Thanks for Reverse DNS

[rock0ne]

under customization, Reverse DNS has been added, not sure when but i found it today and would like to say thanks for that as it makes easier to make sense of ip's without having to do deep analysis. I hope there's more customization in future releases but so far those already allowed has inspired me to make tweaks. can we send backups to outside security onion from the soc web interface or at the moment only to /nsm/backups or setup sftp inside the os to send out backups? Or can we just write sftp command from web-ui and execute from there. could be cool to do sftp from the web ui to a backup server, the idea comes from using VMware NXT. anyway, thanks for a great siem.

[dougburks]

under customization, Reverse DNS has been added, not sure when but i found it today and would like to say thanks for that as it makes easier to make sense of ip's without having to do deep analysis.

Thanks, we're glad you like the Reverse DNS feature!

For others that find this discussion, you can find this feature in the documentation at:
https://docs.securityonion.net/en/2.4/soc-customization.html#reverse-dns-lookups

can we send backups to outside security onion from the soc web interface or at the moment only to /nsm/backups or setup sftp inside the os to send out backups? Or can we just write sftp command from web-ui and execute from there. could be cool to do sftp from the web ui to a backup server, the idea comes from using VMware NXT.

You could certainly create a cron job in the OS to copy from /nsm/backups/ to a separate system if you'd like. For more information about backups, please see:
https://docs.securityonion.net/en/2.4/backup.html

anyway, thanks for a great siem.

You're welcome!