Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
managerhype by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/14966
Vlb2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/14972
merge with 2.4/dev by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/14990
pass pillar properly by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/14994
Vlb2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15015
Vlb2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15056
only update mine for managerhype during setup by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15061
update service file, use salt.minion state to update mine_functions by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15065
set interface for network.ip_addrs for hypervisors by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15066
Vlb2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15067
Vlb2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15076
Byoh by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15098
nsm virtual disk and new nsm_total grain by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15122
bump version by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15169
bump version by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15170
estimate elasticsearch retention by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15176
create libvirt volumes directory by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15181
add manager role to elasticsearch ingest time spent by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15182
Upgrade Salt 3006.16 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15185
Available Models by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/15188
Salt 3006.16 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15193
move off of cmd.script with args \ by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15194
ensure previous setup outcomes are cleared by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15198
strelka use single master image by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15192
update so-elasticsearch-retention-estimate by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15201
rename forward node -> sensor node by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15207
Update defaults.yaml by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/15209
Suricata 8.0.2 by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15211
reduce pcapMaxCount to fit better with max upload size by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15213
add support to so-yaml for using yaml file content for values by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15219
update so-elasticsearch-retention-estimate by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15204
configure salt, then install. update bootstrap-salt. reduce salt install fail timeout by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15223
CompressContextPrompt by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/15221
wait for 200 from registry before proceeding by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15228
Add Enabled Flag to Models by @coreyogburn in https://github.com/Security-Onion-Solutions/securityonion/pull/15229
pcap annotations by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15225
suricata pipeline updates by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15230
fix so-setup error duplicate bond0 by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15231
rm salt keyring and repo file for deb by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15237
update zeek pipelines by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15234
communicate to the viewer that OS patches may take some time by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15240
suricata capture file by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15244
Notify user of hypervisor environment setup failures by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15247
clarify hypervisor annotation by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15248
use timestamp in volume path to prevent duplicates by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15251
Add JA4D option to config.zeek.ja4 by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/15271
add force & certs flag to update fleet certs as needed by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15264
add new so-yaml_test for removefromlist by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15275
need additional line bw class by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15277
reserve group ids by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15280
skip continue prompt if user cannot actually continue by @jertel in https://github.com/Security-Onion-Solutions/securityonion/pull/15281
FEATURE: Advanced ILM actions via SOC UI by @reyesj2 in https://github.com/Security-Onion-Solutions/securityonion/pull/15241
Idstools refactor by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15232
Fixup Airgap by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15283
Make sure local salt dir is created by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15284
be more verbose by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15286
Rework ordering by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15287
match correct custom ruleset name by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15290
Fix custom name by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15292
Remove Claude Sonnet 4 model configuration by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/15293
small fixes by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15297
Fixup logic by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15298
Update Assistant Models by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/15289
Rework backup by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15301
Add Airgap check by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15303
fix cleaning repos on remote nodes if airgap by @m0duspwnens in https://github.com/Security-Onion-Solutions/securityonion/pull/15304
Add trailing nl if it doesnt already exist by @defensivedepth in https://github.com/Security-Onion-Solutions/securityonion/pull/15308
Update so-minion by @TOoSmOotH in https://github.com/Security-Onion-Solutions/securityonion/pull/15311
Full Changelog: https://github.com/Security-Onion-Solutions/securityonion/compare/2.4.190-20251024...2.4.200-20251216