Security Onion: a Linux distribution for security monitoring

Security Onion (about 4,900 stars on GitHub) is a free and open platform for threat hunting, network security monitoring and log management, delivered as a Linux distribution. It was started in 2008 by Doug Burks as a collection of scripts on top of Ubuntu and is now developed by Security Onion Solutions, the company he founded, which funds the work through training, support and hardware appliances. The current generation, Security Onion 2, is built on Oracle Linux and manages its components with Salt and containers.

What it bundles

Rather than a single tool, Security Onion is an integration of many of the projects described in this encyclopedia. Suricata provides signature based network detection, Zeek produces protocol logs, and Stenographer keeps full packet capture for a configurable window. On the host side, the Elastic Agent collects logs from Windows and Linux endpoints and Elastic’s public detection rules run against them. Everything lands in Elasticsearch, and the project’s own web console, Security Onion Console, provides alert triage, a hunting interface, case management and dashboards, with Kibana available alongside. Sigma rules can be imported, and the platform includes CyberChef, a file analysis sandbox and other utilities an analyst needs during an investigation.

Who it is for

• Small security teams and IT departments that want enterprise style monitoring without assembling and tuning each component themselves.
• Students and instructors, since it is the standard lab platform in many network security courses.
• Organisations that need distributed sensors at several sites reporting to one central manager.
• Incident responders who need to deploy a sensor quickly during an engagement.

How to install it

The project publishes an ISO image that installs the operating system and all components. For evaluation choose the import or standalone mode, which runs everything on one machine; the documentation recommends at least sixteen gigabytes of memory and two network interfaces, one for management and one for sniffing. Download the ISO, verify its checksum, boot it in a virtual machine and follow the text based setup:

sha256sum securityonion-*.iso

Production deployments split the roles across manager, search and sensor nodes. The documentation describes each architecture, hardware sizing and the upgrade process in detail.

Credit

Security Onion was created by Doug Burks and is developed by the Security Onion Solutions team with a long standing community. The platform is released under the GNU General Public License version 2, while the bundled components keep their own licences; the Elastic Agent and Elasticsearch are used under the Elastic License and the project ships only the free features.