GitHub Release: Security-Onion-Solutions/securityonion v3.4.0-20261102 (02.11.2026)

Download the ISO

https://github.com/Security-Onion-Solutions/securityonion/blob/4dc7f2d97c887eb9e2ad00c403b5b265b0cd333f/DOWNLOAD_AND_VERIFY_ISO.md

What's Changed

• Bump version from 3.3.0 to 3.4.0 by @TOoSmOotH in #16216


• /login is showing an nginx failure by @jertel in #16225


• fix location typo by @jertel in #16229


• filterEventFields by @coreyogburn in #16236


• Hotfix/3.3.0 by @TOoSmOotH in #16239


• Remove outdated HOTFIX version number by @TOoSmOotH in #16240


• stop Zeek gracefully preventing post-terminate logs by @m0duspwnens in #16242


• FIX: prevent so-sensor-clean runaway loop and concurrent instances by @m0duspwnens in #16243


• Fix/so minion install vars by @m0duspwnens in #16246


• FIX: suricata.fileinfo maps boolean gaps into long file.bytes.missing by @dougburks in #16249


• FIX: root-own /usr/sbin management scripts and the Salt default tree by @m0duspwnens in #16250


• Refactor for ESQL by @defensivedepth in #16247


• notification annotations by @jertel in #16251


• Isolate the Kratos admin API on a dedicated soauth docker network by @TOoSmOotH in #16221


• store in db by @jertel in #16252


• Fix config tree error from the docker.networks setting by @TOoSmOotH in #16253


• Fix user creation failing with a valid password by @TOoSmOotH in #16255


• upgrade whoislookup analyzer deps; notification annotations by @jertel in #16258


• FIX: Fleet scripts failing when endpoints-initial is missing by @reyesj2 in #16260


• Add openai_embeddings to the YAML configuration by @TOoSmOotH in #16262


• FIX: use /sbin/nologin for service accounts by @m0duspwnens in #16263


• Metric alarms and more NTF annotations by @jertel in #16264


• FIX: remove the docker socket from so-telegraf by @m0duspwnens in #16261


• resolve startup errors by @jertel in #16267


• Raise SOAI Sonnet default small context limit to 1M by @TOoSmOotH in #16266


• New Automation Fields by @coreyogburn in #16270


• review integration-defaults weird_integrations mappings, removed unus… by @reyesj2 in #16275


• support empty yaml files by @jertel in #16277


• Unified Automations by @coreyogburn in #16280


• upgrade docker 29.8.1 and containerd 2.3.6 by @m0duspwnens in #16286


• caseless for non-Defend sources by @defensivedepth in #16279


• EVTX Import cleanup by @defensivedepth in #16278


• Move Sigma pipelines into a managed directory by @defensivedepth in #16287


• Fix/auto apply state queue by @m0duspwnens in #16274


• Revert "Fix/auto apply state queue" by @m0duspwnens in #16297


• update tick interval desc by @jertel in #16300


• ES 9.4.8 by @reyesj2 in #16306


• new destination timeout annotation; fix fp by @jertel in #16310


• regenerate elastic agent installer by @reyesj2 in #16311


• Add allowExternalMarkdownImages SOC Setting by @mc-wright in #16312


• Map the AlertTriage and Notifier agents to a model by @TOoSmOotH in #16301


• Add Claude Haiku to the SOAI assistant models by @TOoSmOotH in #16315


• Initial Correlations support by @defensivedepth in #16269


• eval to use Suricata for metadata by @jertel in #16317


• remap enterprisesearch integration components by @reyesj2 in #16319


• combine default and availableModels added via pillar by @m0duspwnens in #16322


• Add a licensed Group By Assessment, Name alerts query by @TOoSmOotH in #16302


• Remove the Notifier agent mapping by @TOoSmOotH in #16323


• combine default and alerts queries added via pillar by @m0duspwnens in #16328


• Add readonly attribute to earliest alert time field by @TOoSmOotH in #16331


• Change readonly to readonlyUi in YAML configuration by @TOoSmOotH in #16332


• Automation Turn Timeout by @coreyogburn in #16333


• Refactor correlation template by @defensivedepth in #16335


• analyzer dep updates by @jertel in #16341


• Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir by @m0duspwnens in #16350


• fix false positive scan results by @jertel in #16351


• Add custom_bind_mounts to so-kafka and so-soc by @m0duspwnens in #16356


• Use the host CA trust store, with the grid CA, for all containers by @TOoSmOotH in #16357


• Remove unused elasticsearch.p12/sokeys keystore by @TOoSmOotH in #16354


• New Configurable Timeouts for Detection Engine Syncs by @coreyogburn in #16358


• switch analyzer deps to py 314 by @jertel in #16361

Full Changelog: 3.3.0-20260911...3.4.0-20261102