Enterprise Security Monitoring - Seeing Clearly with Security Onion - Wes Lambert
Explore enterprise security monitoring techniques using Security Onion in this 38-minute conference talk from BSides Tampa 2019. Learn about the capabilities and tools of Security Onion, including backend components, analysis interfaces, and various data types such as alerts, host data, metadata, and full content. Discover how to leverage Sguil, Squert, and Kibana interfaces for effective threat hunting and investigation. Gain insights into deployment options, event enrichment, alerting mechanisms, and the Elastic Stack integration. Follow along as the speaker demonstrates investigating an alert using Sguil and Kibana, providing practical knowledge for security professionals seeking to enhance their monitoring and incident response capabilities.