Onions in the Cloud Make the CISO Proud: Security Onion Cloud Deployments
Security Onion lead Wes Lambert demonstrates deploying distributed network security monitoring (NSM) and threat hunting sensors in AWS and Azure.
Summary
The Cloud Visibility Gap for Enterprise Defenders
While over 90% of enterprises utilize cloud services, defenders frequently lack visibility into east-west inter-instance traffic and egress data flows.
Deploying Security Onion in Hybrid and Multi-Cloud
Wes Lambert demonstrates architecting distributed Security Onion 2 clusters natively inside AWS and Microsoft Azure virtual networks.
Capturing Cloud Network Traffic via VPC Mirroring
Lambert explains how to leverage native cloud packet mirroring (AWS VPC Traffic Mirroring and Azure Virtual Network TAP) to feed Zeek and Suricata sensors.
Hunting Cloud Threats with Centralized Analytics
The presentation showcases threat hunting workflows across aggregated cloud network logs, full packet captures, and host telemetry in the Security Onion console.
Related talks
Community Stage·38 min
Andrew Cockburn
Explores the future of Distributed Denial of Service (DDoS) attack vectors, dynamic amplification techniques, and emerging mitigation architectures.
Blue Team Village·31 min
Charles Rumford
Charles Rumford challenges overly complex network security designs, showing how simplifying routing and segmentation enhances defensive posture.
Blue Team Village·24 min
Drimacus
Drimacus presents research on operating passive Next-Generation Firewalls (NGFWs) alongside existing detection stacks to enhance network threat hunting and visibility.