Skip to content

Commit 719a3f0

Browse files
ajay-dhangarajay-dhangar
authored
Merge pull request #62 from codeharborhub/dev-1
Complited Cyber Security Docs
2 parents 5fa80f9 + 5047a6b commit 719a3f0

File tree

15 files changed

+2714
-110
lines changed

15 files changed

+2714
-110
lines changed

‎.github/workflows/lighthouse-report.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,15 @@ jobs:
4040
with:
4141
urls: |
4242
http://localhost:3000/tutorial/
43-
http://localhost:3000/tutorial/category/html
44-
http://localhost:3000/tutorial/html/intro-html
45-
http://localhost:3000/tutorial/category/css
43+
http://localhost:3000/tutorial/category/html/
4644
http://localhost:3000/tutorial/css/introduction/what-is-css
47-
http://localhost:3000/tutorial/category/javascript
48-
http://localhost:3000/tutorial/category/react
45+
http://localhost:3000/tutorial/javascript/introduction-to-javascript/what-is-js
46+
http://localhost:3000/tutorial/git/introduction
47+
http://localhost:3000/tutorial/category/getting-started-with-github
48+
http://localhost:3000/tutorial/github/introduction-to-github
4949
http://localhost:3000/tutorial/react/react-intro
50+
http://localhost:3000/tutorial/cybersecurity
51+
http://localhost:3000/tutorial/tags
5052
configPath: ./.github/workflows/lighthouserc.json
5153
uploadArtifacts: true
5254
temporaryPublicStorage: true

‎docs/cybersecurity/cybersecurity-tools/monitoring-and-defense/security-onion.mdx‎

Lines changed: 185 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,186 @@
1-
import ComingSoon from '@site/src/components/ComingSoon';
1+
---
2+
title: "Security Onion"
3+
description: "Learn about Security Onion — an open-source Linux distribution for intrusion detection, network monitoring, and log management. Explore its architecture, components, and setup for modern SOC environments."
4+
---
25

3-
<ComingSoon />
6+
**Security Onion** is a free and open-source **Linux distribution** for **intrusion detection**, **network security monitoring (NSM)**, and **log management**. It’s widely used in **Security Operations Centers (SOCs)**, **cybersecurity training labs**, and **enterprise monitoring setups**.
7+
8+
Developed and maintained by **Doug Burks** and the Security Onion team, it provides an integrated suite of tools like **Snort**, **Suricata**, **Zeek**, **Wazuh**, and **Elasticsearch** — all preconfigured for rapid deployment.
9+
10+
## Why Security Onion?
11+
12+
Security Onion simplifies complex security infrastructure into a **single, cohesive platform**.
13+
14+
```mermaid
15+
flowchart TD
16+
A[Network Traffic] --> B[Packet Capture]
17+
B --> C[Intrusion Detection - Snort/Suricata]
18+
B --> D[Protocol Analysis - Zeek]
19+
B --> E[Log Collection - Wazuh/OSSEC]
20+
C --> F[Elastic Stack Visualization]
21+
D --> F
22+
E --> F[Security Onion Console]
23+
```
24+
25+
**In simple terms:**
26+
27+
Security Onion collects, inspects, and visualizes network data — helping analysts **detect**, **investigate**, and **respond** to security threats efficiently.
28+
29+
30+
## Core Components
31+
32+
| Component | Description |
33+
| ----------------------- | ---------------------------------------------------------------------- |
34+
| **Snort / Suricata** | Network Intrusion Detection Systems (IDS/IPS) |
35+
| **Zeek (formerly Bro)** | Network analysis framework for protocol and behavior-based detection |
36+
| **Wazuh / OSSEC** | Host-based intrusion detection (HIDS) and log analysis |
37+
| **Elastic Stack (ELK)** | Elasticsearch, Logstash, and Kibana — for storing and visualizing logs |
38+
| **TheHive + Cortex** | Incident response and case management |
39+
| **CyberChef** | Data decoding, conversion, and analysis tool |
40+
41+
## Architecture Overview
42+
43+
```mermaid
44+
graph LR
45+
subgraph "Data Layer"
46+
A[Network Traffic]
47+
B[Host Logs]
48+
end
49+
50+
subgraph "Collection Layer"
51+
C1[Snort / Suricata]
52+
C2[Zeek]
53+
C3[Wazuh Agents]
54+
end
55+
56+
subgraph "Analysis Layer"
57+
D1[Logstash]
58+
D2[Elasticsearch]
59+
D3[TheHive]
60+
end
61+
62+
subgraph "Visualization Layer"
63+
E1[Kibana Dashboards]
64+
E2[Security Onion Console]
65+
end
66+
67+
A --> C1
68+
A --> C2
69+
B --> C3
70+
C1 --> D1
71+
C2 --> D1
72+
C3 --> D1
73+
D1 --> D2
74+
D2 --> D3
75+
D2 --> E1
76+
D3 --> E2
77+
```
78+
79+
This architecture allows real-time traffic inspection, data correlation, and security event visualization from a **single pane of glass**.
80+
81+
## Installation Modes
82+
83+
Security Onion supports three main deployment modes:
84+
85+
| Mode | Use Case |
86+
| --------------- | ------------------------------------------------------- |
87+
| **Standalone** | Ideal for labs and small networks |
88+
| **Distributed** | For enterprise-scale environments with multiple sensors |
89+
| **Eval Mode** | Quick evaluation using a single VM (best for beginners) |
90+
91+
```bash
92+
sudo so-setup
93+
```
94+
95+
You can select the desired mode during setup and configure sensors, managers, and storage accordingly.
96+
97+
## Workflow: From Detection to Response
98+
99+
```mermaid
100+
sequenceDiagram
101+
participant Net as Network Traffic
102+
participant IDS as IDS/IPS (Snort/Suricata)
103+
participant Zeek as Zeek
104+
participant Log as Logstash
105+
participant ES as Elasticsearch
106+
participant Kib as Kibana
107+
participant Hive as TheHive
108+
109+
Net->>IDS: Detect anomalies
110+
Net->>Zeek: Analyze protocol behavior
111+
IDS->>Log: Send alerts/logs
112+
Zeek->>Log: Send connection metadata
113+
Log->>ES: Store structured data
114+
ES->>Kib: Visualize dashboards
115+
Kib->>Hive: Escalate incidents
116+
```
117+
118+
This flow demonstrates how Security Onion provides **end-to-end visibility**, from detection → analysis → investigation → response.
119+
120+
## Log Correlation Formula
121+
122+
To understand correlation mathematically, think of Security Onion’s detection engine as:
123+
124+
$$
125+
A(t) = \sum_{i=1}^{n} (E_i \times W_i)
126+
$$
127+
128+
Where:
129+
130+
* $ A(t) $: Alert strength at time *t*
131+
* $ E_i $: Event score (based on severity, frequency, or signature match)
132+
* $ W_i $: Weight of event importance
133+
134+
Higher $ A(t) $ indicates higher confidence of a real incident — enabling analysts to **prioritize critical alerts** efficiently.
135+
136+
## Real-World Use Cases
137+
138+
| Scenario | Description |
139+
| --------------------- | ----------------------------------------------------------- |
140+
| **SOC Operations** | Centralized log management and real-time threat monitoring |
141+
| **Threat Hunting** | Searching for Indicators of Compromise (IOCs) and anomalies |
142+
| **Incident Response** | Using TheHive to manage and document security incidents |
143+
| **Training Labs** | Perfect for blue team exercises and cyber range setups |
144+
145+
## Key Tools Inside Security Onion
146+
147+
* **so-status** — Check system and service health
148+
* **so-allow** — Manage firewall rules and IP access
149+
* **so-import-pcap** — Import and analyze captured network traffic
150+
* **so-query** — Query Elasticsearch directly from the terminal
151+
* **so-dashboard** — Manage and monitor dashboard views
152+
153+
```bash
154+
sudo so-import-pcap /path/to/traffic.pcap
155+
```
156+
157+
This command imports and indexes network captures into the Elastic Stack for retrospective analysis.
158+
159+
## Integration with SIEM and EDR
160+
161+
Security Onion can send data to external systems like:
162+
163+
* **Splunk**
164+
* **Microsoft Sentinel**
165+
* **Wazuh EDR**
166+
* **Graylog**
167+
* **ArcSight**
168+
169+
```mermaid
170+
flowchart LR
171+
SO[Security Onion] --> Splunk
172+
SO --> Sentinel
173+
SO --> Wazuh
174+
SO --> Graylog
175+
SO --> ArcSight
176+
```
177+
178+
This allows hybrid monitoring and advanced analytics across diverse environments.
179+
180+
## Key Takeaways
181+
182+
* Security Onion is an **all-in-one platform** for IDS, NSM, and log management.
183+
* Combines **Snort/Suricata**, **Zeek**, **Elastic Stack**, **Wazuh**, and **TheHive**.
184+
* Perfect for **SOC environments**, **blue team training**, and **incident response**.
185+
* Supports **distributed deployments** for scalability.
186+
* Offers **real-time dashboards** and **correlation across multiple data sources**.

‎docs/cybersecurity/cybersecurity-tools/monitoring-and-defense/snort-ids.mdx‎

Lines changed: 172 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,173 @@
1-
import ComingSoon from '@site/src/components/ComingSoon';
1+
---
2+
title: "Snort IDS (Intrusion Detection System)"
3+
description: "Learn how Snort works as one of the most powerful open-source Intrusion Detection and Prevention Systems (IDS/IPS). Understand its architecture, rule-based detection, deployment modes, and real-world use cases."
4+
sidebar_label: "Snort IDS"
5+
---
26

3-
<ComingSoon />
7+
**Snort** is an **open-source Intrusion Detection and Prevention System (IDS/IPS)** developed by **Cisco**. It’s one of the most widely used network security tools for detecting and preventing malicious network traffic in real time.
8+
9+
## What is Snort?
10+
11+
Snort acts as a **network traffic analyzer** that monitors packets flowing through the network and compares them against predefined **rules** or **signatures**.
12+
13+
It can operate in multiple modes:
14+
15+
| Mode | Description |
16+
|------|--------------|
17+
| **Sniffer Mode** | Reads network packets and displays them on the console. |
18+
| **Packet Logger Mode** | Logs packets to disk for later analysis. |
19+
| **Network Intrusion Detection (NIDS) Mode** | Analyzes network traffic and alerts for suspicious activity. |
20+
| **Intrusion Prevention (IPS) Mode** | Detects and blocks malicious packets in real time. |
21+
22+
23+
## Snort Architecture
24+
25+
```mermaid
26+
graph TD
27+
A[Packet Capture - Libpcap] --> B[Preprocessors]
28+
B --> C[Detection Engine]
29+
C --> D[Logging & Alerting]
30+
D --> E[Output Plugins]
31+
32+
subgraph "Snort IDS Pipeline"
33+
A
34+
B
35+
C
36+
D
37+
E
38+
end
39+
```
40+
41+
**Explanation:**
42+
43+
* **Packet Capture:** Uses `libpcap` to capture live network packets.
44+
* **Preprocessors:** Normalize and prepare packets for detection (e.g., decode protocols, detect anomalies).
45+
* **Detection Engine:** Matches traffic against Snort rules and triggers alerts.
46+
* **Logging & Alerting:** Records alerts or logs for review.
47+
* **Output Plugins:** Export data to databases, dashboards, or SIEM tools.
48+
49+
## Snort Rule Syntax
50+
51+
Snort rules are written in a simple yet powerful format:
52+
53+
```bash
54+
alert tcp any any -> 192.168.1.0/24 80 (msg:"Possible web exploit"; content:"/bin/sh"; sid:1000001; rev:1;)
55+
```
56+
57+
### Rule Breakdown
58+
59+
| Part | Meaning |
60+
| ----------------------------- | --------------------------------------- |
61+
| `alert` | Action to take (alert, log, pass, drop) |
62+
| `tcp` | Protocol type |
63+
| `any any` | Source IP and port |
64+
| `->` | Traffic direction |
65+
| `192.168.1.0/24 80` | Destination IP range and port |
66+
| `msg:"Possible web exploit";` | Description shown in alert |
67+
| `content:"/bin/sh";` | Signature or string to match |
68+
| `sid:1000001;` | Unique Snort rule ID |
69+
| `rev:1;` | Rule version |
70+
71+
72+
## How Snort Detects Intrusions
73+
74+
Snort’s detection process follows a **rule-based mathematical model**:
75+
76+
$$
77+
A(t) = f(P, R, C)
78+
$$
79+
80+
Where:
81+
82+
* $A(t)$ = Alert at time *t*
83+
* $ P $ = Packet data captured
84+
* $ R $ = Rule set applied
85+
* $ C $ = Context (state/session information)
86+
87+
The function $( f ) $ determines whether a packet matches a rule condition, producing an alert if true.
88+
89+
## Example: Detecting a Port Scan
90+
91+
```bash
92+
alert tcp any any -> any 22 (flags:S; msg:"Possible SSH Port Scan"; sid:2000001;)
93+
```
94+
95+
This rule triggers an alert whenever a **TCP SYN packet** targets port **22 (SSH)** — a common behavior during a scan.
96+
97+
## Snort in Action (Workflow)
98+
99+
```mermaid
100+
sequenceDiagram
101+
participant Net as Network Traffic
102+
participant Cap as Packet Capture
103+
participant Pre as Preprocessor
104+
participant Det as Detection Engine
105+
participant Log as Alert System
106+
107+
Net->>Cap: Capture packets (libpcap)
108+
Cap->>Pre: Normalize data
109+
Pre->>Det: Match with rules
110+
Det->>Log: Generate alert/log
111+
```
112+
113+
## Integration & Automation
114+
115+
Snort integrates with various tools for **alert management** and **data visualization**:
116+
117+
* **Snorby** – Web interface for Snort alerts
118+
* **BASE** – Basic Analysis and Security Engine
119+
* **Splunk / ELK Stack** – For SIEM and visualization
120+
* **Security Onion** – Linux distro with Snort preconfigured
121+
122+
```mermaid
123+
flowchart LR
124+
Snort --> BASE
125+
Snort --> Snorby
126+
Snort --> Splunk
127+
Snort --> ELK[ELK Stack]
128+
ELK --> SOC[Security Operations Center]
129+
```
130+
131+
## Formula: Rule Matching Probability
132+
133+
Snort’s detection efficiency can be approximated as:
134+
135+
$$
136+
P_{match} = \frac{M_r}{T_p}
137+
$$
138+
139+
Where:
140+
141+
* $P_{match} $ = Probability of rule match
142+
* $ M_r $ = Matched rules count
143+
* $ T_p $ = Total packets processed
144+
145+
A higher $ P_{match} $ indicates frequent matches, possibly signaling an attack or misconfigured rule.
146+
147+
## Deployment Options
148+
149+
| Environment | Recommended Mode |
150+
| ---------------------- | --------------------------- |
151+
| **Home / Lab** | IDS (alert-only) |
152+
| **Enterprise Network** | IPS (preventive blocking) |
153+
| **Cloud / VM** | Inline bridge mode |
154+
| **SOC Environment** | Combined Snort + SIEM setup |
155+
156+
## Example: Inline IPS Mode Setup (Linux)
157+
158+
```bash
159+
sudo snort -Q --daq afpacket -i eth0:eth1 -c /etc/snort/snort.conf -A console
160+
```
161+
162+
* `-Q`: Enables inline mode
163+
* `--daq afpacket`: Uses AFPacket for inline packet capture
164+
* `-i eth0:eth1`: Bridge between two interfaces
165+
* `-A console`: Prints alerts to the console
166+
167+
## Key Takeaways
168+
169+
* **Snort** is a rule-based **IDS/IPS** used for packet-level network security.
170+
* It uses **libpcap** for packet capture and **custom rules** for detection.
171+
* Supports **multiple operation modes** (sniffer, logger, IDS, IPS).
172+
* Easily integrates with **SIEMs** like Splunk and ELK for advanced monitoring.
173+
* **Continuous rule updates** and **proper tuning** are critical for accuracy.

0 commit comments

Comments
 (0)