student

[ranimhassine]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

24

Storage for /

224

Storage for /nsm

140

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hello Security Onion community,
I'm working on integrating Suricata logs from pfSense (version 2.4.8) into Security Onion and have some questions about the best approach:

• Log Forwarding Method:

*Is using Filebeat on pfSense still a recommended method for forwarding Suricata logs to Security Onion?
*If not, what's the current best practice for getting Suricata logs from pfSense into Security Onion?

• Elastic Agent Configuration:

*How should the forwarding be configured if using Elastic Agent?
*Are there specific settings or configurations recommended for pfSense log ingestion?

• Pipeline and Tagging:

*What pipeline configurations and tags should be added to ensure logs are ingested into the correct index in Security Onion?
*Are there any pfSense-specific or Suricata-specific settings we need to consider?

• Index Naming:

*In previous versions, Suricata logs were often indexed into "so-ids". What's the current equivalent index in newer Security Onion versions?
*Has the index naming convention changed, and if so, what should we be using?

• Best Practices:

*Are there any specific best practices or common pitfalls to be aware of when setting up this integration?
*Any guidance or documentation links would be greatly appreciated. Thank you in advance for your help!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

First, please note the following from #1720:

When creating your discussion, please put a relevant and descriptive title in the Title field and avoid generic titles

For your pfSense questions, please see the pfSense section of our documentation:
https://docs.securityonion.net/en/2.4/pfsense.html