Security Onion

Third party integration - sending log info from security onion to a tool like bro: https://github.com/Security-Onion-Solutions/security-onion/wiki/ThirdPartyIntegration#how-do-i-send-bro-and-ossec-logs-to-an-external-syslog-collector

Info about bro on security onion wiki: https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

Peeling the security onion: https://www.networkworld.com/article/2220605/cisco-subnet/cisco-subnet-peeling-the-security-onion.html

Iso Image for Live USB

Plug in the usb drive, list all drives, identify the device associated with the usb drive:

parted -l

for this example we'll use /dev/sdb. Now download the iso file, confirm the signature matches.

then format the usb device with the iso:

sudo dd if=securityonion-14.04.5.6.iso of=/dev/sdb bs=1M