SO 2.4 and Wazuh replaced by Winlogbeat

[Jaap79]

As it was just announced in the SO blog: “in the 2.4 release we plan to drop Wazuh”.

Will there be a grace period where Wazuh will still work?

And, when planning to migrate to Winlogbeat, will there be an option to make Winlogbeat talk to sensor nodes instead of only the Manager or a Receiver node?

[dougburks]

Will there be a grace period where Wazuh will still work?

When we release Security Onion 2.4, we will announce an End Of Life date for Security Onion 2.3. You can continue using Security Onion 2.3 and Wazuh until that EOL date.

And, when planning to migrate to Winlogbeat, will there be an option to make Winlogbeat talk to sensor nodes instead of only the Manager or a Receiver node?

For Security Onion 2.4, we plan to have a dedicated Elastic Fleet node option that can receive logs from the new Elastic Agent (which replaces Winlogbeat and other beats).

[rdevries-capland]

Hi Doug,

Thank you for the heads up on where SO is going.
Over the last couple of days I have been testing with SO, and you guys have done incredible work here.
I've currently got Wazuh deployed within my network, and was about to migrate over to SO, when I found the notice that Wazuh is being dropped off from SO.
During my research phase of SIEM options, Elastic was one of the systems that I considered.
The pay per feature factor ultimately eliminated Elastic endpoints as an option for me.

With this in mind, I would like to better understand the future of SO.
Will Security Onion stop being a freely obtainable and usable set of tools in order to make up for the licensing costs behind elk, or will we end up seeing features that we need to purchase licenses for?

There are 3 major things that I am hoping will prevail within SO.

1. This will be a fully integrated system with no requirement for multiple servers to serve different purposes.
2. We will be able to use SO within OnPrem environments with no cost barring support and SLA
3. We will not have banners everywhere stating that the features are not available unless we purchase licenses.

Further to this, do you perhaps have any guess as to what the timeline could look like for SO 2.4 Beta and Official releases?

Your clarity in this regard would be greatly appreciated.

[dougburks]

Over the last couple of days I have been testing with SO, and you guys have done incredible work here.

Thanks!

The pay per feature factor ultimately eliminated Elastic endpoints as an option for me.

Many organizations are using Elastic Beats and the newer Elastic Agents for free. Are there specific features you're looking at that are paid?

Will Security Onion stop being a freely obtainable and usable set of tools in order to make up for the licensing costs behind elk, or will we end up seeing features that we need to purchase licenses for?

This blog post might provide some additional insight into Security Onion 2.4 features:
https://blog.securityonion.net/2022/08/security-onion-enterprise-features-and.html

1. This will be a fully integrated system with no requirement for multiple servers to serve different purposes.

Security Onion 2.4 continues to include a Standalone mode which can enable all features on a single server. However, some enterprises may want or need to move to a distributed deployment as they scale out. For more about architecture, please see:
https://docs.securityonion.net/en/2.3/architecture.html

That page is for 2.3, but most of it will be relevant for 2.4.

2. We will be able to use SO within OnPrem environments with no cost barring support and SLA

From https://blog.securityonion.net/2022/08/security-onion-enterprise-features-and.html:
Q: I am a free community user. Can I use Security Onion 2.4 for free?
A: As long as you are adhering to the license, any free features in Security Onion 2.3 that carry over to Security Onion 2.4 will remain free.

3. We will not have banners everywhere stating that the features are not available unless we purchase licenses.

See my response to 2 above.

Further to this, do you perhaps have any guess as to what the timeline could look like for SO 2.4 Beta and Official releases?

We are working as hard as we can to reach 2.4 Beta as soon as possible. We will share more information as get closer to that release.