Contributing - Building and Testing

[zfcarsonb]

Hi everyone,

I am interested in learning more about how Security Onion works under the hood, in hopes that I may be able to make contributions in the future. I am already pretty familiar with SO's salt repository, the pulling and pushing of Docker containers to the local registry and working with Bash and Go applications.

I'm primarily stumped with how I can build and test changes locally. For example:

• For salt repo-related changes, I could probably just apply them to a running cluster and see what happens, but I'm not sure this is the best way to perform tests.
• For code changes, such as a new feature in SOC, what is required to set up a testing environment?

Also, is there any documentation published to aid contributors in getting started?

Thanks!

[zfcarsonb]

Some examples of changes for which I would like to test and potentially create a pull request:

• Ability to submit files on-demand to Strelka, either by integrating the Strelka UI as a docker container, or by adding a button to SOC - probably on the Grid page next to the "Import PCAP" and "Import EVTX" buttons.
• Ability to match Detection rules by regular expression and apply overrides in bulk.
• Adding support for additional elastic integrations, or creating new ones.
• Improving Sigma support (e.g., "logsource.product"/"logsource.category" combinations)

[defensivedepth]

hey there @zfcarsonb !

I think the first thing to do is create separate feature requests for these/document them in some way. You don't want to go through the effort of putting together a PR and then finding out that either the functionality can't be accepted as-is or that we are already working on it, etc.

[zfcarsonb]

Thanks for the advice! And thank you to everyone at Security Onion Solutions for the hard work and dedication to making adversaries cry!