Community Community | Pro Pro | |
|---|---|---|
| Flexible Installation Options | ||
| Internet-connected and airgap | ||
| Alerting | ||
| Triggers host and network (NIDS) alerts and provides user interface with drilldown, acknowledgement, and escalation | ||
| Threat Hunting | ||
| Focused Hunt interface | ||
| Dashboards with Visualizations | ||
| Includes prebuilt and supports custom dashboards | ||
| Case Management | ||
| Escalate events and track observables | ||
| Analyzers | ||
| Gather context of observables | ||
| Detections | ||
| Import and manage Sigma, Suricata, and YARA rules | ||
| Audit Trail | ||
| Automatically capture case and detection change history | ||
| User Management | ||
| Includes Role-Based Access Control (RBAC) | ||
| Web-Based UI Configuration | ||
| Easily modify and customize grid configuration | ||
| Grid Management | ||
| Manage grid node membership within the SOC UI | ||
| Grid Monitoring | ||
| Monitor grid status and health | ||
| Grid Remote Control | ||
| Reboot nodes, import events, and more | ||
| Cyberchef Integration | ||
| Perform simple and complex data manipulation tasks quickly in a web browser | ||
| Packet Metadata | ||
| Parse and classify network traffic at OSI layers 3, 4, and 7 using Zeek or Suricata | ||
| Packet Capture (PCAP) Storage and Retrieval | ||
| View and download raw packet data using Stenographer or Suricata | ||
| Endpoint Monitoring | ||
| Monitor organization's entire digital footprint for software changes and much more | ||
| Fleet Integration | ||
| Monitor status of endpoints | ||
| Fully Scalable Deployments | ||
| Add new sensor and search nodes as your enterprise grows | ||
| Intrusion Detection Honeypots (IDH) | ||
| Build IDH nodes which mimic services and connect these nodes to your Security Onion grid | ||
| Mitre ATT&CK Navigator | ||
| Use the Navigator to visualize defensive coverage | ||
| Limited Live Response | ||
| Use osquery to collect data on the fly or on a schedule from your endpoints and servers | ||
| Open ID Connect (OIDC) | ||
| SSO authentication via popular OIDC providers | ||
| Data at Rest Encryption | ||
| Storage-level AES 256 encryption (LUKS) | ||
| Federal Information Processing Standards (FIPS) | ||
| Standardized security policy compliance for your enterprise | ||
| STIG Compliance for the OS | ||
| Strict organizational policy compliance for CAT 1 issues of the OS | ||
| External Notifications | ||
| Quickly configure outbound notifications when alerts are generated | ||
| Time Tracking | ||
| Track time spent resolving cases | ||
| Guaranteed Message Delivery | ||
| Ensure all events and logs are recorded using Kafka | ||
| Enhanced SLA Options | ||
| Additional Service Level Agreements (SLAs) available | ||
| Professional Support | ||
| Professional services and email/phone/screenshare support hours included | ||
| Airgap Update Assistance | ||
| Physical media provided up to twice per year | ||
| Health Checks | ||
| Includes two health checks of your Security Onion grid per year | ||