Security Onion is a free platform for threat hunting, enterprise security monitoring and log management. It ships a complete intrusion-detection and network-security-monitoring stack as one installable system: Suricata for signature-based detection, Zeek for protocol-level metadata, the Elastic stack for indexing, search and dashboards, osquery for endpoint visibility, and CyberChef for quick data surgery. On top of those it adds its own SOC console with Alerts, Hunt, Dashboards, Detections, Cases and PCAP modules, so a sensor, a search cluster and a hunting interface arrive together instead of being integrated by hand.

The project was started by Doug Burks in 2008, first released in 2009, and is now developed and maintained by Security Onion Solutions, LLC.

Key features

• Alerts and Detections — triage Suricata and Zeek detections, acknowledge, escalate and keep notes in one workflow.
• Hunt — search raw events, protocol metadata and full packet captures from a single query bar, then pivot from a hit into the PCAP that produced it.
• Dashboards — prebuilt Kibana dashboards for traffic, DNS, TLS, authentication and IDS activity, editable in place.
• PCAP — packet capture retention and retrieval, so an alert can be confirmed against the actual traffic rather than a log line.
• Cases — group alerts, notes and artefacts into an investigation record that survives shift changes.
• Bundled tooling — Kibana, Elastic Fleet, Osquery Manager, InfluxDB, CyberChef and Navigator are reachable straight from the console.
• Grid management — standalone or distributed deployment, with node roles (import, search, forward, manager), versions, disk and memory usage, and container health shown on one Grid page.
• Onion AI — an optional assistant for alert analysis and detection tuning; part of the commercial Pro offering, with local model support.

Why use it

Most blue teams end up maintaining a sensor, a broker, a search cluster and a dashboard tool as four separate projects, each with its own upgrade path and query language. Security Onion replaces that integration work with a single distribution: one installer, one console, one release cadence, and a documented path from a standalone VM to a multi-node grid. Detection content keeps its Elastic and Kibana heritage, so existing dashboards and queries still apply, while investigations become a first-class object instead of a folder of screenshots.

Use cases

• Home labs and small teams that want real NSM without building the stack themselves.
• Enterprise SOCs running a distributed grid with dedicated search and forward nodes.
• Incident response: pull the PCAP for an alert, then search the same events across the estate.
• Compliance and audit trails via retained logs, cases and documented detections.

Deployment and platforms

Security Onion installs on dedicated hardware or a virtual machine from an ISO image; Security Onion Solutions also publishes VM appliances and sells preconfigured hardware appliances. Internally, the platform runs its components as containers on a Linux host, which is why the Grid page reports container status rather than service units. The widely deployed line is the 2.4 series, and a 3.x line is in active development on the project’s default branch.

Licence

Source-available, not OSI-approved open source. The main Security Onion repository is published under the Elastic License 2.0 (ELv2). ELv2 lets you use, copy, modify and redistribute the software free of charge, but it does not allow you to provide it to others as a managed service, to circumvent licence-key functionality, or to remove licensing notices. Bundled third-party components such as Suricata and Zeek keep their own licences. Security Onion Solutions funds development by selling Pro subscriptions, appliances, training and support; the platform itself is free to download and run.

Alternatives

• Wazuh — open source SIEM and XDR platform (GPL-2.0).
• Suricata — the IDS/IPS engine Security Onion bundles, usable on its own.
• Zeek — standalone network security monitor and metadata generator.

See the rest of the directory in Security and Privacy.