Doug Burks

RE: https://infosec.exchange/@securityonion/116878718682536323 Thanks to our customers and community for your support over the years!

🥗 SO-CRATES went on a diet!

1.1.1 cuts the container image size in half with a new multi-stage build.

Leaner, faster, still awesome for analyzing PCAPs, logs & binaries.

Who’s trying the new slim version? ❤️

SO-CRATES 3 is LIVE 🔥 Container for Rapid Analysis of Threats, Evil, and Sus Makes quick work of your pcap, log, and file analysis Now with: Suricata 8 under the hood support for more protocol metadata sqlite backend optimizations for performance and scalability new themes (CGA, C64, Vaporwave, and more) Which theme are you running first?

You can find the github repo at https://github.com/dougburks/ohmypcap Don't forget to give the repo a star!

@taosecurity @zeek when I get some time, I'll take a look to see what the level of effort would be and what that would do to the overall size of the app

View security alerts, browse network metadata (DNS, HTTP, TLS, flows), extract ASCII transcripts, and carve individual streams - all from a single-page UI:

Thanks to Jay Hawkins and @chrissanders88 for the early testing and feedback!

@chrissanders88 The main screen now allows you to drag and drop pcap files for analysis. There is also a new button that allows you to re-analyze a previously analyzed pcap:

@chrissanders88 The pcap analysis screen now includes a sankey diagram:

@chrissanders88 When you find an interesting alert, you can drill into a row in the data table and see the rule that generated the alert and the ASCII transcript:

@chrissanders88 You can then switch to hexdump:

@chrissanders88 To slice and dice your data, expand the Aggregation Tables section and click on one or more values to filter your data:

@chrissanders88 You can find the github repo and a quick online demo at: https://github.com/dougburks/ohmypcap Don't forget to give the repo a star!

@chrissanders88 and if you're looking for some fun pcap files to try out, @malware_traffic has a great collection!

Check it out! https://ohmydebn.org

Check it out at https://ohmydebn.org

Check it out at https://ohmydebn.org

Want to try a quick interactive demo? securityonion.net/socrates-demo

Want to run it locally? Check out our github repo at github.com/dougburks/so-crates and give it a star!

Check it out at https://ohmydebn.org

Check it out at https://ohmydebn.org

So close to 2M downloads of SO-CRATES!