p] - Wazuh API - port 55000/tcp
			[r] - Wazuh registration service - 1515/tcp

			Please enter your selection:

	~~[a] - Analyst - ports 80/tcp and 443/tcp~~		==Wazuh==
	~~[b] - Logstash Beat - port 5044/tcp~~
	~~[e] - Elasticsearch REST API - port 9200/tcp~~
	~~[f] - Strelka frontend - port 57314/tcp~~
	~~[o] - Osquery endpoint - port 8090/tcp~~
	~~[s] - Syslog device - 514/tcp/udp~~
	~~[w] - Wazuh agent - port 1514/tcp/udp~~
	~~[p] - Wazuh API - port 55000/tcp~~
	~~[r] - Wazuh registration service - 1515/tcp~~

	~~Please enter your selection:~~
	Wazuh
	If you choose the analyst option, so-allow will also add the analyst IP address to the Wazuh safe list. This will prevent Wazuh Active Response from blocking the analyst IP address.		If you choose the analyst option, so-allow will also add the analyst IP address to the Wazuh safe list. This will prevent Wazuh Active Response from blocking the analyst IP address.

	Automation		==Automation==
	In addition to the interactive menu shown above, you can pass desired options as command line arguments:		In addition to the interactive menu shown above, you can pass desired options as command line arguments:

	so-allow -h		so-allow -h

	Usage: /usr/sbin/so-allow [-abefhoprsw] [ -i IP ]		Usage: /usr/sbin/so-allow [-abefhoprsw] [ -i IP ]

	This program allows you to add a firewall rule to allow connections from a new IP address or CIDR range.		This program allows you to add a firewall rule to allow connections from a new IP address or CIDR range.
Line 59:		Line 63:

	To add 10.1.2.3 to the analyst role:		To add 10.1.2.3 to the analyst role:
	so-allow -a -i 10.1.2.3		so-allow -a -i 10.1.2.3

	To add 10.1.2.0/24 to the osquery role:		To add 10.1.2.0/24 to the osquery role:
	so-allow -o -i 10.1.2.0/24		so-allow -o -i 10.1.2.0/24

Unknown user: /* Pranala Menarik */

2023-07-10T10:18:55Z

Pranala Menarik

← Older revision		Revision as of 10:18, 10 July 2023
Line 78:		Line 78:

	* [[Cyber Security]]		* [[Cyber Security]]
			* [[Cyber Security: Security Onion Install]]
			* [[Cyber Security: Security Onion Konfigurasi]]
			* [[Cyber Security: Security Onion setelah Instalasi]]

Unknown user at 09:59, 10 July 2023

2023-07-10T09:59:08Z

@@ Line 18: / Line 18: @@
 Any IDS/NSM system needs to be tuned for the network it’s monitoring. Please see the Tuning section.
 Configure the OS to use your preferred NTP server.
@@ Line 27: / Line 72: @@
 * https://docs.securityonion.net/en/2.3/post-installation.html#post-installation

Unknown user: Created page with "After Installation SSH Key Change Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes. _images/so-ssh-harden..."

2023-07-10T09:58:22Z

Created page with "After Installation SSH Key Change Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes. _images/so-ssh-harden..."

New page

After Installation
SSH Key Change
Depending on what kind of installation you did, you may have seen a warning at the end of Setup about SSH key changes.

_images/so-ssh-harden.png
For more information, see the SSH section.

Adjust firewall rules using so-allow
Depending on what kind of installation you did, the Setup wizard may have already walked you through adding firewall rules to allow your analyst IP address(es). If you need to allow other IP addresses, you can manually run so-allow.

Services
Verify services are running with the so-status command:
sudo so-status
Data Retention
Review the Curator and Elasticsearch sections to see if you need to change any of the default index retention settings.
Other
Full-time analysts may want to connect using a dedicated Analyst VM.
Any IDS/NSM system needs to be tuned for the network it’s monitoring. Please see the Tuning section.
Configure the OS to use your preferred NTP server.

==Referensi==

* https://docs.securityonion.net/en/2.3/post-installation.html#post-installation