Getting Started

If you’re ready to get started with Security Onion, you may have questions like:

How many machines do I need?

Depending on what you’re trying to do, you may need anywhere from one machine to thousands of machines. The Architecture section will help you decide.

What kind of hardware does each of those machines need?

This could be anything from a small virtual machine to a large rack mount server with lots of CPU cores, lots of RAM, and lots of storage. The Hardware Requirements section provides further details.

Which ISO image should I download?

You can download our Security Onion ISO image or a standard CentOS 7 or Ubuntu 18.04 ISO image. We recommend our Security Onion ISO image for most use cases, but you should review the Partitioning, Release Notes, and Download sections for more information.

If I just want to try Security Onion in a virtual machine, how do I create a virtual machine?

See the VMware and VirtualBox sections.

What if I have trouble booting the ISO image?

Check out the Booting Issues section.

What if I’m on an airgap network?

Review the Airgap section.

Once I’ve booted the ISO image, how do I install it?

The Installation section has steps for our Security Onion ISO image and for standard CentOS 7 and Ubuntu 18.04 ISO images.

After installation, how do I configure Security Onion?

The Configuration section covers many different use cases.

Is there anything I need to do after configuration?

See the After Installation section.