Adding monitoring interface on the forward node

[lmb2100]

Are we able to add a monitoring interface on the forward node to send the zeek and suricata logs to the manager? We have a search manager that only has 1 NIC, so would it be possible to deploy a forward node with 2 NICs and having one be a monitor interface? Would we then set that up as a SPAN? Also is there some documentation on how to set up that monitor interface to get those logs? Besides so-monitor-add? We tried that on the Search Manager and it couldnt find bond0 after we added a new NIC to be the monitor NIC. We are not currently seeing any network logs on kibana even though zeek and suricata services are running fine. Thanks!

[dougburks]

Are we able to add a monitoring interface on the forward node to send the zeek and suricata logs to the manager?

Yes:
https://docs.securityonion.net/en/2.3/architecture.html#forward-node

We have a search manager that only has 1 NIC, so would it be possible to deploy a forward node with 2 NICs and having one be a monitor interface?

Yes:
https://docs.securityonion.net/en/2.3/hardware.html#nic

Would we then set that up as a SPAN?

You could connect the monitor interface to a SPAN port on a switch OR to a dedicated tap:
https://docs.securityonion.net/en/2.3/hardware.html#packets

Also is there some documentation on how to set up that monitor interface to get those logs?

When you build a forward node, it will ask which interface should be the monitor interface and it will do everything for you:
https://docs.securityonion.net/en/2.3/configuration.html#production-server-distributed-deployment

We tried that on the Search Manager and it couldnt find bond0 after we added a new NIC to be the monitor NIC. We are not currently seeing any network logs on kibana even though zeek and suricata services are running fine.

When you say Search Manager, are you referring to a Manager node or a ManagerSearch node? Neither of these support sniffing, bond0, Zeek, or Suricata.
https://docs.securityonion.net/en/2.3/architecture.html#node-types