What Security-Onion-Solutions/securityonion shipped

Security Onion 3.4.0 released. ILM policy errors now show in so-elasticsearch-ilm-policy-load output, securityonion-so-crates installs on Security Onion Desktop, stale ISO registry.tar is skipped on tag mismatch, and soup no longer has the CPU pre-flight check or --skip-cpu-check

Security Onion 3.4.0 is out. In this week's work, so-elasticsearch-ilm-policy-load now surfaces ILM policy errors, and securityonion-so-crates is installed on Security Onion Desktop. ISO builds skip a leftover registry.tar when tags do not match SOVERSION. The x86-64-v3 CPU pre-flight check and the --skip-cpu-check flag were removed from soup since the image issue is fixed, so soup --skip-cpu-check now prints usage and exits 1.

This week: all containers now use the host CA trust store with the grid CA, detection engine syncs get configurable timeouts, and the eMudhra/emSign CA fix is backported to the salt 3006.19 onedir.

This week's changes to the project: containers now use the host CA trust store together with the grid CA, replacing the roots images shipped with and the stale so-catrust copies. The unused elasticsearch.p12 and sokeys keystore were removed. Each detection engine now has configurable timeouts for how long a sync may run after detections change. The salt 3006.29 eMudhra and emSign CA fix was backported into the 3006.19 onedir build. custom_bind_mounts now works for so-kafka and so-soc, false positive scan results were fixed, and analyzer dependencies were updated, including a switch to Python 3.14.

This week: alerts queries from the SOC config UI now merge with defaults by name, so defaults added later still reach soc.json. Added a licensed Group By Assessment, Name query. AlertTriage sends its own notifications, so the Notifier agent mapping is gone.

This week's changes for SOC configuration and alert triage. Queries added to defaults via pillar are now merged with alerts queries saved from the SOC config UI by name, keeping pillar order and edits, so defaults added later such as the licensed Group By Assessment, Name query reach soc.json. A licensed Group By Assessment, Name alerts query was added, grouping by the alert triage assessment, rule name, severity label and rule uuid; untriaged alerts are not in this view. AlertTriage now sends its own notification through the Notify skill, so the Notifier agent mapping and annotation were removed and AlertTriage's description reworded. Also, readonly became readonlyUi in the YAML configuration, the earliest alert time field gained a readonly attribute, default and availableModels entries a

Initial Correlations support with Sigma Correlation rules, Sigma pipelines moved to a managed directory, and a new setting for external Markdown images. Elasticsearch 9.4.8 and an evaluation change to use Suricata for metadata.

This week shipped initial Correlations support with Sigma Correlation rules, including a SOC migration that fills rule type on existing detections and ElastAlert defaults raising old_query_limit from 5 minutes to 24 hours so rules resume where they stopped after an outage. Sigma pipelines are now in a managed directory at /opt/so/conf/soc/sigma_pipelines/, mounted read-only into SOC, replacing two single-file mounts. A new allowExternalMarkdownImages setting, default off, lets user-written Markdown such as case comments load external images. Also included: Elasticsearch 9.4.8, an evaluation change to use Suricata for metadata, a new destination timeout annotation, an elastic agent installer regeneration, and a revert of the auto apply state queue fix.

Security-Onion 3 updates: EVTX imports unified with live Windows parsing, Sigma detections fixed for Sysmon/4688, docker socket removed from telegraf, automations refactored to DB storage.

Security-Onion 3 updates improve Windows event handling and detection reliability. EVTX imports now use consistent parsing with live Windows data. Sigma detections fixed for Sysmon and 4688 sources. Security hardening removed unnecessary docker socket access from telegraf. Automations moved to database storage for better management.

This week: fixed three security vulnerabilities in network isolation, privilege escalation, and pillar rendering. Resolved regressions in user creation and config screens. Improved sensor cleanup and Zeek shutdown behavior.

This week's updates address critical security improvements and operational stability. Fixed network isolation for authentication APIs, patched privilege escalation vulnerabilities in management scripts and pillar rendering, and resolved user-facing regressions in account creation and configuration. Additional improvements prevent runaway cleanup processes and ensure Zeek terminates gracefully.