Josh Patterson
a540e47672
Salt 3006.29 (saltstack/salt#70466) answered the eMudhra/emSign incident by bumping certifi to 2026.10.19, which drops the "emSign ECC Root CA - G3" root whose intermediates had recoverable private keys, and by shipping pip 26.2.2, whose vendored certifi gets the same fix. We stay on 3006.19, so apply the same two upgrades inside /opt/saltstack/salt from vendored wheels. relenv is upgraded to 0.22.27 in the same pip invocation. relenv 0.22.2's runtime wrapper hardcodes pre-26.2 pip install() signatures, so a lone pip 26.2.2 upgrade breaks every later pip run with an unexpected 'script_executable' argument. 0.22.27 is what 3006.29 builds against and its runtime diff is otherwise cosmetic. Installing all three at once under the stock pip means no host ever sits in the broken intermediate state. The state lives in salt.python_modules so new installs get it from salt_install_module_deps before salt-master starts, and existing grids get it from the soup highstate plus grid push. It is gated on saltversion 3006.19 so a future Salt bump disables it, and ordered before the docker module install so docker is always installed with the fixed pip. The docker wheel set now carries certifi 2026.10.19 instead of 2024.7.4. Verified on a fresh 3.4.0 manager + sensor grid: state applies on both, reruns are no-ops, full highstate passes on both nodes.
Security Onion
Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity.
✨ Features
Security Onion includes everything you need to monitor your network and host systems:
- Security Onion Console (SOC): A unified web interface for analyzing security events and managing your grid.
- Elastic Stack: Powerful search backed by Elasticsearch.
- Intrusion Detection: Network-based IDS with Suricata and host-based monitoring with Elastic Fleet.
- Network Metadata: Detailed network metadata generated by Zeek or Suricata.
- Full Packet Capture: Retain and analyze raw network traffic with Suricata PCAP.
⭐ Security Onion Pro
For organizations and enterprises requiring advanced capabilities, Security Onion Pro offers additional features designed for scale and efficiency:
- Onion AI: Leverage powerful AI-driven insights to accelerate your analysis and investigations.
- Enterprise Features: Enhanced tools and integrations tailored for enterprise-grade security operations.
For more information, visit the Security Onion Pro page.
☁️ Cloud Deployment
Security Onion is available and ready to deploy in the AWS, Azure, and Google Cloud (GCP) marketplaces.
🚀 Getting Started
| Goal | Resource |
|---|---|
| Download | Security Onion ISO |
| Requirements | Hardware Guide |
| Install | Installation Instructions |
| What's New | Release Notes |
📖 Documentation & Support
For more detailed information, please visit our Documentation.
- FAQ: Frequently Asked Questions
- Community: Discussions & Support
- Training: Official Training
🤝 Contributing
We welcome contributions! Please see our CONTRIBUTING.md for guidelines on how to get involved.
🛡️ License
Security Onion is licensed under the terms of the license found in the LICENSE file.
Built with 🧅 by Security Onion Solutions.