Is it possible to send pcaps from windows 10/11 to security onion for analysis?

[iqworks]

Hi, I need to see if i can use the SOC to analyze wireshark pcaps from my laptop?

Does the pcap import only grab data from within the SOC.?

thx

[Jaap79]

Hi,

You can upload any PCAP to your SecurityOnion instance and import them.

[iqworks]

thanks for replying. I will look for how to do that.

[dlee35]

You could copy the pcap to your sensor using SCP and run sudo so-import-pcap /full/path/to/import.pcap as described here: https://docs.securityonion.net/en/2.3/so-import-pcap.html

I recommend this be done on a freshly installed, non-production sensor...

[iqworks]

Hi, I am wanting to get wireshark pcap's from wireshark to my SOC. I can get my sysmon data but not my wireshark pcaps? i saw a video of how to get a pcap file from a URL, but not from my windows 10 ( https://www.youtube.com/watch?v=TZ96aBEVhFU ).
thanks for any help or advice

[dougburks]

Answered here:
#10507