Community Support

Check Documentation First

Before posting for help, check to see if your question has already been answered in the Help or FAQ sections.


If at first you don’t see your post appear, it may have been queued for approval by the forum moderators. There is no need to re-submit your post. It will be reviewed and then approved if appropriate.


Please be courteous and respectful. Disrespectful messages can result in being banned from the forum.


Start a new discussion instead of replying to an old one

Please search the forum to see if you can find similar discussions that may help you. However, please do not reply to old discussions with your new issue. Instead, please start a new discussion and provide a hyperlink to the related discussion.

Avoid generic OS questions

Security Onion is based on a standard Linux distribution. In order to keep the signal-to-noise ratio as high as possible, the Security Onion forums should only be used for questions directly relating to Security Onion itself. If you have generic questions about Linux, you should search Google for other forums or relevant information.

Provide sufficient technical info

In order to be as effective and efficient as possible, please consider the following when posing your question/problem to the group:

Please include the following details where you can:

  • Exact version. ex. 2.3.0
  • Install source. Did you install from our Security Onion ISO image or did you perform a network installation?
  • If network install, did you install from CentOS 7 or Ubuntu 18.04?
  • Install type. ex. eval, standalone, forward node, search node, etc
  • Does so-status show all services running?
  • Do you get any failures when you run salt-call state.highstate from the node?
  • Explain your issue. For example: Installation fails when I select this series of options...


Once you’ve read and understand all of the above, you can post your question to the community support forum: