Security-Onion-Solutions/securityonion

Features

• Security Logging and SIEM - Implements a full security information and event management platform for aggregating and analyzing security event data.
• Network Security Monitoring - Functions as a comprehensive network security monitoring suite for capturing and analyzing traffic to detect malicious activity.
• Log Aggregators - Centralizes security event logs from diverse distributed sources into a unified searchable store.
• Full Packet Capture Systems - Provides a full packet capture system that records raw network traffic to disk for retrospective forensic analysis.
• Raw Packet Inspection - Enables the capture and inspection of raw network packets for detailed forensic investigation of security incidents.
• Incident Investigation Tools - Includes utilities for analyzing suspicious data and performing retrospective forensic analysis of raw packets.
• Unified Incident Investigation Consoles - Ships a unified web console that aggregates telemetry and alerts from networks and endpoints for centralized incident assessment.
• Intrusion Detection Systems - Implements intrusion detection systems that monitor network and system activity for malicious behavior.
• Investigation Case Management - Provides a dedicated system for organizing security investigations into tracked cases to group related events and detections.
• Security Logging Management - Provides security logging management to collect and index logs from diverse sources for analysis.
• Network Intrusion Detection - Identifies malicious network activity using signature-based detection and host-based monitoring systems.
• Signature-Based Threat Detectors - Uses signature-based threat detection to match network traffic patterns against databases of known malicious activity.
• Threat Hunting Workflows - Supports threat hunting workflows by searching forensic data with custom logic to uncover stealthy activity.
• Activity Monitors - Provides activity monitoring to collect and analyze network traffic and host system events for security visibility.
• Distributed Log Aggregation - Implements distributed log aggregation to collect and index security event logs from multiple remote sources.
• Security Event Monitoring - Offers tools for analyzing security events and searching system logs for malicious patterns via a unified console.
• Security Analysis Assistants - Incorporates artificial intelligence to accelerate the analysis and investigation of security data to find threats faster.
• Traffic Metadata Generation - Extracts high-level summaries of network connections to streamline the process of threat hunting.
• Endpoint Activity Monitoring - Includes endpoint activity monitoring to detect malicious processes and unauthorized changes on host systems.
• Network Traffic Analysis - Provides tools for recording raw network packets and extracting metadata for retrospective forensic analysis.
• Network Metadata Extraction - Extracts high-level summaries of network connections from raw packets to streamline proactive threat hunting.
• Security Lab Environments - Linux distribution for intrusion detection and enterprise security monitoring.

Star history