Security-Onion-Solutions · TOoSmOotH · Jul 29, 2024 · Jun 27, 2024 · Jul 5, 2024 · Jul 8, 2024
diff --git a/alerts.rst b/alerts.rst
@@ -134,28 +134,26 @@ The ``Clipboard`` sub-menu has several options that allow you to copy selected d
 Actions
 ~~~~~~~
 
-The ``Actions`` sub-menu has several different options:
+The ``Actions`` sub-menu has several different options. Please note that some of these actions will only display on the Actions menu if you click on a specific log type.
 
 - Clicking the ``Hunt`` option will start a new search for the selected value and will give you a good overview of what types of data are available for that indicator.
 
 - Clicking the ``Add to Case`` option will add an observable to a new or existing case.
 
 - Clicking the ``Correlate`` option will find related logs based on Community ID, uid, fuid, etc.
 
-- Clicking the ``PCAP`` option will pivot to the :ref:`pcap` interface to retrieve full packet capture for the selected stream.
+- Clicking the ``PCAP`` option will pivot to the :ref:`pcap` interface to retrieve full packet capture for the selected stream. This option will only appear if you click on a log that contains source IP, source port, destination IP, destination port, etc.
 
 - Clicking the ``Google`` option will search Google for the selected value. 
 
 - Clicking the ``VirusTotal`` option will search VirusTotal for the selected value.
 
-- Clicking the ``Process Info`` option will show all logs that include this process's entity_id in the ``process.entity_id`` field.
+- Clicking the ``Process Info`` option will show all logs that include this process's entity_id in the ``process.entity_id`` field. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process and Child Info`` option will show all logs that include this process's entity_id in either the ``process.entity_id`` or ``process.parent.entity_id`` fields (depending on the process, this may show the same logs as the ``Process Info`` option or it may show more).
+- Clicking the ``Process and Child Info`` option will show all logs that include this process's entity_id in either the ``process.entity_id`` or ``process.parent.entity_id`` fields. Depending on the process, this may show the same logs as the ``Process Info`` option or it may show more. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process All Info`` option will show all logs that include this process's entity_id in any field (depending on the process, this may show the same logs as the ``Process and Child Info`` option or it may show more).
+- Clicking the ``Process All Info`` option will show all logs that include this process's entity_id in any field. Depending on the process, this may show the same logs as the ``Process and Child Info`` option or it may show more. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process Ancestors`` option will show all parent processes for the selected process.
-
-Please note that some of these actions will only display on the Actions menu if you click on a specific log type. For example, the first three Process actions will only appear if you click on a log that contains the ``process.entity_id`` field and the ``Process Ancestors`` action will only appear if you click on a log that contains the ``process.Ext.ancestry`` field.
+- Clicking the ``Process Ancestors`` option will show all parent processes for the selected process. This option will only appear if you click on a log that contains the ``process.Ext.ancestry`` field.
 
 If you'd like to add your own custom actions, see the :ref:`soc-customization` section.
diff --git a/architecture.rst b/architecture.rst
@@ -178,7 +178,6 @@ Heavy nodes perform sensor duties and store their own logs in their own local :r
 Heavy Nodes run the following components:
 
 -  :ref:`elasticsearch`
--  :ref:`logstash`
 -  :ref:`zeek`
 -  :ref:`suricata`
 -  :ref:`stenographer`

diff --git a/dashboards.rst b/dashboards.rst
@@ -145,29 +145,27 @@ The ``Clipboard`` sub-menu has several options that allow you to copy selected d
 Actions
 ~~~~~~~
 
-The ``Actions`` sub-menu has several different options:
+The ``Actions`` sub-menu has several different options. Please note that some of these actions will only display on the Actions menu if you click on a specific log type.
 
 - Clicking the ``Hunt`` option will start a new search for the selected value and will give you a good overview of what types of data are available for that indicator.
 
 - Clicking the ``Add to Case`` option will add an observable to a new or existing case.
 
 - Clicking the ``Correlate`` option will find related logs based on Community ID, uid, fuid, etc.
 
-- Clicking the ``PCAP`` option will pivot to the :ref:`pcap` interface to retrieve full packet capture for the selected stream.
+- Clicking the ``PCAP`` option will pivot to the :ref:`pcap` interface to retrieve full packet capture for the selected stream. This option will only appear if you click on a log that contains source IP, source port, destination IP, destination port, etc.
 
 - Clicking the ``Google`` option will search Google for the selected value.
 
 - Clicking the ``VirusTotal`` option will search VirusTotal for the selected value.
 
-- Clicking the ``Process Info`` option will show all logs that include this process's entity_id in the ``process.entity_id`` field.
+- Clicking the ``Process Info`` option will show all logs that include this process's entity_id in the ``process.entity_id`` field. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process and Child Info`` option will show all logs that include this process's entity_id in either the ``process.entity_id`` or ``process.parent.entity_id`` fields (depending on the process, this may show the same logs as the ``Process Info`` option or it may show more).
+- Clicking the ``Process and Child Info`` option will show all logs that include this process's entity_id in either the ``process.entity_id`` or ``process.parent.entity_id`` fields. Depending on the process, this may show the same logs as the ``Process Info`` option or it may show more. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process All Info`` option will show all logs that include this process's entity_id in any field (depending on the process, this may show the same logs as the ``Process and Child Info`` option or it may show more).
+- Clicking the ``Process All Info`` option will show all logs that include this process's entity_id in any field. Depending on the process, this may show the same logs as the ``Process and Child Info`` option or it may show more. This option will only appear if you click on a log that contains the ``process.entity_id`` field.
 
-- Clicking the ``Process Ancestors`` option will show all parent processes for the selected process.
-
-Please note that some of these actions will only display on the Actions menu if you click on a specific log type. For example, the first three Process actions will only appear if you click on a log that contains the ``process.entity_id`` field and the ``Process Ancestors`` action will only appear if you click on a log that contains the ``process.Ext.ancestry`` field.
+- Clicking the ``Process Ancestors`` option will show all parent processes for the selected process. This option will only appear if you click on a log that contains the ``process.Ext.ancestry`` field.
 
 If you'd like to add your own custom actions, see the :ref:`soc-customization` section.
 

diff --git a/download.rst b/download.rst
@@ -13,7 +13,7 @@ Download and verify our ISO image as shown at https://github.com/Security-Onion-
 
 .. warning::
 
-   If you download our ISO image and then scan it with antivirus software, it is possible that one or more of the files included in the ISO image may generate false positives. If you look at the antivirus scan details, it will most likely tell you that it alerted on a file in ``SecurityOnion\agrules\``. This is part of :ref:`strelka` and it is being incorrectly flagged as a backdoor when it is really just a Yara ruleset that looks for backdoors. In some cases, the alert may be for a sample EXE that is included in :ref:`strelka` but again a false positive.
+   If you download our ISO image and then scan it with antivirus software, it is possible that one or more of the files included in the ISO image may generate false positives. If you look at the antivirus scan details, it will most likely tell you that it alerted on a file in ``SecurityOnion\agrules\``.
 
 .. note::
 

diff --git a/faq.rst b/faq.rst
@@ -194,6 +194,11 @@ Should I backup my Security Onion box?
 
 Security Onion automatically backs up some important configuration as described in the :ref:`backup` section. However, there is no automated data backup. Network Security Monitoring as a whole is considered "best effort". It is not a "mission critical" resource like a file server or web server. Since we're dealing with "big data" (potentially terabytes of full packet capture) of a transient nature, backing up the data would be prohibitively expensive. Most organizations don't do any data backups and instead just rebuild boxes when necessary.
 
+What happened to Playbook?
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Playbook has been replaced by :ref:`detections`.
+
 How can I add local rules?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 

diff --git a/images/01_grub.png b/images/01_grub.png
diff --git a/images/04_setup_init.png b/images/04_setup_init.png
diff --git a/images/05_setup_option.png b/images/05_setup_option.png
diff --git a/images/06_setup_airgap.png b/images/06_setup_airgap.png
diff --git a/images/06_setup_type.png b/images/06_setup_type.png
diff --git a/images/07_setup_license.png b/images/07_setup_license.png
diff --git a/images/08_setup_hostname.png b/images/08_setup_hostname.png
diff --git a/images/09_setup_hostname_conflict.png b/images/09_setup_hostname_conflict.png
diff --git a/images/10_setup_mn_nic.png b/images/10_setup_mn_nic.png
diff --git a/images/11_setup_mn_int.png b/images/11_setup_mn_int.png
diff --git a/images/12_setup_cidr.png b/images/12_setup_cidr.png
diff --git a/images/13_setup_gateway.png b/images/13_setup_gateway.png
diff --git a/images/14_setup_dns_servers.png b/images/14_setup_dns_servers.png
diff --git a/images/15_setup_dns_domain.png b/images/15_setup_dns_domain.png
diff --git a/images/16_setup_docker_range.png b/images/16_setup_docker_range.png
diff --git a/images/18_setup_direct_proxy.png b/images/18_setup_direct_proxy.png
diff --git a/images/20_setup_webuser.png b/images/20_setup_webuser.png
diff --git a/images/21_setup_webpass1.png b/images/21_setup_webpass1.png
diff --git a/images/22_setup_webpass2.png b/images/22_setup_webpass2.png
diff --git a/images/23_setup_access_type.png b/images/23_setup_access_type.png
diff --git a/images/26_setup_so_allow.png b/images/26_setup_so_allow.png
diff --git a/images/27_setup_so_allow_input.png b/images/27_setup_so_allow_input.png
diff --git a/images/27_telemetry.png b/images/27_telemetry.png
diff --git a/images/28_setup_summary.png b/images/28_setup_summary.png
diff --git a/images/29_setup_finished.png b/images/29_setup_finished.png
diff --git a/images/38_overview.png b/images/38_overview.png
diff --git a/images/39_grid.png b/images/39_grid.png
diff --git a/images/40_upload.png b/images/40_upload.png
diff --git a/images/45_import.png b/images/45_import.png
diff --git a/images/50_alerts.png b/images/50_alerts.png
diff --git a/images/51_alerts_options.png b/images/51_alerts_options.png
diff --git a/images/53_dashboards.png b/images/53_dashboards.png
diff --git a/images/54_dashboards_options.png b/images/54_dashboards_options.png
diff --git a/images/56_hunt.png b/images/56_hunt.png
diff --git a/images/57_0_cases.png b/images/57_0_cases.png
diff --git a/images/57_1_cases_options.png b/images/57_1_cases_options.png
diff --git a/images/57_2_cases_create.png b/images/57_2_cases_create.png
diff --git a/images/57_detections.png b/images/57_detections.png
diff --git a/images/58_detections_options.png b/images/58_detections_options.png
diff --git a/images/59_detection_create.png b/images/59_detection_create.png
diff --git a/images/60_detection_nids.png b/images/60_detection_nids.png
diff --git a/images/60_detection_nids_0_comments.png b/images/60_detection_nids_0_comments.png
diff --git a/images/60_detection_nids_1_signature.png b/images/60_detection_nids_1_signature.png
diff --git a/images/60_detection_nids_2_tuning_1.png b/images/60_detection_nids_2_tuning_1.png
diff --git a/images/60_detection_nids_2_tuning_2_add.png b/images/60_detection_nids_2_tuning_2_add.png
diff --git a/images/60_detection_nids_3_history.png b/images/60_detection_nids_3_history.png
diff --git a/images/60_detection_sigma.png b/images/60_detection_sigma.png
diff --git a/images/60_detection_sigma_2_tuning_1.png b/images/60_detection_sigma_2_tuning_1.png
diff --git a/images/60_detection_sigma_2_tuning_2_add.png b/images/60_detection_sigma_2_tuning_2_add.png
diff --git a/images/60_detection_yara.png b/images/60_detection_yara.png
diff --git a/images/62_pcap.png b/images/62_pcap.png
diff --git a/images/65_pcap_details.png b/images/65_pcap_details.png
diff --git a/images/68_cyberchef.png b/images/68_cyberchef.png
diff --git a/images/72_jobs.png b/images/72_jobs.png
diff --git a/images/73_jobs_add.png b/images/73_jobs_add.png
diff --git a/images/75_grid.png b/images/75_grid.png
diff --git a/images/76_grid_options.png b/images/76_grid_options.png
diff --git a/images/78_downloads.png b/images/78_downloads.png
diff --git a/images/81_users.png b/images/81_users.png
diff --git a/images/82_users_detail.png b/images/82_users_detail.png
diff --git a/images/83_users_add.png b/images/83_users_add.png
diff --git a/images/84_gridmembers.png b/images/84_gridmembers.png
diff --git a/images/87_config.png b/images/87_config.png
diff --git a/images/88_config_options.png b/images/88_config_options.png
diff --git a/images/91_licensekey.png b/images/91_licensekey.png
diff --git a/images/94_usermenu.png b/images/94_usermenu.png
diff --git a/images/config-item-backup.png b/images/config-item-backup.png
diff --git a/images/config-item-bpf.png b/images/config-item-bpf.png
diff --git a/images/config-item-elastalert-alerter.png b/images/config-item-elastalert-alerter.png
diff --git a/images/config-item-elastalert.png b/images/config-item-elastalert.png
diff --git a/images/config-item-elasticfleet.png b/images/config-item-elasticfleet.png
diff --git a/images/config-item-elasticsearch.png b/images/config-item-elasticsearch.png
diff --git a/images/config-item-firewall.png b/images/config-item-firewall.png
diff --git a/images/config-item-global-url.png b/images/config-item-global-url.png
diff --git a/images/config-item-global.png b/images/config-item-global.png
diff --git a/images/config-item-host.png b/images/config-item-host.png
diff --git a/images/config-item-idh.png b/images/config-item-idh.png
diff --git a/images/config-item-idstools.png b/images/config-item-idstools.png
diff --git a/images/config-item-influxdb.png b/images/config-item-influxdb.png
diff --git a/images/config-item-kafka.png b/images/config-item-kafka.png
diff --git a/images/config-item-kibana.png b/images/config-item-kibana.png
diff --git a/images/config-item-kratos.png b/images/config-item-kratos.png
diff --git a/images/config-item-logstash.png b/images/config-item-logstash.png
diff --git a/images/config-item-manager.png b/images/config-item-manager.png
diff --git a/images/config-item-nginx.png b/images/config-item-nginx.png
diff --git a/images/config-item-ntp.png b/images/config-item-ntp.png
diff --git a/images/config-item-patch.png b/images/config-item-patch.png
diff --git a/images/config-item-pcap.png b/images/config-item-pcap.png
diff --git a/images/config-item-redis.png b/images/config-item-redis.png
diff --git a/images/config-item-sensor.png b/images/config-item-sensor.png
diff --git a/images/config-item-sensoroni.png b/images/config-item-sensoroni.png
diff --git a/images/config-item-soc-additionalAlerters.png b/images/config-item-soc-additionalAlerters.png
diff --git a/images/config-item-soc.png b/images/config-item-soc.png
diff --git a/images/config-item-strelka.png b/images/config-item-strelka.png
diff --git a/images/config-item-suricata.png b/images/config-item-suricata.png
diff --git a/images/config-item-telegraf.png b/images/config-item-telegraf.png
diff --git a/images/config-item-zeek.png b/images/config-item-zeek.png
diff --git a/images/diagrams/heavy-distributed.png b/images/diagrams/heavy-distributed.png
diff --git a/ingest.rst b/ingest.rst
@@ -56,7 +56,7 @@ Manager Search
 Heavy
 -----
 
-| Pipeline: Elastic Agent [Heavy Node] --> Logstash [Heavy] --> Redis [Heavy] <--> Logstash [Heavy] --> Elasticsearch Ingest [Heavy] 
+| Pipeline: Elastic Agent [Heavy Node] --> Elasticsearch Ingest [Heavy] 
 | Logs: Zeek, Suricata, syslog
 
 Search

diff --git a/release-notes.rst b/release-notes.rst
@@ -22,6 +22,31 @@ To resolve the issue, run the following command for each affected index (replaci
 
 After running the command, the index should no longer use replicas and the status should change from "Pending" to "OK" once all indices have been successfully modified. 
 
+2.4.90 [20240729] Changes
+-------------------------
+
+- FEATURE: Add new action to SOC Actions list to allow users to more easily add their own actions `#13346 <https://github.com/Security-Onion-Solutions/securityonion/issues/13346>`_
+- FEATURE: Include new Security Onion appliance images for v2 refresh
+- FEATURE: Provide maximize button on configuration screen
+- FEATURE: Support suricata regex enable | disable
+- FEATURE: Visualize diff of history edits
+- FIX: Better Timeout Error message `#12534 <https://github.com/Security-Onion-Solutions/securityonion/issues/12534>`_
+- FIX: Custom defined template causes SLS rendering error in base:elasticsearch.enabled `#13328 <https://github.com/Security-Onion-Solutions/securityonion/issues/13328>`_
+- FIX: Detections - Bulk Performance Revisit
+- FIX: Disable logstash on heavynodes `#13073 <https://github.com/Security-Onion-Solutions/securityonion/issues/13073>`_
+- FIX: Exclude policy phases if not defined in defaults `#13354 <https://github.com/Security-Onion-Solutions/securityonion/issues/13354>`_
+- FIX: Heavynode architecture documentation
+- FIX: Improve displayed metrics for Kafka in influxdb `#13235 <https://github.com/Security-Onion-Solutions/securityonion/issues/13235>`_
+- FIX: Refactor Sync Process
+- FIX: Update MOTD `#13317 <https://github.com/Security-Onion-Solutions/securityonion/issues/13317>`_
+- FIX: Update SOC MOTD `#13320 <https://github.com/Security-Onion-Solutions/securityonion/issues/13320>`_
+- UPGRADE: Base image for so-steno container to oracle9:latest `#13344 <https://github.com/Security-Onion-Solutions/securityonion/issues/13344>`_
+- UPGRADE: Base image for so-tcpreplay container to oracle9:latest `#13345 <https://github.com/Security-Onion-Solutions/securityonion/issues/13345>`_
+- UPGRADE: CyberChef 10.19.0 `#13267 <https://github.com/Security-Onion-Solutions/securityonion/issues/13267>`_
+- UPGRADE: so-idh to newer base image `#13265 <https://github.com/Security-Onion-Solutions/securityonion/issues/13265>`_
+- UPGRADE: so-nginx to nginx:1.26.1-alpine `#13264 <https://github.com/Security-Onion-Solutions/securityonion/issues/13264>`_
+- UPGRADE: Suricata 7.0.6 `#13283 <https://github.com/Security-Onion-Solutions/securityonion/issues/13283>`_
+
 2.4.80 [20240624] Changes
 -------------------------
 

diff --git a/suricata.rst b/suricata.rst
@@ -177,7 +177,7 @@ Troubleshooting Alerts
 
 If you're not seeing the Suricata alerts that you expect to see, here are some things that you can check:
 
-- If you have metadata enabled, check to see if you have metadata for the connections. Depending on your configuration, this could be Suricata metadata or :ref:`zeek` metadata.
+- If you have metadata enabled, check to see if you have metadata for the connections. Depending on your configuration, this could be Suricata metadata or :ref:`zeek` metadata. Go to :ref:`dashboards`, click the dropdown menu, select the ``Connections seen by Zeek or Suricata`` dashboard, and see if the connections you expect to see in your network traffic are listed there.
 
 - If you have metadata enabled but aren't seeing any metadata, then something may be preventing the process from seeing the traffic. Check to see if you have any :ref:`bpf` configuration that may cause the process to ignore the traffic. If you're sniffing traffic from the network, verify that the traffic is reaching the NIC using tcpdump. If importing a pcap file, verify that file contains the traffic you expect and that the Suricata process can read the file and any parent directories.
 

diff --git a/url-base.rst b/url-base.rst
@@ -3,9 +3,7 @@
 Web Access URL
 ==============
 
-If you need to change the URL for web access to Security Onion (for example, from IP to FQDN), go to :ref:`administration` --> Configuration --> global.
+If you need to change the URL for web access to Security Onion (for example, from IP to FQDN), go to :ref:`administration` --> Configuration --> global --> url_base. Enter the new URL in the field on the right and then click the checkmark to save the new setting.
 
-.. image:: images/config-item-global.png
-  :target: _images/config-item-global.png
-
-Then select the ``url_base`` option.
+.. image:: images/config-item-global-url.png
+  :target: _images/config-item-global-url.png
diff --git a/vmware.rst b/vmware.rst
@@ -10,7 +10,7 @@ In this section, we'll cover creating a virtual machine (VM) for our ISO image i
 
 .. note::
 
-   With the sniffing interface in ``bridged`` mode, you will be able to see all traffic to and from the host machine's physical NIC. If you would like to see **ALL** the traffic on your network, you will need a method of forwarding that traffic to the interface to which the virtual adapter is bridged. This can be achieved with a tap or SPAN port.
+   If you want to sniff live traffic, then you will need a second network interface dedicated to sniffing. You will need to set this sniffing interface to sniff from whatever network you want to monitor. With the sniffing interface in ``bridged`` mode, you should be able to see all traffic to and from the host machine's physical NIC. If you would like to see **ALL** the traffic on your network, you will need a method of forwarding that traffic to the interface to which the virtual adapter is bridged. This can be achieved with a tap or SPAN port. If you want to sniff traffic from other VMs, then the virtual sniffing interface needs to be set to the same virtual network that those VMs are set to (this may be ``NAT`` or ``bridged`` depending on how they are configured).
 
 Workstation Pro
 ---------------
@@ -24,8 +24,8 @@ VMware Workstation is available for many different host operating systems, inclu
 #. Specify virtual machine name and click ``Next``.
 #. Specify disk size (minimum 200GB), store as single file, click ``Next``.
 #. Customize hardware and increase Memory and Processors based on the :ref:`hardware` section.
-#. Network Adapter (NAT or Bridged -- if you want to be able to access your Security Onion machine from other devices in the network, then choose Bridged, otherwise choose NAT to leave it behind the host) -- in this tutorial, this will be the management interface.
-#. Add >> Network Adapter (Bridged) - this will be the sniffing (monitor) interface.
+#. Network Adapter (``NAT`` or ``Bridged`` -- if you want to be able to access your Security Onion machine from other devices in the network then choose Bridged, otherwise choose NAT to leave it behind the host). This will be the management interface.
+#. Add >> Network Adapter (``NAT`` or ``Bridged``). This will be the sniffing (monitor) interface.
 #. Click ``Close``.
 #. Click ``Finish``.
 #. Power on the virtual machine and then follow the installation steps for your desired installation type in the :ref:`installation` section.
-Original file line number
+Diff line change
@@ Expand Up / @@ -56,7 +56,7 @@ Manager Search @@
     Heavy
     -----
-    | Pipeline: Elastic Agent [Heavy Node] --> Logstash [Heavy] --> Redis [Heavy] <--> Logstash [Heavy] --> Elasticsearch Ingest [Heavy]
+    | Pipeline: Elastic Agent [Heavy Node] --> Elasticsearch Ingest [Heavy]
     | Logs: Zeek, Suricata, syslog
     Search
@@ Expand Down @@