awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
Security-Onion-Solutions avatar

Security-Onion-Solutions/securityonion

0
View on GitHub↗

Securityonion

Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring.

The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from diverse sources.

The system covers a broad range of security operations, including security incident investigation, threat hunting workflows, and security log aggregation. It utilizes a unified web console to analyze security events and alerts, and incorporates artificial intelligence to assist in the investigation of security data.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI
securityonion.net
↗

Features

  • Security Logging and SIEM - Implements a full security information and event management platform for aggregating and analyzing security event data.
  • Network Security Monitoring - Functions as a comprehensive network security monitoring suite for capturing and analyzing traffic to detect malicious activity.
  • Log Aggregators - Centralizes security event logs from diverse distributed sources into a unified searchable store.
  • Full Packet Capture Systems - Provides a full packet capture system that records raw network traffic to disk for retrospective forensic analysis.
  • Raw Packet Inspection - Enables the capture and inspection of raw network packets for detailed forensic investigation of security incidents.
  • Incident Investigation Tools - Includes utilities for analyzing suspicious data and performing retrospective forensic analysis of raw packets.
  • Unified Incident Investigation Consoles - Ships a unified web console that aggregates telemetry and alerts from networks and endpoints for centralized incident assessment.
  • Intrusion Detection Systems - Implements intrusion detection systems that monitor network and system activity for malicious behavior.
  • Investigation Case Management - Provides a dedicated system for organizing security investigations into tracked cases to group related events and detections.
  • Security Logging Management - Provides security logging management to collect and index logs from diverse sources for analysis.
  • Network Intrusion Detection - Identifies malicious network activity using signature-based detection and host-based monitoring systems.
  • Signature-Based Threat Detectors - Uses signature-based threat detection to match network traffic patterns against databases of known malicious activity.
  • Threat Hunting Workflows - Supports threat hunting workflows by searching forensic data with custom logic to uncover stealthy activity.
  • Activity Monitors - Provides activity monitoring to collect and analyze network traffic and host system events for security visibility.
  • Distributed Log Aggregation - Implements distributed log aggregation to collect and index security event logs from multiple remote sources.
  • Security Event Monitoring - Offers tools for analyzing security events and searching system logs for malicious patterns via a unified console.
  • Security Analysis Assistants - Incorporates artificial intelligence to accelerate the analysis and investigation of security data to find threats faster.
  • Traffic Metadata Generation - Extracts high-level summaries of network connections to streamline the process of threat hunting.
  • Endpoint Activity Monitoring - Includes endpoint activity monitoring to detect malicious processes and unauthorized changes on host systems.
  • Network Traffic Analysis - Provides tools for recording raw network packets and extracting metadata for retrospective forensic analysis.
  • Network Metadata Extraction - Extracts high-level summaries of network connections from raw packets to streamline proactive threat hunting.
  • Security Information and Event Management - Platform for threat hunting, monitoring, and log management.
  • Security Lab Environments - Linux distribution for intrusion detection and enterprise security monitoring.
4,661 stars·652 forks·Shell·35 views

Star history

Star history chart for security-onion-solutions/securityonionStar history chart for security-onion-solutions/securityonion

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does security-onion-solutions/securityonion do?

Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring.

What are the main features of security-onion-solutions/securityonion?

The main features of security-onion-solutions/securityonion are: Security Logging and SIEM, Network Security Monitoring, Log Aggregators, Full Packet Capture Systems, Raw Packet Inspection, Incident Investigation Tools, Unified Incident Investigation Consoles, Intrusion Detection Systems.

Which projects share features with security-onion-solutions/securityonion?

Projects with overlapping indexed features include: stamparm/maltrail — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network… comodosecurity/openedr — OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to… zeek/zeek — Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level… facebookarchive/scribe — Scribe is a distributed log aggregation system designed to collect and route real-time log data from numerous servers… oisf/suricata — Suricata is an open-source network intrusion detection and prevention engine that analyzes live network traffic in… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.…

Projects sharing features with Securityonion

These projects share indexed features with Securityonion. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • stamparm/maltrailstamparm avatar

    stamparm/maltrail

    8,498View on GitHub↗

    Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

    Pythonattack-detectionintrusion-detectionmalware
    View on GitHub↗8,498
  • comodosecurity/openedrComodoSecurity avatar

    ComodoSecurity/openedr

    2,603View on GitHub↗

    OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity. The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks. The platform provides capabi

    C++
    View on GitHub↗2,603
  • zeek/zeekzeek avatar

    zeek/zeek

    7,735View on GitHub↗

    Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity. The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous app

    C++brodfirndr
    View on GitHub↗7,735
  • facebookarchive/scribefacebookarchive avatar

    facebookarchive/scribe

    3,911View on GitHub↗

    Scribe is a distributed log aggregation system designed to collect and route real-time log data from numerous servers to centralized storage or analysis tools. It functions as a log data pipeline and scalable collector that gathers streaming data and writes it to local disks or remote endpoints. The system employs a log routing server model that organizes incoming streams into specific buckets based on predefined configuration mappings. It supports multi-hop log forwarding, allowing data to be routed through a chain of intermediate servers to centralize logs from diverse network segments. Re

    C++
    View on GitHub↗3,911
Compare all 30 related projects→