Getting Started

If you’re ready to get started with Security Onion, you may have questions like:

What are the recommended best practices?

See the Best Practices section.

How many machines do I need?

Depending on what you’re trying to do, you may need anywhere from one machine to thousands of machines. The Architecture section will help you decide.

What kind of hardware does each of those machines need?

This could be anything from a small virtual machine to a large rack mount server with lots of CPU cores, lots of RAM, and lots of storage. The Hardware Requirements section provides further details.

Which ISO image should I download?

You can download our Security Onion ISO image or a standard 64-bit CentOS 7 or Ubuntu 20.04 ISO image. We recommend our Security Onion ISO image for most use cases, but you should review the Partitioning, Release Notes, and Download sections for more information.

If I just want to try Security Onion in a virtual machine, how do I create a virtual machine?

See the VMware and VirtualBox sections.

How do I deploy Security Onion in the cloud?

See the AWS Cloud AMI and Azure Cloud Image sections.

What if I have trouble booting the ISO image?

Check out the Booting Issues section.

What if I’m on an airgap network?

Review the Airgap section.

Once I’ve booted the ISO image, how do I install it?

The Installation section has steps for our Security Onion ISO image and for standard CentOS 7 and Ubuntu 20.04 ISO images.

After installation, how do I configure Security Onion?

The Configuration section covers many different use cases.

Is there anything I need to do after configuration?

See the After Installation section.