Skip to content
THREATWIRE

Security Onion

Platform for threat hunting and security monitoring

Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.

Source-availableElastic-2.0
Alternative toSplunk Enterprise SecurityMicrosoft SentinelDarktrace
Visit website View repository Docs
Homepage of Security Onion
Official website (securityonion.net), captured by ThreatWire.

What Security Onion does

Security Onion packages a full monitoring stack: network sensors running Suricata and Zeek, full packet capture, log collection from endpoints and a web console for alerts, hunting and case management. It is designed to be installed from an ISO or on a supported Linux distribution.

Its code is published under the Elastic License 2.0, so ThreatWire labels it source-available rather than open source. Security Onion Solutions offers support, training and appliances.

Key features

  • Suricata and Zeek network sensors
  • Full packet capture
  • Alert triage, hunting and case management console
  • Endpoint and log collection
  • Distributed deployment for large networks

Licence

Elastic-2.0 · Elastic License 2.0 · Source-available

The repository LICENSE file is the Elastic License 2.0, which is not an OSI-approved open-source licence.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION. Source-available means the code is public but the licence is not approved by the Open Source Initiative.

Security of Security Onion itself

2 published advisories for Security Onion in GitHub repository advisories. Keep the tool updated: security tools often run with broad access.

  • GHSA-pv78-459c-rmpmlow2021-03-01

    Security Onion 2 prior to 2.3.30 has incorrect permissions on /nsm/backup/

  • GHSA-h5v3-qxcr-8cfcCVE-2020-27985low2020-11-30

    Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration

Sources: GitHub repository advisories · checked 2026-10-20.

Categories and tags

SIEM, XDR and log managementIDS, IPS and network monitoringDigital forensics and incident response#nsm#threat-hunting#siem#distribution#case-management#cyber-security#endpoint-security#information-security#intrusion-detection-system#monitoring

Related tools

  • Zeek

    Network security monitoring and traffic analysis framework

    Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.

    Stars
    8.1k
    Forks
    1.4k
    Last commit
    today
    BSD-3-ClauseOpen sourceIDS, IPS and network monitoring
    Alternative toDarktrace

  • Wireshark

    Network protocol analyser

    The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.

    Stars
    10k
    Forks
    2.2k
    Last commit
    today
    GPL-2.0-onlyOpen sourceNetwork scanning and analysis

  • Suricata

    Network IDS, IPS and security monitoring engine

    High-performance network threat detection engine from the OISF: signature-based IDS/IPS, protocol logging and file extraction in one multi-threaded engine.

    Stars
    6.8k
    Forks
    1.8k
    Last commit
    today
    GPL-2.0-onlyOpen sourceIDS, IPS and network monitoring
    Alternative toDarktrace

  • Snort 3

    Rule-based network intrusion prevention system

    The next generation of the Snort IPS, maintained by Cisco Talos: multi-threaded, with a new rule parser and Lua-based configuration.

    Stars
    3.4k
    Forks
    691
    Last commit
    5 months ago
    GPL-2.0-onlyOpen sourceIDS, IPS and network monitoring
    Alternative toDarktrace
Share on X@threatwire_https://www.threatwire.tech/tools/security-onion