Alert for new devices on particular VLANS

[MrDigitalDick]

Hi,

Is there a way in security onion to view new devices connecting to particular vlans in our network? If so, could someone be kind enough to send some links to documentation?

If not, does anyone know of any opensource software that does?

Thanks in advance!

[dougburks]

Depending on what you're actually trying to achieve, there may be several options:

• Custom NIDS alert (https://docs.securityonion.net/en/2.3/local-rules.html)
• Zeek Intel (https://docs.securityonion.net/en/2.3/zeek.html#intel)
• Custom play (https://docs.securityonion.net/en/2.3/playbook.html#creating-a-new-play)