mount directory

[Anelka3523]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

12

RAM

24

Storage for /

300 GB

Storage for /nsm

1.8T

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

hello, I want to connect a shared folder to my securtiy onion standalone node server. How can I do this? There are many *.pcap files in my shared folder that will be continuously flowing. I want to process these files automatically with so-pcap-import.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

What kind of shared folder is this? https://docs.oracle.com/cd/F61088_01/shareadmin/OL9-SHAREADMIN.pdf checkout 2-6 for NFS instructions.

There is no built in process for automatically processing pcap from a directory, so you'll likely need to create your own script for handling the processing

[Anelka3523]

I will use cifs. I write /etc/fstab file like this line

mount -t cifs -o username=<share user>,password=<share password> //WIN_PC_IP/<share name> /mnt

My question is this: When I enter the settings as above, which port should I allow in the firewall settings? How should I define the "hostgroup" section in the security onion settings screen.

I think I need to do something like the link below: https://docs.securityonion.net/en/2.4/pfsense.html#elastic-integration-for-pfsense

[dougburks]

If your Security Onion box is connecting outbound to another machine, then you shouldn't need to modify the Security Onion firewall. Outbound connections should be allowed.