Security Onion Courses

This course is geared for those interested in seeing how Security Onion is used practically to triage alerts, hunt for threats, as well as build new detections. This course consists of three case studies that briefly cover the 3 most common workflows used in Security Onion: Case Study 1: Alert Triage & Case Creation – This case study walks through how to triage alerts within the alerts interface including escalation to TheHive. Case Study 2: Threat Hunting – This case study focuses on threat hunting within Security Onion using the Hunt interface, targeting SSL & Sysmon logs. Case Study 3: Detection Engineering – This case study covers ingesting Google Workspace audit logs into Security Onion and writing Sigma rules within Playbook targeting these new logs. Practical Analysis with Security Onion 2.3

This course is geared for those wanting to understand how to build a Detection Playbook with Security Onion 2.3. Students will gain both a theoretical and practical understanding of building detections in Security Onion, reinforced with real-life examples from network and host datasources. Syllabus Course Welcome & Introduction to Security Onion Security Onion Installation tDetection Engineering tKey Components of a Play Operationalizing Plays with Sigma Getting Started with Playbook Creating New Plays Developing Your Detection Playbook with Security Onion 2.3

This course is geared for administrators of Security Onion 2.3. Students will gain a foundational understanding of the platform – how to architect, deploy, manage and tune their Security Onion 2.3 grid. Syllabus Preview Course Welcome & Introduction to Security Onion Overall Architecture Installation – Manager Node Installation – Search Node Installation – Forward Node Grid Management with Salt Grid User Management Grid Firewall Management Grid Updates Grid Hardening Security Onion 2.3 in Production