Security onion deployment

[redson96]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

16GB

Storage for /

500Gb

Storage for /nsm

Hi

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Hi, I'm going to deploy Security Onion on two labs. These two labs are in different networks. I have deployed the Security Onion manager on my server and also deployed a forward node on my first lab. My forward node is connected to my first lab's firewall. Everything is working perfectly. I think logs are coming from Zeek and Suricata to my manager node. Now, I need to connect my second lab. I'm going to deploy another forward node and connect it to my manager node. However, all the logs coming from the second lab should be displayed on the manager node, and my first lab's logs should not mix with the second lab's logs. How can I achieve this? I need some assistance.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

As a forward node ingests network traffic it will have a field observer.name. You could use that to split your dashboards up between what forward node 1 saw and what forward node 2 saw. Using an "include" filter https://docs.securityonion.net/en/2.4/dashboards.html#include