Community Community | Pro Pro | |
|---|---|---|
| Flexible Installation Options | ||
| Internet-connected and airgap | ||
| Alerting | ||
| Triggers host and network (NIDS) alerts and provides user interface with drilldown, acknowledgement, and escalation | ||
| Threat Hunting | ||
| Focused Hunt interface | ||
| Dashboards with Visualizations | ||
| Includes prebuilt and supports custom dashboards | ||
| Case Management | ||
| Escalate events and track observables | ||
| Analyzers | ||
| Gather context of observables | ||
| Detections | ||
| Import and manage Sigma, Suricata, and YARA rules | ||
| Audit Trail | ||
| Automatically capture case and detection change history | ||
| User Management | ||
| Includes Role-Based Access Control (RBAC) | ||
| Web-Based UI Configuration | ||
| Easily modify and customize grid configuration | ||
| Grid Management | ||
| Manage grid node membership within the SOC UI | ||
| Grid Monitoring | ||
| Monitor grid status and health | ||
| Grid Remote Control | ||
| Reboot nodes, import events, and more | ||
| Cyberchef Integration | ||
| Perform simple and complex data manipulation tasks quickly in a web browser | ||
| Packet Metadata | ||
| Parse and classify network traffic at OSI layers 3, 4, and 7 using Zeek or Suricata | ||
| Packet Capture (PCAP) Storage and Retrieval | ||
| View and download raw packet data using Stenographer or Suricata | ||
| Endpoint Monitoring | ||
| Monitor organization's entire digital footprint for software changes and much more | ||
| Fleet Integration | ||
| Monitor status of endpoints | ||
| Fully Scalable Deployments | ||
| Add new sensor and search nodes as your enterprise grows | ||
| Intrusion Detection Honeypots (IDH) | ||
| Build IDH nodes which mimic services and connect these nodes to your Security Onion grid | ||
| Mitre ATT&CK Navigator | ||
| Use the Navigator to visualize defensive coverage | ||
| Limited Live Response | ||
| Use osquery to collect data on the fly or on a schedule from your endpoints and servers | ||
| Playbooks and Guided Analysis | ||
| Guided Analysis leverages Playbooks to help you investigate alerts | ||
| Open ID Connect (OIDC) | ||
| SSO authentication to Security Onion Console (SOC) via popular OIDC providers | ||
| Data at Rest Encryption | ||
| Storage-level AES 256 encryption (LUKS) | ||
| Federal Information Processing Standards (FIPS) | ||
| Standardized security policy compliance for your enterprise | ||
| STIG Compliance for the OS | ||
| Strict organizational policy compliance for CAT 1 issues of the OS | ||
| Connect API | ||
| Integrate Security Onion with external systems for automating security processes | ||
| External Notifications | ||
| Quickly configure outbound notifications when alerts are generated | ||
| Time Tracking | ||
| Track time spent resolving cases | ||
| Guaranteed Message Delivery | ||
| Ensure all events and logs are recorded using Kafka | ||
| Active Query Management | ||
| View and cancel long-running Elastic queries | ||
| Manager of Managers (MoM) | ||
| Manage multiple grids from a single SOC login (additional licensing requirements may apply) | ||
| MCP Server | ||
| Interface your AI/LLM platform to your Security Onion grid, allowing AI to query alerts, playbooks, and more. | ||
| Onion AI Security Assistant | ||
| AI-powered security assistant for enhanced threat analysis and response | ||
| Splunk App | ||
| Automated, periodic ingest of Security Onion alerts into Splunk via the Security Onion Connect API. Security Onion Solutions does not provide support for this feature. | ||
| Hardware Virtualization | ||
| This feature is especially helpful if you want to optimize your hardware's potential and expand your Elastic performance and retention. Available on select hardware. | ||
| Reporting | ||
| Run built-in case or productivity reports, export SOC data to CSV files, and even create your own custom reports, or customize our built-in reports. | ||
| Enhanced SLA Options | ||
| Additional Service Level Agreements (SLAs) available | ||
| Professional Support | ||
| Professional services and email/phone/screenshare support hours included | ||
| Airgap Update Assistance | ||
| Physical media provided up to twice per year | ||
| Health Checks | ||
| Includes two health checks of your Security Onion grid per year | ||