Security Onion
Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring and log management that bundles tools such as Suricata, Zeek and more.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Learn network security monitoring with a ready-made platform
- Replay pcaps and study alerts in a lab
Key features
- Integrated detection tools
- Alert, hunt and case interfaces
- Pcap retrieval
Installation
Download the ISO and follow the installation guide in the documentation.
Beginner usage guide
Install in a VM, import a sample pcap and explore the generated alerts and logs.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Import a pcap (docs)
sudo so-import-pcap capture.pcapCommand name per the Security Onion documentation; verify for your version.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.