Augmenting the (Security) Onion: Facilitating Enhanced Detection and Response with Open Source Tools

No ratings

Presented at BSidesAugusta 2019 by

Wes Lambert

As network defenders, we face evolving threats every day. We need to truly understand our computer networks, gain greater context around events occurring within them, and be able to quickly scope and respond to events, as necessary. To do this, we can use completely free and open source tools, augmenting a platform like Security Onion, to assist in enriching existing data, responding to alerts, tracking events, automating analysis of files extracted from network data streams, and even performing remote host-based forensics. This presentation discusses how these tools can be integrated to empower even the smallest of security teams to bolster their security program, providing greater value, and increasing efficiency in their operations.