Security-Onion-Solutions/securityonion
Securityonion
Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring.
The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from diverse sources.
The system covers a broad range of security operations, including security incident investigation, threat hunting workflows, and security log aggregation. It utilizes a unified web console to analyze security events and alerts, and incorporates artificial intelligence to assist in the investigation of security data.
Features
- Security Logging and SIEM - Implements a full security information and event management platform for aggregating and analyzing security event data.
- Network Security Monitoring - Functions as a comprehensive network security monitoring suite for capturing and analyzing traffic to detect malicious activity.
- Log Aggregators - Centralizes security event logs from diverse distributed sources into a unified searchable store.
- Full Packet Capture Systems - Provides a full packet capture system that records raw network traffic to disk for retrospective forensic analysis.
- Raw Packet Inspection - Enables the capture and inspection of raw network packets for detailed forensic investigation of security incidents.
- Incident Investigation Tools - Includes utilities for analyzing suspicious data and performing retrospective forensic analysis of raw packets.
- Unified Incident Investigation Consoles - Ships a unified web console that aggregates telemetry and alerts from networks and endpoints for centralized incident assessment.
- Intrusion Detection Systems - Implements intrusion detection systems that monitor network and system activity for malicious behavior.
- Investigation Case Management - Provides a dedicated system for organizing security investigations into tracked cases to group related events and detections.
- Security Logging Management - Provides security logging management to collect and index logs from diverse sources for analysis.
- Network Intrusion Detection - Identifies malicious network activity using signature-based detection and host-based monitoring systems.
- Signature-Based Threat Detectors - Uses signature-based threat detection to match network traffic patterns against databases of known malicious activity.
- Threat Hunting Workflows - Supports threat hunting workflows by searching forensic data with custom logic to uncover stealthy activity.
- Activity Monitors - Provides activity monitoring to collect and analyze network traffic and host system events for security visibility.
- Distributed Log Aggregation - Implements distributed log aggregation to collect and index security event logs from multiple remote sources.
- Security Event Monitoring - Offers tools for analyzing security events and searching system logs for malicious patterns via a unified console.
- Security Analysis Assistants - Incorporates artificial intelligence to accelerate the analysis and investigation of security data to find threats faster.
- Traffic Metadata Generation - Extracts high-level summaries of network connections to streamline the process of threat hunting.
- Endpoint Activity Monitoring - Includes endpoint activity monitoring to detect malicious processes and unauthorized changes on host systems.
- Network Traffic Analysis - Provides tools for recording raw network packets and extracting metadata for retrospective forensic analysis.
- Network Metadata Extraction - Extracts high-level summaries of network connections from raw packets to streamline proactive threat hunting.
- Security Information and Event Management - Platform for threat hunting, monitoring, and log management.
- Security Lab Environments - Linux distribution for intrusion detection and enterprise security monitoring.
