Enabling IDH's portscan function does not work.

[khoinhtvn]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

16GB

Storage for /

85GB

Storage for /nsm

166GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello everyone,

My team is deploying Security Onion IDH. We would like to turn on the "portscan" function.
We want to receive alerts whenever someone does a port scan to our IDH servers.

However, after enabling the function and doing the scans, we cannot see any alerts. We think there should be some configurations needed.
Has anyone done this before?

Thank you for your help!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Mav1814]

Hi,

On Security Onion, go to Configuration -> IDH -> Opencanary -> Config -> portscan_X_enabled -> True .
Then so-playbook-import, to import the opencanary playbooks to generate alerts, and activate them.

cheers.
Mav

[khoinhtvn]

Thank you for your help.

I will give it a try and reply with the result.

[khoinhtvn]

Hi Mav,

I think the problem that there is no log in opencanary.log in the first place.
I have tried adding the path of the iptables but to no avail.

My test command with nmap was "nmap -t4 [IP]".

Do you have any idea on this matter?

Thank you so much for your help.

Regards,
Khoi

[Mav1814]

Hi!
You don't need to do anything on the iptables.

When you did de so-playbook-import did import the opencanary playbooks?
Check on the playbooks page if it shows them . If so, activate them by changing from draft to active.

For example - nmap -A IP should generate some alert.

Or probably when you instaled the IDH on the option on listening you choose to not be listening.

cheers.