Respond Part

[vaschthestampede]

Hi, I recently discovered this project and it seems really interesting.
However, what seems to be missing is an active defense component.
Something like darktrace respond.

I believe this feature would greatly enhance the capabilities of SecurityOnion in responding to security incidents.

[dougburks]

Depending on what you're looking for, these links might help:
https://www.elastic.co/guide/en/security/current/use-osquery.html
https://www.elastic.co/guide/en/security/current/response-actions.html

[vaschthestampede]

I'm referring to something like this:
https://robertheaton.com/2020/04/27/how-does-a-tcp-reset-attack-work/

[dougburks]

From https://docs.securityonion.net/en/2.4/faq.html#can-security-onion-run-in-ips-mode:

Can Security Onion run in IPS mode?
No, Security Onion does not support blocking traffic. Most organizations have some sort of Next Generation Firewall (NGFW) with IPS features and that is the proper place for blocking to occur. Security Onion is designed to monitor the traffic that makes it through your firewall.

[vaschthestampede]

Firewalls cannot intervene in internal network traffic, a solution like this can.
Darktrace does it, security onion is only missing the active component.
The fact that it can't is why I'm suggesting it in the ideas section.