Your SOC, explained plainly
Everything from how the system is set up, to logging in, using Kibana, adding a new computer, and knowing what to do with an alert — written for MIS Tanauan City Hall staff, no cybersecurity background required.
1 What is this system?
Security Onion is the monitoring system now watching over your office network and computers, 24 hours a day. Think of it as a security guard that never sleeps — it watches network traffic and computer activity, and tells you immediately if something looks suspicious.
It does not slow down your computers or your network. It works quietly in the background, listening to network traffic through a passive connection, and receiving activity reports from a small program (called an agent) installed on monitored computers.
What it does for you
- Watches for six specific kinds of suspicious activity (Section 9)
- Sends an instant alert to a Telegram group the moment something is detected
- Keeps a searchable record of activity, in case you need to investigate something later
- Gives your IT staff one dashboard to see everything and dig into details
2 How the system is set up
A reference for your IT staff — what's already in place, not a step-by-step reinstall guide. Setup was performed once by the deployment team; you shouldn't need to repeat it unless the server needs to be rebuilt entirely, which is specialist work best done with the deployment team's help (Section 15).
What's already installed and running
- Security Onion 2.4, in "standalone" mode — one server (the "manager") handles monitoring, storage, and the dashboard together.
- Zeek and Suricata — the two network-monitoring engines, watching traffic via a passive connection so they never sit in the path of your actual network traffic.
- Elasticsearch and Kibana — the storage and search engine underneath the dashboard (Section 5).
- Elastic Agent — the small program installed on individual computers to report activity back (Section 11).
- ElastAlert — watches for the five scenarios (Section 9) and sends the Telegram messages (Section 7).
What your IT staff can safely do
- Add new computers/agents to be monitored (Section 11)
- Create additional dashboard accounts for staff who need access
- Check overall system health from Administration/Grid (Section 13)
3 Logging in for the first time
Your IT/MIS staff will give you a web address, username, and password separately from this handbook — for security, login details are never printed in a shared document. Once you have those:
4 Finding your way around
The dashboard has a menu on the left. Here's what you'll use most:
Simplified layout — actual menu labels may look slightly different depending on the version installed.
The Alerts page, in more detail
This is where you'll spend most of your time. Each row shows a severity color, a short title, the time, and which computer or device was involved. Click any alert to see the recommended action written directly into it.
5 Accessing Kibana
Kibana is the more advanced search-and-visualization tool powering the technical side of your dashboard. Think of the main dashboard (Section 4) as the everyday front desk, and Kibana as the back-office archive room — everything the dashboard shows ultimately comes from data stored here.
Kibana is a genuinely technical tool — day-to-day use of your system only needs the main dashboard (Section 4). Kibana is here for when your IT staff needs to dig deeper.
6 Customizing dashboards in Kibana
If your IT staff wants a view tailored to a specific question ("how much traffic came from this one device this week?"), Kibana lets you build and save one.
7 Getting alerts on Telegram
Rather than requiring someone to watch the dashboard all day, alerts also arrive directly in a Telegram group — so your team is notified the moment something happens, even away from a computer.
8 Understanding severity
Every alert is labeled with one of three severity levels, so you can tell at a glance how urgently it needs attention.
Needs prompt attention. Could indicate an active attempt to break in or access something without authorization.
Worth checking when convenient. Often something unusual but not necessarily malicious — verify it.
Informational. Logged for visibility and recordkeeping; rarely needs immediate action.
Severity tells you how quickly to look at something — it doesn't automatically mean an attack happened. Many alerts, once checked, turn out to be normal activity that matched a pattern. That's expected: it means the system is watching closely.
9 The six things we watch for
Your system is tuned to detect six kinds of activity, chosen from the concerns your office raised during setup.
SSH/RDP Brute-Force Authentication Attempt
HighSomeone repeatedly trying different passwords to remotely log into a server — like trying every key on a keyring to open a lock.
Network Reconnaissance and Port Scanning
MediumA device systematically checking many connection points on another device — often the first step before a real intrusion attempt.
Unauthorized Workstation Access Attempt
HighRepeated failed attempts to log into or unlock an employee's computer at its own screen — could mean someone trying to access it without permission.
Unauthorized Removable Media & Data Exfiltration
MediumA USB drive or external storage device connected to a monitored computer — flagged because it's a common way sensitive data leaves an office undetected.
Phishing-Related Malicious Communication
MediumA computer connecting to an internet address already known for phishing or malware — detected by checking the destination address only, never by reading email content, to protect privacy.
New Device Connected to the Network
MediumA device — laptop, phone, printer, or anything else — connecting to your office network for the first time, whether by LAN cable or Wi-Fi. The system doesn't distinguish how it connected, only that it's an IP address it hasn't seen on the network in the past 7 days.
10 What to do when you get an alert
Follow this process for every alert, regardless of severity:
11 Adding a new computer to the system
Every computer that should be actively monitored (not just watched passively over the network) needs a small program called an "agent" installed on it. This walks your IT staff through adding one.
12 Looking up more detail
If a Telegram alert needs more investigation, log into the dashboard (Section 3) and go to Alerts (Section 4) to find the matching entry by its timestamp.
Clicking an alert shows additional technical detail meant for IT staff — which rule triggered it and the underlying recorded activity. If that looks unfamiliar, that's normal: this depth is for your IT/MIS team's investigation, not something every staff member needs to interpret.
13 Basic system health & maintenance
A few simple checks your IT staff can do periodically, without needing deep technical knowledge.
Checking overall health
- Go to Administration / Grid — it lists every part of the system with a status indicator (green/healthy is good, red/yellow needs attention).
- Confirm the number of "Healthy" agents matches the number of computers you expect monitored. A computer that's been off a long time may show offline — that's expected, not a problem.
If Telegram alerts stop arriving
Could mean genuinely quiet activity, or something stopped working. Check Administration/Grid for a red/unhealthy status first — that's the most common cause.
When to contact the deployment team instead of troubleshooting yourselves
- The dashboard is unreachable and restarting your computer/browser doesn't fix it
- An agent repeatedly fails to enroll even after double-checking the server address
- Anything touching the server's own network settings, firewall, or core configuration
14 Frequently asked questions
15 Getting help
For anything not covered here, or if something doesn't look right, reach out: