securityonion

Overview of securityonion

What it is

Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a suite of tools designed to work together to provide visibility into network and host activity. The platform is available for deployment in the AWS, Azure, and Google Cloud marketplaces. Security Onion Pro is also mentioned as an offering with additional capabilities such as Onion AI and enterprise features.

Key features

• Security Onion Console (SOC): a unified web interface for analyzing security events and managing your grid.
• Elastic Stack: powerful search backed by Elasticsearch.
• Intrusion Detection: network-based IDS with Suricata and host-based monitoring with Elastic Fleet.
• Network Metadata: detailed network metadata generated by Zeek or Suricata.
• Full Packet Capture: retain and analyze raw network traffic with Suricata PCAP.

Use cases

Security Onion is designed for threat hunting, enterprise security monitoring, and log management. It can be used to monitor network and host activity, detect intrusions, analyze network metadata, and retain and inspect full packet captures.

Getting started

The README provides resources for downloading the ISO, reviewing hardware requirements, following installation instructions, and checking release notes. No shell commands are listed in the README, so please see the repository README for details.

License and pricing

Security Onion is open source, with a pricing type of open_source. The README states that Security Onion is licensed under the terms of the license found in the LICENSE file. The metadata license identifier is NOASSERTION.

Based on the project's public README and repository metadata.