Adding additional home networks after the setup of SO is completed. #8042
-
|
Hello there, Is it possible to add additional networks after the setup of SO is completed? the system is running fine but I just realized I have another couple of networks I would like to add to the monitoring. Any help is greatly appreciated. Rafael~ |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 1 reply
-
|
I changed my $HOME_NET that was being monitored from between router/switch to between router/cable modem. This required that I added the Cable Modems IP address to my HOME_NET. Hope that helps, |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Hi there, After inspecting the global.sls file I did add the range of 10.17.0.0/16 but when looking at the alerts I am only seeing alerts from one of my VLANs (10.17.9.0/24) -- I do not see anything for 10.17.8.0/24 or 10.17.10.0/24 where I have other devices. Do I need to add those VLANs separately on the global file? Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
I would recommend looking at Kibana, and see if you see any of that traffic say in your Zeek Logs. |
Beta Was this translation helpful? Give feedback.
I changed my $HOME_NET that was being monitored from between router/switch to between router/cable modem. This required that I added the Cable Modems IP address to my HOME_NET.
I used the documentation from the website: https://docs.securityonion.net/en/2.3/homenet.html?highlight=HOMENET#homenet.
If you are talking about adding additional sensors to monitor those networks well that could be:
https://docs.securityonion.net/en/2.3/so-monitor-add.html?highlight=add%20sensor
Hope that helps,