Linux no GUI learning resources available

[Nitekite1]

What kind of learning resources are available in regards to operating security onion without a GUI, all shell?

[InfosecGoon]

Could you elaborate a little? What are you trying to do? Most of the deployment and tuning work in Security Onion 2.3 is done without a GUI, but the analyst and investigation work is heavily dependent on the web console.

[Nitekite1]

Hello Matthew thank you for your quick response, I am a cybersecurity student who participates in hackathons regularly and one of the requirements for our next hackathon is that we will have a command line only version of security onion but everything that I've seen about security onion does point to that web console. However they have reiterated, it will be a CLI only security onion. Which translates to me as the tools that we would find in the web console just being used in terminal but I thought I would check with the official security onion team. Thank you and I hope this is clarification enough if not I'm happy to elaborate more.

…

On Thu, Apr 6, 2023, 11:00 AM Matthew Gracie ***@***.***> wrote: Could you elaborate a little? What are you trying to do? Most of the deployment and tuning work in Security Onion 2.3 is done without a GUI, but the analyst and investigation work is heavily dependent on the web console. — Reply to this email directly, view it on GitHub <#10075 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A64CW4RHERZYJMXWLNQMNWTW73LB5ANCNFSM6AAAAAAWOQQIMQ> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/10075/comments/5544675 @github.com>

[Nitekite1]

Is there a version of security onion that is CLI from the past? Hackathons often use older versions they never use the most recent version.

…

On Thu, Apr 6, 2023, 11:13 AM Don Brewer ***@***.***> wrote: Hello Matthew thank you for your quick response, I am a cybersecurity student who participates in hackathons regularly and one of the requirements for our next hackathon is that we will have a command line only version of security onion but everything that I've seen about security onion does point to that web console. However they have reiterated, it will be a CLI only security onion. Which translates to me as the tools that we would find in the web console just being used in terminal but I thought I would check with the official security onion team. Thank you and I hope this is clarification enough if not I'm happy to elaborate more. On Thu, Apr 6, 2023, 11:00 AM Matthew Gracie ***@***.***> wrote: > Could you elaborate a little? What are you trying to do? Most of the > deployment and tuning work in Security Onion 2.3 is done without a GUI, but > the analyst and investigation work is heavily dependent on the web console. > > — > Reply to this email directly, view it on GitHub > <#10075 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A64CW4RHERZYJMXWLNQMNWTW73LB5ANCNFSM6AAAAAAWOQQIMQ> > . > You are receiving this because you authored the thread.Message ID: > <Security-Onion-Solutions/securityonion/repo-discussions/10075/comments/5544675 > @github.com> >

[InfosecGoon]

No, there have always been web tools for accessing the data - before Elastic was integrated into the platform, it was ELSA and Squert.

If you want to access the data that Security Onion is gathering from the CLI, you can do so -- it's written to disk under /nsm/zeek and /nsm/suricata, and the JSON logs can be parsed with jq. It's not as efficient as a web console for stacking and sorting but you could find things if necessary.