This lab introduces students to the Security Onion Security Information and Event Management (SIEM) system.  It is a widely used SIEM that integrates multiple tools into one platform.  Tools include: Log analysis tools such as Elasticsearch, Logstash, and Kibana;  intrusion detection systems such as Suricata, Zeek and Snort; and threat detection systems such as Wazuh.

Students will learn to configure Security Onion and to use Squil, a graphical analyst console; Squert, a web application that is used to query and view event data stored in a Sguil database; and Kibana, the data visualization and exploration user interface for the Elasticsearch log analysis system.