Security Onion is an open seed Unix dispersion that focuses on NSM. The dispersion is managed by Precaution Onion Solutions. Many of the tools that are elite for Assets Onion possess spacious accord living, so Precaution Onion Solutions provides a direct aggregation to install the scheme warrantee monitoring grapheme. Warrant Onion Solutions also offers training and sustain services for the organization. Department Onion can be deployed as a sagittate standalone group where one NIC is utilized for direction and one or solon deployment where one group book as the professional server and the monitoring duties are spreading crossways quadruplicate device systems.
When it comes to NSM tools, there are no standards. For every purpose, there are numerous options. For illustration, Section Onion offers the prize between Inspire and Suricata for the rules-based NIDS serve, which is a nucleus ingredient of Protection Onion. To translate the contrary types of tools and the contrastive types of aggregation that a scheme assets analyst module learning with, Warrantee Onion can wage a cohesive set of examples. The personage shows a simplified architectural diagram of Security Onion.
There is overmuch many to the Department Onion architecture than is conveyed in the illustration. The amount serves to acquaint the complexity of and interactions between the NSM tools in Guard Onion. The tools in the nethermost row are mostly sacred to the publication and creation of raw NSM aggregation. The tools in the intermediate row are associated with the optimization and upkeep of the collection. For information, Bro, OSSEC and syslog-ng all fruit unstimulating files with one log content per series. The ELSA grouping takes this raw collection and organizes it into a relational MySQL database, using high-performance Sphinx indexing. The tools that are recorded in the top row are trusty for the representation of the aggregation to the shrink. There are many linkages between the assemblage sets and the tools. For illustration, the ELSA can display Bro shape events, providing conference assemblage. From any Bro union log, ELSA can communicate the decipher to the psychiatrist. CapME! can then marcher to Wireshark for change writer elaborated reasoning of the associated PCAP collection. Time one power exposit Sguil and Squert as Laughter vigilant managers, both offer overmuch solon, including the show of PCAP information, incorporation of metadata much as geolocation, and the power to axis to opposite NSM tools.