Adding more new subnet to monitor in security onion

[pavlos1982]

Hi all,

Looking for what command to use for me to add more subnets for security onion to monitor? thanks

Regards,

Paul

[Jaap79]

Hi Paul,

I'd check the pillar file for your sensor (assuming a distributed environment, I have little to no experience with other types of deployments but may be similar):

sensor:
interface: 'bond0'
mainip: 'x.x.x.x'
mainint: 'ensxxx'
(...)
hnsensor: '10.10.0.0/16,192.168.100.0/24'

You'll be looking at the hnsensor-line and adjust accordingly.

[Jaap79]

Also, make sure you include the VLAN or switch ports or whatnot in your monitoring port (add to the span port for instance) to mirror it's traffic to your sensor node if that's your setup ;) but that goes for every network you want to monitor.

[pavlos1982]

Thanks, Jaap see the screenshot which file do I need to edit in the pillar folder?, already have a dedicated trunk port that passes all my VLAN for monitoring for security onion

[reyesj2]

If you are running a standalone instance / you want to configure all your nodes to run this new home net variable then you modify it at

sudo vim /opt/so/saltstack/local/pillar/global.sls

If there is a specific sensor you want to modify then edit the home net at

sudo vim /opt/so/saltstack/local/pillar/minions/<forwarder hostname>.sls