# Security Onion install runbook — VM 51017 (sectestbed lane)

> Ticket [#772](https://projects.knownelement.com/issues/772) · Lane index
> https://community.turnsys.com/t/297 · Provenance: plan from the security-lane
> merge (2026-09-04); VM + ISO staged by the OAM agent 2026-09-05.
> Human (Charles) drives the actual SO install per plan.

## Prepped state (2026-09-05, all on pfv-tsys5)

| item | value |
|---|---|
| VMID / name | 51017 / `sectestbed-securityonion` |
| sizing | 4 cores (host), 16 GB RAM, 200 GB disk (`local-nonprod`, thin) |
| NICs | net0 mgmt on vmbr0 · net1 sniffing on vmbr0 (**link_down** — connect to the SPAN/mirror source before install) |
| boot | disk first, falls through to the attached ISO while the disk is empty |
| autostart | **off** (lane rule: non-prod stays down across host reboots) |
| ISO | `securityonion-3.2.0-20260729.iso` attached as ide2, GPG-verified on the node against SO's published key `C804 A93D 36BE 0C73 3EA1 9644 7C10 60B7 FE50 7013` (sig + KEYS also saved beside the ISO) |
| guest agent | SO ships qemu-guest-agent in the image; confirm `qm agent 51017 ping` after install, install `qemu-guest-agent` if absent |

## Install steps (human)

1. `qm start 51017` (console via PVE noVNC).
2. SO 3.2.0 installer → **Standalone** deployment.
3. Follow the SO installer prompts (management iface = the DHCP/eth0 NIC;
   agree to the attack-surface reduction; set the SO admin account).
4. After first boot + setup completes: detach ide2 (`qm set 51017 --ide2 none,media=cdrom`)
   and set `--boot order=scsi0`.
5. Connect the sniffing path: attach net1 to the bridge that carries the
   mirrored traffic (OPNsense port mirror) — `qm set 51017 --net1 virtio,bridge=<span-bridge>`
   then `qm set 51017 --link_down 0` semantics via editing, or just attach and `qm start`.
6. Register the VM in GLPI + Uptime Kuma (ping monitor), and add the host to
   the KNELIAC inventory (`virtual_guests`).
7. Hook-ups owned by this lane (post-install): Wazuh/SO input matrix
   (README coverage matrix), OPNsense netflow (nprobe/netflow target =
   SO's Zeek/suricata + flow input), syslog routing decision (Wazuh vs SO
   Elastic ingest) — tracked in the README matrix.

## Rollback

VM is unregistered-from-nothing and dataless before install: destroy with
`qm destroy 51017` if the plan changes (ISO + sig remain staged on the node).