Has anyone had any luck getting seconion 2 to work with moloch?

[ZeeMastermind]

Like it says on the tin. We had the previous version of security onion working with Moloch, but now we're running into issues. It looks like the way that stenographer stores PCAP is not readable by vanilla Moloch. (We hadn't been using moloch for packet capture, just for looking at the pcap in a web ui)

Any thoughts on configuring Moloch to read stenographer PCAP? Are there any other web UI that would work for our purposes?

[TOoSmOotH]

Can you let me know what the PCAP interface is missing that you need to use Moloch for?

[ZeeMastermind]

To be honest, it's more that our users like Moloch's interface. I think SecOnion has all the features we use in Moloch in the "Hunt" page, I think the main difference is that you can pivot to looking at different packets a bit quicker in Moloch, rather than going back and forth between Hunt and PCAP.

One thing that is missing is searching on Protocol, rather than searching on Port. In fact, I'm usually more interested in Port/Protocol mismatches. Although I prefer analysts do the hunt in something like Kibana or Splunk before switching to packet analysis, sometimes it's useful to be able to switch between the packets of a single connection.

Moloch also can carve files out of PCAP in the browser. We can still do this with your interface by downloading the PCAP and extracting the file with a tool like wireshark, it's just more convenient to do it all in browser.

We just got ahold of SO 2, so it could be growing pains. If we run into anything else missing, or anything that we prefer in the new SO over Moloch, I will let you know.

[TOoSmOotH]

Yea Moloch's interface is different and allows a PCAP centric approach. We have designed our interface around having multiple data sources.

Searching on protocol port anomalies is easily done via the following query:
event.module: "zeek" AND event.dataset: "conn" | groupby network.protocol destination.port

We plan on carving files from the PCAP from the web interface at some point: #635

Always reach out if there is a feature or something you think that is missing!