AWS Install

[cyrisk-bot]

We're trying to install a trial of a single-node SecurityOnion that would not do any network sniffing as we have no network, a completely distributed workforce, with AWS SaaS environment. We were following the installation documentation in https://docs.securityonion.net/en/2.4/cloud-amazon.html, but reached a stumbling block in the instructions:
Create a Security Group for Sniffing Interface section that asked us to:
• With the inbound tab selected, select: Add Rule
• Add the appropriate inbound rules to ensure all desired traffic destined for the sniffing interface is allowed.
The question we had was, what inbound rules? My colleague asked if there was a CloudFormation template available for a single-node, host-agent optimized environment? We then came up with the attached doc

and wondered if anyone can validate it:

[cm-ops]

https://docs.securityonion.net/en/2.4/firewall.html#network-firewalls

That should give you an idea of allowances that are needed.

[cyrisk-bot]

Thanks!