Security Onion Reviews

My main use case for Security Onion is monitoring components, including Zeek and Suricata, for training, as my environment runs on Proxmox and I use OpenSense as my firewall. I have also configured port mirroring on my Cisco switch to send network traffic for my lab VLANs to Security Onion for analysis.

Currently, I am taking my master's degree and have set up some victim VMs that I use for testing in my lab with Security Onion, and I am using it towards my thesis paper.

Although I do not use Security Onion at my actual job, it has definitely helped me learn how to look at alerts, understand what they mean, and how I can remedy the issues they cause when I get a SOC job eventually.

Security Onion has helped me analyze network traffic and better understand what is happening across my home lab. Since I have multiple VLANs separating my red team, blue team, and victim environments, I can use Security Onion to monitor traffic between systems and identify potentially suspicious activity. One of the biggest benefits is having Zeek and Suricata integrated into one platform. Zeek helps me examine network connections, DNS requests, and communication patterns. I also added a Pi-hole for DNS, and Suricata provides alerts for potentially malicious activity. It also helps me investigate why certain alerts are triggered instead of just seeing something suspicious happen. I can look at my network activity surrounding an event and better understand whether it might be a security concern or normal traffic. Overall, Security Onion has helped me develop my threat detection and network analysis skills. It is particularly useful because I can apply what I am learning in my graduate cybersecurity courses to a real hands-on lab environment.

What I appreciate most about Security Onion is that it combines multiple security monitoring tools into one platform. Rather than having to install and manage Zeek, Suricata, and other tools separately, I can work with them in a centralized environment. I also appreciate that it is free and open-source, making it accessible for people building cybersecurity labs.

Having everything in one place with Security Onion has definitely saved me time because it is one install and then everything is there, so I can learn everything all at once without having to have multiple things running at one time.

The biggest challenges I have experienced with Security Onion are the learning curve and resource requirements, as it is not necessarily something you can install and immediately understand without networking and Linux knowledge. I actually encountered an HTTP 500 error with the management interface recently, which required troubleshooting and expanding my storage, showing me how important storage planning and system maintenance are when running Security Onion.

What I would improve about Security Onion is probably the documentation around troubleshooting common issues, particularly storage management, and making the interface more approachable for new users.

Having documentation of what works best would help, especially since you can have nodes or have it all built-in one as a standalone. If you use nodes, you have to have several different Security Onion instances downloaded, then have a manager and connect all of them together.

I have been using Security Onion in my personal cybersecurity lab to learn more about network security, monitoring, intrusion detection, and threat analysis for about two years.

In my experience, Security Onion is pretty stable, with the only significant issue being that I had to increase the storage, but other than that, it has been good.

I have not tested Security Onion's scalability yet, but it seems as though it would be pretty easy to expand. I am not sure if I would have to reinstall if I wanted to make nodes and a manager; I just have not tested it.

I have not used customer support for Security Onion; however, I have participated in some community resources, and it is pretty good because it has a large community that has been around for years, which helps.

I have not previously used a different solution before Security Onion.

I run Security Onion through private hardware on my server as a VM on several servers, specifically four, and it runs on my dedicated blue server where I host it myself.

I do not have any relevant metrics to share regarding return on investment, but I believe it has saved me time and since it is free, it has not cost me any money. I view it as a good learning tool.

I do not have a license for Security Onion since I have the free version, meaning it does not cost me anything. The setup cost was really just the hardware I had; nowadays hardware can be pretty expensive, but if you have it, you should run it with at least 24 gigs of RAM.

I did not evaluate other options before choosing Security Onion because I thought it would be the best one to learn, as it has everything built into it and can be used as a standalone.

I would rate Security Onion an eight out of ten, as I think it is pretty good.

I chose an eight because, as I mentioned, it takes a lot to get used to and learn, but I have not used anything else. Everything I have looked at suggests I should use Security Onion over something else first because it is good; it has everything together. Once you learn Security Onion, you can probably do most of the other things.

I cannot comment on Security Onion's AI capabilities as it is a Security Onion Pro feature that I have not tested, since I am only using the free edition.

From my experience using Security Onion in my home lab, the output from Zeek and Suricata is generally reliable, but it is important to understand what each tool is actually reporting. Zeek is particularly useful because it provides detailed information about network connections, DNS activity, and communication between devices, helping me understand what is happening across my different VLANs. Suricata is useful for detecting potential malicious activity through its detection rules, although not every alert indicates an actual security threat; false positives do occur. I think it is crucial to investigate alerts instead of automatically assuming they are accurate, as the reliability of the results depends heavily on how Security Onion is configured. For instance, if port mirroring is not configured correctly or if the system is dropping packets, the information being analyzed might be incomplete. Overall, I would say I trust Security Onion as a network monitoring and detection platform, though I would not rely solely on alerts to make security decisions. The best approach is to correlate Zeek's network activity logs with Suricata's alert logs and investigate the evidence before making a final determination.

My advice for others looking into using Security Onion is to have a solid understanding of networking fundamentals before diving in. You really need to grasp TCP/IP, VLANs, DNS, and how network traffic flows to make it much easier to understand what Security Onion is showing you. I would also recommend starting with a small lab environment instead of trying to monitor an entire network at once. That is what I have been doing with my Proxmox home lab, which has separate VLANs for my red team, blue team, and victim machines. Additionally, ensure you allocate enough hardware resources, particularly RAM, CPU, and storage, as I have faced a storage issue that caused my security interface to have faults. Learning Zeek and Suricata individually is important to understand the differences between network metadata and signature-based detection alerts. Do not assume every alert is a genuine threat; it is crucial to take the time to investigate the traffic and understand why an alert was generated. Primarily, I would tell beginners to be patient and take things one step at a time, as Security Onion has a learning curve but is a great platform for developing practical cybersecurity skills, especially if you are interested in working in a SOC or becoming a security analyst.

I also recommend generating controlled test traffic and verifying that Security Onion actually captures it because just because the dashboard is running does not mean your monitoring configuration is working correctly.

My overall rating for Security Onion is an eight out of ten.

I use Security Onion to view logs when students are working with different threats, as it has a dashboard that monitors logs, network traffic, and suspicious activities, which is the primary usage we employ.

The scenario I use for Security Onion in one of my classes is when we have a DDoS attack, and we start to monitor the DDoS attack under Security Onion to see if the network traffic related to the DDoS is coming to Security Onion and showing an alert or not.

One of the tools we regularly use through Security Onion is to show threats and suspicious activity by conducting port scanning and monitoring unusual connections, which allows students to identify red flags on Security Onion.

Security Onion has positively impacted my organization by enabling students to analyze logs, understand network traffic, comprehend intrusion detection, and utilize threat hunting and incident response skills in a practical environment, which are best practices we have implemented with the students.

Students find value in using this free tool because they can install Security Onion on their own network and practice with real threats, which aids their understanding of threats and teaches them how to prevent such incidents, leading to significant outcomes stemming from their experience with Security Onion.

One of the best features that Security Onion offers is that it is open source, free to install in a lab environment, and allows for monitoring network traffic and investigating potential attacks while integrating other tools such as Suricata, Zeek, and Elastic-based components that are useful for diving into the logs, along with its threat detection capabilities to see network activity, including port scans, unusual connections, and potential intrusion attempts.

Security Onion's threat detection feature is very useful, and its dashboard is also impressive, showing graphs and allowing me to set alerts to my email or search based on events.

The governance and security of Security Onion are good in terms of how I can investigate through logs and match them with various frameworks, benefiting from being open source when working with enterprise-level organizations.

The accuracy and reliability of output from Security Onion, which is a feature recently added, will be useful for detecting alerts and minimizing false positives during investigations.

One of the improvements for Security Onion could be to address the issue of many logs and false positive alerts by reducing the number of false positives, as storage management is very hard sometimes due to a lack of storage space for logs, and they could implement methods to expand storage. Additionally, the installation process is not always straightforward.

A specific guideline for helping beginners understand the detection and investigation features of Security Onion would be beneficial, and guides for the installation process can also be helpful.

My priority for improving Security Onion would be the user interface and its installation process.

I have been using Security Onion since 2018.

Security Onion is stable.

Security Onion is quite scalable in terms of adding to other products and expanding functionality, making it a very scalable product.

I have not used customer support, as I have been using the free version.

I only use Security Onion for my students, and throughout my teaching, I have not used any other solution.

The installation process for Security Onion is very hard; if you do not know the Linux operating system and security monitoring tools very well, it is not going to be easy, and it is resource-intensive, requiring good CPU, memory, and storage for installation, which can be challenging for beginners.

With this kind of tool, students can save money by using open-source software while gaining experience in working with different logs and detection systems, leading to time savings during their studies.

I installed Security Onion as a free tool and did not utilize the licensed version.

I have considered other products such as Splunk, FORTISIEM, and QRadar while I used to work with QRadar, and I find Splunk to be a strong competitor due to its straightforward installation and very graphical user interface.

I advise others looking into using Security Onion to set up a test environment to understand how it works and to explore its features, which helps in learning how to investigate logs and integrate additional tools before deploying it in a real environment. I rate Security Onion an eight out of ten because, among other competitors, Security Onion being open source provides an excellent learning opportunity for beginners to understand logs, detection, and investigation processes, leading to good outcomes in their skills development.

Security Onion is primarily used for network security monitoring, threat detection, log management, and centralized visibility across our infrastructure, serving as the primary means for our organization.

Security Onion is used in our organization by continuously leveraging the Linux platform, Linux system, and network-based architecture to monitor threat detections and log management systems, which has proven very helpful for our organization in terms of network security monitoring.

The most valuable features of Security Onion are its threat detection capabilities, centralized log management system, and network security monitoring.

Security Onion has positively impacted our organization by providing features such as log management and threat detection, alongside network security monitoring, which creates a significant impact in our environment, particularly in incident investigation support.

Security Onion can be made easier to set up initially, as it is somewhat difficult at the start, but once configured, it becomes a great tool to use.

I assigned a rating of eight out of ten because the initial setup requires documentation reading and planning, which could be improved to make it easier for first-time users.

I do not think of any other improvements for Security Onion.

I have been using Security Onion for approximately nine months.

Since using Security Onion, we have not faced any issues or downtime, which indicates it is very stable.

Under heavy workloads, Security Onion works very smoothly, although there are occasions when it slows down, but overall it performs exceptionally.

Security Onion is a highly scalable platform, making it suitable for medium to large-scale enterprises.

Customer support for Security Onion is very good; whenever issues arise, help is quick and documentation is well maintained.

I have not previously used any other solution and switched directly to using Security Onion from the start.

Security Onion can be made easier to set up initially, as it is somewhat difficult at the start, but once configured, it becomes a great tool to use.

I assigned a rating of eight out of ten because the initial setup requires documentation reading and planning, which could be improved to make it easier for first-time users.

Security Onion is handled by our team very effectively, as we manage issues and maintain updates whenever necessary.

For new team members, we provide reading materials and training on Security Onion platform usage after familiarizing them with basic tasks.

We handle incident response and investigation with Security Onion, where alerts indicate issues directly, leading our team to respond quickly and solve problems efficiently.

We achieve a return on investment through improved threat detection and faster incident response in log management and centralized visibility across the infrastructure.

Security Onion does not require any cost, as it is open-source and free.

Before choosing Security Onion, we evaluated alternatives such as Splunk Enterprise Security.

Security Onion is a completely open-source and free platform, making it a cost-effective solution that works smoothly and effectively for our organization.

Security Onion integrates well with our existing tools, primarily using Linux systems in our organization, allowing us to monitor logs and manage threat detection and operations in the public cloud effectively.

Security Onion is very helpful in meeting compliance requirements and supports regular standards for our environment.

I advise organizations that use Linux or have network security knowledge to consider Security Onion, as it satisfies requirements such as threat detection and log management systems.

I would rate this review eight out of ten.

The solution is used to learn how the tools work. It enables us to do consulting and demonstrate solutions. We develop attacks, detect them, and demonstrate how it works. The customers are interested in seeing how and what these tools can do.

We are only working with open-source products. The tool is very easy to install and easy to update. A lot of interfaces are specified. So, it's quite easy to make extensions. It is very important when we do experiments and try to connect and integrate other tools. Security Onion is the most mature solution in the open source world. This is its biggest advantage.

The product takes time to learn, it's not that easy. In the beginning we had a lot of questions. If you want to use such a tool in an real (industrial) environment, you have to ask how to get the network data. Can we do a full packet capture? Can we provide agents to our end systems? There are no simple solutions to these questions. It's a general problem when running such systems in an industrial environment.

I have been using the solution for about ten years. I am using the latest version.

There is a community. If we are active and ask people questions, we get answers. We also have the option to buy support for difficult problems.

We also use Malcolm. It is a similar platform. But it is not as mature as Security Onion. The system management features are not perfect and need to be improved.

The solution is partially in a real environment and partially in a virtual environment. The focus is on the OT environment. Our main focus is to deliver security in automation systems. It is very easy to set up.

It is an open-source solution. The vendor also sells a hardware solution (appliance) as a paid solution.

My advice depends on the requirements, network, and resources available in an organization. It also depends on whether someone is looking for a turnkey solution, whether they are interested in working alone, and what their skills are. There is no one solution for all installations. Overall, I rate the product a ten out of ten.

The most valuable feature of Security Onion for security monitoring is its ability to find infected ports. I have used the Squert tool within Security Onion the most for threat hunting.

The initial setup of the solution is a little bit difficult.

I have been using Security Onion for one year.

The solution’s technical support is good and responsive.

Neutral

On a scale from one to ten, where one is difficult and ten is easy, I rate the solution's initial setup a six out of ten.

Security Onion is an open-source solution.

On a scale from one to ten, where ten is expensive and one is cheap, I rate the solution's pricing a six out of ten.

Before choosing Security Onion, we evaluated Splunk. We chose Security Onion because it's a free and open-source solution.

Security Onion is deployed on the cloud in our organization. I would recommend the solution to other users.

Overall, I rate the solution a seven out of ten.

We use Security Onion for internal vulnerability assessment.

Security Onion's user interface could be improved. The solution's general reporting should be made simple and better-looking in terms of graphics so that we can update our senior management.

I have been using Security Onion for four years.

Security Onion is a stable solution, but we experience some crashes.

I rate Security Onion a six out of ten for stability.

Security Onion is a scalable solution, but some connected APIs are a bit difficult to integrate. Two people are using Security Onion in our organization.

I rate Security Onion a five out of ten for scalability.

We are part of the solution's blogging site, where we discuss with other people working on it so that we understand most things. Security Onion's blogging site or community forum helps us to resolve all our issues.

Security Onion's deployment needs to be a bit simple. Some explanations or jargon are a bit complicated and should be made simple enough to understand.

Security Onion is a free solution.

Security Onion is deployed on our established private cloud, which operates from our recovery site.

Security Onion does not need any maintenance.

You need to be skilled in order to use Security Onion.

Overall, I rate Security Onion a six out of ten.