How to monitor my Security Onion

[borgoncete88]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64 Gb

Storage for /

65 Gb

Storage for /nsm

125 Gb

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all, I'm new using Security Onion and I would love if someone could help me. I'd like to monitor my Security Onion VM by PRTG in order to check via snmp the free space on hard disk, CPU and RAM usage, etc. I managed to enable firewall to do it with iptables commands, but it seems there's a daemon running becuase in a while it terminates the snmp process. How can I configure to make permanent? Thanks in advance.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

Check out https://docs.securityonion.net/en/2.4/influxdb.html

For modifying the Security Onion firewall you won't use ssh. Iptables is managed by salt and will be overwritten as you noted. You will modify it using the SOC configuration page. https://docs.securityonion.net/en/2.4/firewall.html#creating-a-custom-host-group-with-a-custom-port-group

[borgoncete88]

Hi Jorge,

Thanks for replying. I added the 161 and 162 TCP/UDP ports for snmp as you said on SOC config page, but still no getting data from Security Onion to the monitoring server (PRTG). Is there anything left to set?

Kind regards.

[InfosecGoon]

You also need to set a customhostgroup for the source IP that you want to allow (your PRTG server), and then add the hostgroup and portgroup to the Standalone role so that Salt knows where in your grid you want these firewall holes configured.

Documentation: https://docs.securityonion.net/en/2.4/firewall.html#creating-a-custom-host-group-with-a-custom-port-group

[borgoncete88]

Hi @InfosecGoon,

Thank you for replying. I didi it, the only thing it was missing is the part where documentation talks about adding grid value in: Options > Show all settings > firewall > role > idh > chain > DOCKER-USER > hostgroups > customhostgroup0 > portgroups > adding "customportgroup0", but still not working. Anything else missing?

Kind regards,