How to Install and Configure Security Onion in VirtualBox

Thanks to our practical knowledge in virtual environments, specifically VirtualBox, we will share some recommendations about Security Onion. In this guide, you will learn more about Security Onion, its installation, and configuration. If that is something you are interested in, then let’s dive into this topic!

What is Security Onion?

Security Onion is a free software package that helps with monitoring strange or unusual activity in the network. This software package gives great visibility if talking about the security of the apps and network infrastructure.  

What Does It Do?

This open-source software is crucial because it constantly monitors traffic activity to find the signs of probable attacks or other cyber risks. If talking specifically about the threats then Security Onion helps with specifying malware, unauthorized access, or other behavior that is classified as threatening and can lead to serious security troubles.  

Why Use It in an Enterprise Environment or Home Lab?

Security Onion is a fantastic option for both enthusiasts and professionals and the major reason is - it is free. For the enterprise environment, it is a great choice to improve cybersecurity, while home labs will perfectly protect the gadget from all the possible online risks. All the users will benefit from this option and anyone can just test it out without paying for its usage.

Step-by-Step Guide

To begin the process, you should first install the VirtualBox. After that let’s proceed to the installation process of Security Onion.

Once VirtualBox is created and launched, the following step is the creation of the new VM. For this purpose, you will need to press Ctrl+N or New. In the appeared dialog box, you will need to specify the name, choose the location of the ISO file, and import it in the ISO image.

Then press next, the following step will be adding password, username, and domain name. Use the domain that was in the Active Directory home lab. Then press next and you will be at an extremely important step where you should specify CPU and memory.

The requirements relating CPU and RAM are based on the use case. When talking about the general requirements, for the deployment process you should allocate 12 GB. In case your host machine has only 18 GB of RAM, then you can use half of this space.

As for CPU, Security Onion works better in case several cores are used. That means if you have 4 cores, then it is advisable to use 2 of them for the Security Onion VM.   

Remember that the general number of CPU cores across all VMs shouldn’t exceed the core count of the host processor. Otherwise, this can lead to some performance degradation.

Press next and the following step is the allocation of the virtual hard drive. Depending on the traffic and data that will be involved you should specify this number accordingly. After the completion of all the discussed steps, you will be redirected to the main page of VM Virtual.

Before starting your Virtual Machine, there are a couple of adjustments that you should not forget about. Once you are in the general settings of VM you should specify the OS type that you are using.

The following step is selecting Network in the setting and the activation of the 3rd/2nd adapter. It should be attached to the internal network and named “LAN”.

After clicking OK, the startup process will be initiated. The next step is pressing Enter at the prompt to start the installation.

In this initial prompt, type Yes and Enter. The next process includes the establishment of the PW and username. After the completion of the installation, press Enter for reboot. After the restart, you will need to enter these credentials.

Then the wizard appears, where you should press Yes to continue the process. In the following prompt, the process looks pretty straightforward where you need to choose OK for the standard installation.

During the following step, you should press Enter, type AGREE, and proceed to the next step. Then you will see a warning that you will need to have a minimum of 4 cores for the installation. However, you can proceed by only using 2 cores just press Yes.  

Then similar message will appear about RAM usage, where you should also choose YES to proceed with the chosen RAM. After that, you should specify the hostname and type description (Security Onion VM).

Highlight your management NIC by pressing space and confirm the choice with Enter. The following step will be the choice of DHCP, then check whether Security Onion has internet access, select direct internet connection, and select monitor interface for config.  

Once you are in the OS patch schedule, it should be set to automatic. Then type your mail and set PW. In case, you would like to access the web via IP, then you should confirm this by Enter. To go with the default settings, in opt for config the NTP you should choose Yes. For ‘so-allow’ option, you should press NO.

In the review section in the wizard, press Tab to choose Yes and continue with the installation process. After the installation is completed, you should press OK for the reboot to take place.

Managing Security Onion

After the installation of Security Onion, access can be made from the external Ubuntu Desktop. The process of Ubuntu Desktop installation won’t be covered here so in case you need a clear instruction you can easily google it.

After the installation of Ubuntu, log in to the system and enter the terminal. Let’s start from the installation of the net-tools:

sudo apt install net-tools

The installed tool is crucial for configuration, network diagnostics, and basic monitoring. Once this pack is installed, we can use the command “ifconfig” to check the info about our IP and MAC. The IP address that will be mentioned in the output is needed in the Security Onion.

Log in to the Security Onion with your credentials. To allow the connection between the Ubuntu system and Security Onion, the following command is needed:

sudo so-allow

After that, you should add PW and “a” so that your IP will be added to the analyst role.

Once you have done everything properly, there might be an issue with VM with the same IP because of NAT. To deal with this, you can switch to a NAT Network, replace the settings for all the needed devices, and change all the IPs.

This network can be created by entering file-tools-network manager, and that will help to deal with the issues of IP address among VMs. Change IPs so that Ubuntu and Security Onion will have different IPs.

After the completion of this process, return to the browser on Ubuntu and access Security Onion with the changed IP. After entering Security Onion, you will be in the dashboard with all the details about alerts, network events, and incident response. Moreover, you have immediate access to the alerts, network traffic patterns, and of course log analysis.

Also, you have access to Hunt through which you can easily track potential risks. There you can use visualization, various analysis, custom queries, and much more.

PCAP is important for recording traffic activity within the network. This information is captured from different sources and as obvious PCAP files are used for hunting, detecting, and getting a general understanding of the network events. For more effective monitoring, integrating with the following tools might significantly help – Snort, Suricata, and Wireshark.

That’s pretty much all that you should know about the installation and configuration of the Security Onion in VirtualBox. Hope this review was helpful and now you have a clear understanding of where to start.