Using Playbook

[widdleavi]

I am new to security onion. Just got it setup on my network. So in playbook, it seems like all the items are set to draft to start. How do you decide which ones to change to active? I went it and did all Critical, High, and medium items and am getting overloaded with alerts.

[dougburks]

I went it and did all Critical, High, and medium items and am getting overloaded with alerts.

We recommend against enabling all Critical, High, and Medium items. In particular, one of the High severity plays (Malicious Nishang PowerShell Commandlets) can cause performance issues and should be avoided. From https://docs.securityonion.net/en/2.4/playbook.html#putting-a-play-into-production:

How do you decide which ones to change to active?

First, you need to know your environment. Then, you should only enable those plays which are relevant to your environment AND which would be critical enough for you to engage the incident response process.