securityonion

Security Onion is a free and open Linux distribution designed for threat hunting, enterprise security monitoring, and log management. It bundles a comprehensive suite of security tools into a single cohesive platform with its own web-based interfaces. Key capabilities include: - **Security Onion Console (SOC)**: A unified web interface for analyzing security events, managing detection rules, investigating alerts, and handling case management across the entire grid. - **Intrusion Detection**: Network-based detection powered by Suricata, combined with host-based monitoring through Elastic Fleet and osquery for endpoint visibility. - **Network Metadata**: Rich network telemetry generated by Zeek (formerly Bro) or Suricata, providing detailed insights into protocols, connections, DNS, HTTP, and more. - **Full Packet Capture**: Automatic retention and analysis of raw network traffic via Suricata PCAP, enabling deep packet inspection and forensic review. - **Elastic Stack**: Centralized search and visualization backed by Elasticsearch, Logstash, and Kibana for log management and correlation. - **CyberChef**: Integrated cryptographic and encoding toolkit for analyzing captured data. The platform also offers Security Onion Pro with AI-driven insights (Onion AI) and enterprise-grade features for scaling operations. Cloud deployments are available through AWS, Azure, and Google Cloud marketplaces. Documentation, community support, and official training resources are available at the project website. The project welcomes community contributions following its CONTRIBUTING guidelines.