Liam Randall <[email protected]>
Scott Runnels <[email protected]>
A copy of SecurityOnion installed into a VM. Simply install it; you do not need to run the "Setup" wizard and actually enable the SO Suite of tools for active usage.
If you are using VMWare please also install VMWare Tools into your new SecurityOnion VM; if VirtualBox please make sure to install the Guest Additions.
If you do not already have a github account, please take the time to create one now. For the class we will be cloning repositories for configuration demonstrations, customization examples, and programming demo's. You can quickly install Git onto your SO Box with:
sudo apt-get install git
From there please follow the following steps to create your git account, create your first test repo, and then fork a sample repo:
https://help.github.com/articles/set-up-git
https://help.github.com/articles/create-a-repo
https://help.github.com/articles/fork-a-repo
Install the demonstrationss for today
git clone git://github.com:LiamRandall/bro-scripts.git bro-scripts
git clone git://github.com:LiamRandall/novaha-bro-training.git novaha-bro-training
Overview
Setup Sublime-2 with Syntax Highlighting
Download Sublime:
http://www.sublimetext.com/2
tar -xvjpf Sublime Text 2.0.1 x64.tar.bz2
Go ahead and start Sublime for the first time:
cd Sublime Text 2/
./sublime_text to launch
Enter the Sublime control window with the shortcut CONTROL TICK; the tick: ` is in the top left corner under the tilda: ~:
ctrl `
Install package control window just cut and paste the following:
import urllib2,os; pf='Package Control.sublime-package'; ipp=sublime.installed_packages_path(); os.makedirs(ipp) if not os.path.exists(ipp) else None; urllib2.install_opener(urllib2.build_opener(urllib2.ProxyHandler())); open(os.path.join(ipp,pf),'wb').write(urllib2.urlopen('http://sublime.wbond.net/' pf.replace(' ',' ')).read()); print 'Please restart Sublime Text to finish installation'
Install the Bro APT1 Report Module:
sudo apt-get install -y git
cd /opt/bro/share/bro/site/
sudo git clone git://github.com/sethhall/bro-apt1.git apt1
echo "@load apt1" | sudo tee -a local.bro