Security-Onion-Solutions/securityonion
Securityonion
Security Onion este o platformă de gestionare a informațiilor și evenimentelor de securitate (SIEM) și o suită de monitorizare a securității rețelei. Funcționează ca un sistem de detectare a intruziunilor și un instrument de analiză a traficului de rețea, conceput pentru a identifica activitățile malițioase și intruziunile prin detectare bazată pe semnături și monitorizare la nivel de host.
Platforma integrează un sistem de gestionare a cazurilor de securitate pentru a organiza investigațiile prin urmărirea detecțiilor și gruparea evenimentelor de securitate conexe. Oferă capabilități pentru capturarea completă a pachetelor, extragerea metadatelor de rețea, precum și colectarea și indexarea log-urilor de securitate din surse diverse.
Sistemul acoperă o gamă largă de operațiuni de securitate, inclusiv investigarea incidentelor, fluxuri de lucru pentru threat hunting și agregarea log-urilor. Utilizează o consolă web unificată pentru analiza alertelor și încorporează inteligență artificială pentru a asista în investigarea datelor de securitate.
Features
- Security Logging and SIEM - Implements a full security information and event management platform for aggregating and analyzing security event data.
- Network Security Monitoring - Functions as a comprehensive network security monitoring suite for capturing and analyzing traffic to detect malicious activity.
- Log Aggregators - Centralizes security event logs from diverse distributed sources into a unified searchable store.
- Full Packet Capture Systems - Provides a full packet capture system that records raw network traffic to disk for retrospective forensic analysis.
- Raw Packet Inspection - Enables the capture and inspection of raw network packets for detailed forensic investigation of security incidents.
- Incident Investigation Tools - Includes utilities for analyzing suspicious data and performing retrospective forensic analysis of raw packets.
- Unified Incident Investigation Consoles - Ships a unified web console that aggregates telemetry and alerts from networks and endpoints for centralized incident assessment.
- Intrusion Detection Systems - Implements intrusion detection systems that monitor network and system activity for malicious behavior.
- Investigation Case Management - Provides a dedicated system for organizing security investigations into tracked cases to group related events and detections.
- Security Logging Management - Provides security logging management to collect and index logs from diverse sources for analysis.
- Network Intrusion Detection - Identifies malicious network activity using signature-based detection and host-based monitoring systems.
- Signature-Based Threat Detectors - Uses signature-based threat detection to match network traffic patterns against databases of known malicious activity.
- Threat Hunting Workflows - Supports threat hunting workflows by searching forensic data with custom logic to uncover stealthy activity.
- Activity Monitors - Provides activity monitoring to collect and analyze network traffic and host system events for security visibility.
- Distributed Log Aggregation - Implements distributed log aggregation to collect and index security event logs from multiple remote sources.
- Security Event Monitoring - Offers tools for analyzing security events and searching system logs for malicious patterns via a unified console.
- Security Analysis Assistants - Incorporates artificial intelligence to accelerate the analysis and investigation of security data to find threats faster.
- Traffic Metadata Generation - Extracts high-level summaries of network connections to streamline the process of threat hunting.
- Endpoint Activity Monitoring - Includes endpoint activity monitoring to detect malicious processes and unauthorized changes on host systems.
- Network Traffic Analysis - Provides tools for recording raw network packets and extracting metadata for retrospective forensic analysis.
- Network Metadata Extraction - Extracts high-level summaries of network connections from raw packets to streamline proactive threat hunting.
- Security Information and Event Management - Platform for threat hunting, monitoring, and log management.
- Security Lab Environments - Linux distribution for intrusion detection and enterprise security monitoring.
