Security Onion

Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring).  It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, argus, Xplico, tcpreplay, scapy, hping, and many other security tools.  The main web site for the project is http://securityonion.blogspot.com/.

The screen captures below were taken from installing the distribution within a VMware Workstation environment.  After the initial installation has completed, access a terminal window and execute the following command as root to update the OS:

apt-get update; apt-get dist-upgrade

This process may take some time to download.  Once completed, the components of the Security Onion will need to be updated.  On the web site, a link is present concerning updates.

The page should have a command that you can copy and paste into a terminal window.

Once all components are updated, a icon should be present on the desktop called Setup.  This should launch a configuration wizard.

An advanced or quick setup option should be available.

Below are some of the screens of the setup wizard.

A summary screen should eventually appear.

Back on the desktop, access the Snorby icon.

Log into the web interface of the application.

To view alerts, click on the Events menu option.

In reviewing the details of an alert, a button is available to display the rule that generated the entry.

More options are available via the main menu.

The /etc/snort/snort.conf file may need to be modified to include the IP range on the network in question.

The FAQ section on the web site includes more configuration hints.

Shotty

Shotty is a screen capture utility for Windows that includes an integrated image editor.  During the installation process, a portable option is available.

http://shotty.devs-on.net/

vCenter Database Pre-Upgrade Checker

The vCenter Database Pre-Upgrade Checker is a utility to use on your current vCenter Server database to reveal problems that could prevent the upgrade or affect the performance of your database after the upgrade.  A KB article with details on the tool can be found at http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2004286.

DBPreUpgradeChecker.zip

Observium

Observium is an auto discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems including Cisco, Linux, FreeBSD, Juniper, Brocade, Foundry, HP and many more.  Observium is not intended to replace an up/down alerting system, but rather to complement it with an easy to manage, intuitive representation of historical and current performance statistics, configuration, visualization, and syslog capture.

www.observium.org

ISO to USB

ISO to USB is a free and small software that can burn the ISO image file directly to the USB drives, these USB drives include USB flash drives, memory sticks and other USB storage devices, it also supports to create a bootable USB disk with Windows operating systems.

http://www.isotousb.com/

smtp4dev

Windows 7/Vista/XP/2003/2010 compatible dummy SMTP server. Sits in the system tray and does not deliver the received messages. The received messages can be quickly viewed, saved and the source/structure inspected. Useful for testing/debugging software that generates email.

http://smtp4dev.codeplex.com/

Enable Night-Reading Mode with iOS

To enable a dimmed “night” display mode for any application with an iOS device, tap the Settings icon and choose General –> Accessibility –> Triple-click Home and and set it to “Toggle White on Black.”

Press the Home button to exit Settings and launch any reading app.  Triple-click the Home button in quick succession and it should enable white-on-black effect.  Triple-click again to switch back to the default normal mode.  The main downside is that images (both within apps and on the web) will look like photographic negatives instead of normal photographs.

Copy Output from Command Line Applications to the Clipboard

With Windows Vista and 7, an option is available to copy output from the command line to the Clipboard by piping it into the clip command:

command | clip

Below is an example of copying the output of the tasklist command to the Clipboard.

The contents of a file can be piped into the Clipboard by reserve.

clip < filename

The example below copies the contents of the file test.txt to the Clipboard.

VMware ThinApp

VMware’s ThinApp solution creates an executable from one or more applications without the requirement of a client agent.  This program is normally used within a virtual desktop environment, but can be used with a more traditional environment.  Below are some screen captures from the 60-day demo that created an executable of Firefox with Adobe Flash.  The default parameters were used in the majority of the selections.

Application virtualization encapsulates the application into a single executable .MSI or .EXE.  Just plug in an .MSI or .EXE file to deploy a virtual system environment, including registry keys, DLLs, third-party libraries, and frameworks without requiring any installation of agents on end point devices.

Outlook PST Viewer

This utility allows the viewing of a .PST (Personal Folder) file without using a Microsoft Outlook client.  The same site offers other free tools such as an OST Viewer.

http://www.nucleustechnologies.com/pst-viewer.html