Analyst Tools
A dedicated silent sensor. The interface eth0 carries management traffic; eth1 has no IP address and exists only to observe. Security Onion manages its own analysis stack, so this reference does not attempt to document its internals — treat the platform’s own documentation as authoritative there. The entries below cover the two host-level facilities the labs touch directly.
| Tool | Path / Command | What It Does |
|---|---|---|
| Auditd | /etc/audit/auditd.conf |
How the audit daemon behaves: log size, rotation, and what to do when the disk fills. |
/etc/audit/rules.d/*.rules |
Your audit rules, split across files. These survive a reboot. | |
/etc/audit/audit.rules |
The compiled ruleset assembled from rules.d and loaded at boot. Generated — don’t hand-edit. | |
/var/log/audit/audit.log |
The raw record of system calls: who ran what, who touched which file. Wazuh reads this directly. | |
| tcpdump | /usr/bin/tcpdump |
The capture binary. |
/etc/apparmor.d/usr.sbin.tcpdump |
Example profile path; installation and enforcement vary. Check aa-status and the active profile when diagnosing a denied write. | |
eth1 (interface) |
The capture interface: promiscuous, no IP address, sees all mirrored traffic. |
UB2604 and SO14 are both silent sensors, and the contrast between them is deliberate. UB2604 is dual-homed, running a management interface alongside a capture interface on one machine. SO14 is a purpose-built appliance. The teaching point is architectural, not a difference in how either one addresses the network.