If you’re ready to get started with Security Onion, you may have questions like:
What are the recommended best practices?
See the Best Practices section.
How many machines do I need?
Depending on what you’re trying to do, you may need anywhere from one machine to thousands of machines. The Architecture section will help you decide.
What kind of hardware does each of those machines need?
This could be anything from a small virtual machine to a large rack mount server with lots of CPU cores, lots of RAM, and lots of storage. The Hardware Requirements section provides further details.
Which ISO image should I download?
If I just want to try Security Onion in a virtual machine, how do I create a virtual machine?
How do I deploy Security Onion in the cloud?
What if I have trouble booting the ISO image?
Check out the Booting Issues section.
What if I’m on an airgap network?
Review the Airgap section.
Once I’ve booted the ISO image, how do I install it?
The Installation section has steps for our Security Onion ISO image and for other ISO images.
After installation, how do I configure Security Onion?
The Configuration section covers many different use cases.
Is there anything I need to do after configuration?
See the After Installation section.
- Best Practices
- Hardware Requirements
- CPU Architecture
- Minimum Specs
- Production Deployments
- Elastic Stack
- Standalone Deployments
- Manager node with local log storage and search
- Manager node with separate search nodes
- Search Node
- Forward Node (Sensor)
- Heavy Node (Sensor with Elasticsearch components)
- Receiver Node
- Intrusion Detection Honeypot (IDH) Node
- Sensor Hardware Considerations
- Operating System
- Booting Issues
- Amazon Cloud Image
- Azure Cloud Image
- Google Cloud Image
- After Installation