Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Clone this wiki locally
Some organizations have airgapped networks with no connection to the Internet. Security Onion works fine on these airgapped networks, although it may be missing some updates due to lack of Internet connection.
When pivoting to transcript (Sguil client or CapMe), the Sguil server performs DNS lookups on the source and destination IP addresses. You can disable these DNS lookups as shown here: https://github.com/Security-Onion-Solutions/security-onion/issues/905
You can transfer updates to airgapped networks via DVD, USB, or other media.
@SkiTheSlicer has created a set of scripts to assist in updating airgapped Security Onion installations:
For Docker containers, sneakernet updates can be performed by doing something like the following: