Security Onion
Free platform for threat hunting and security monitoring
Description
Enterprise security monitoring usually means separate products for intrusion detection, logging and traffic analysis that barely connect. Security Onion is a free, open Linux distribution for threat hunting, enterprise security monitoring and log management.
It includes interfaces for alerts, dashboards, hunting, PCAP, detections and case management, plus osquery, CyberChef, Elasticsearch, Suricata and Zeek.
Threat hunting:Search logs for anomalies.
Intrusion detection:Suricata and Zeek.
Logs:The Elastic stack.
Cases:Track response.
It includes interfaces for alerts, dashboards, hunting, PCAP, detections and case management, plus osquery, CyberChef, Elasticsearch, Suricata and Zeek.
Features
Threat hunting:Search logs for anomalies.
Intrusion detection:Suricata and Zeek.
Logs:The Elastic stack.
Cases:Track response.
