Security Onion is a free and open‑source Linux distribution for network security monitoring, intrusion detection, log management, and threat hunting [web:50]. It bundles Suricata, Zeek, Wazuh, Elastic, Grafana and a full analyst web interface into a single deployable platform.
In this post we’ll install Security Onion 2.4 as a virtual machine, walk through the Setup wizard, enable the analyst web UI, and finish with concrete incident investigation workflows that show why every defender should have Security Onion in their lab or SOC.
◈ Table of Contents
Why Deploy Security Onion?
VALUE FOR DEFENDERSSecurity Onion turns commodity hardware or a simple hypervisor into a full‑stack detection and response platform, ideal for learning, blue‑teaming, or augmenting an existing SOC [web:50].
Deep Network Visibility
Suricata, Zeek and full packet capture give you IDS alerts, protocol metadata and PCAP for every interesting session.
Unified Analyst Console
Hunt, Dashboards, Cases, PCAP, Kibana and Grafana are integrated into one web interface for investigation and threat hunting.
Perfect for Labs
Ideal for home‑lab defenders learning detection engineering and SOC workflows using realistic tools and data.
Real Incident Response
Correlate alerts, logs and PCAP during an intrusion to reconstruct attacker behaviour and verify containment actions.
Phase 1 — Prerequisites & Sizing
BEFORE YOU INSTALLSecurity Onion can run bare‑metal or as a VM; for labs, a virtual machine is easiest. The project recommends generous resources, especially RAM, if you plan to run multiple sensors and tools on one box [web:50][web:53].
Typical all‑in‑one lab deployment (VirtualBox / ESXi):
- 1CPU: 2–4 vCPUs minimum, 4+ recommended for busy networks [web:53].
- 2RAM: 12GB recommended; 8GB works for light home labs but will trigger warnings during setup [web:53].
- 3Disk: 200GB+ virtual disk for OS and data; more if you want long‑term PCAP retention [web:53].
- 4NICs: at least 2 (Management + Monitor). Many labs use 3 to mirror internal/external segments [web:53].
- 5Virtualisation platform: VirtualBox, VMware ESXi, Proxmox/KVM or similar.
During Setup, Security Onion warns if you allocate fewer than 4 cores or 12GB RAM. For lab use you can accept the warnings and continue, but production sensors should meet or exceed their documented minimums [web:53].
Phase 2 — Download & Verify the ISO
SECURITY ONION ISOSecurity Onion provides a bootable ISO image; you verify its checksum, then boot it in a VM or on bare metal [web:50]. Always verify the download before booting.
◈ Download & Verify
- 1Browse to securityonion.net and click Download [web:50].
- 2Download the latest Security Onion 2.4 ISO to your workstation.
- 3On Linux/macOS, run
sha256sum securityonion-2.4.isoand compare with the checksum on the download page [web:50]. - 4On Windows, use
certutil -hashfile securityonion-2.4.iso SHA256or a GUI checksum tool.
Phase 3 — Create the VM
VIRTUALBOX / ESXIThe Medium lab guide uses Oracle VirtualBox, but the steps map cleanly to any hypervisor [web:53]. Here’s the VirtualBox workflow that most analysts use for a home lab.
◈ VM Creation
- 1Open VirtualBox and click New or press Ctrl+N [web:53].
- 2Name the VM
SecurityOnion, set Type = Linux and Version = Other Linux (64‑bit) or CentOS 7 (64‑bit) [web:53]. - 3Assign RAM (8–12GB depending on host capacity) and 2–4 vCPUs as described earlier [web:53].
- 4Create a VDI or VMDK virtual disk, dynamically allocated, at least 200GB in size [web:53].
- 5In VM Settings → Storage, attach the Security Onion ISO to the virtual optical drive.
- 6In Settings → Network, enable at least two adapters — Adapter 1 as NAT/bridged for management, Adapter 2 as Internal Network for monitoring [web:53].
Use a named NAT Network in VirtualBox for all your lab VMs. It avoids IP conflicts and simulates an internal lab subnet that Security Onion can monitor [web:53].
Phase 4 — Run the Security Onion Installer
BASE OSWith the VM created and ISO attached, you boot the installer, create the base OS, and then hand over to the Security Onion Setup utility [web:50][web:53].
◈ Installation Steps
- 1Start the VM; when the Security Onion boot menu appears, press Enter to start the installer [web:50][web:53].
- 2Accept the license prompts, then choose your language and keyboard layout.
- 3Set a strong password for the so user (or installer‑prompted admin account) and note it for later [web:53].
- 4Confirm disk partitioning — typically accept the guided defaults for lab installs.
- 5Begin installation; this copies the OS to disk and can take several minutes depending on disk performance [web:50].
- 6When prompted, press Enter to reboot and make sure the VM now boots from disk (detach the ISO or change boot order) [web:50].
- 7Log in with the username/password you created in the installer — the Security Onion Setup wizard will auto‑start on first login [web:50].
The official docs note that your hostname must be correct during installation; certificates are generated from it and changing hostname later isn’t supported [web:50]. Decide your hostname up front (e.g. so-sensor).
Phase 5 — Security Onion Setup Wizard
ROLE & SERVICES
After OS install, the so-setup utility configures Security Onion’s role
(standalone / manager / sensor), network interfaces, and key services [web:50][web:53].
If it doesn’t start automatically, you can run it manually.
$ sudo SecurityOnion/setup/so-setup iso
◈ Setup Wizard Flow (Eval / Lab)
- 1At the text‑based Setup prompt, answer Yes to continue and select Standard installation when asked [web:53].
- 2Choose EVAL license for lab use, type
AGREE, then press OK [web:53]. - 3When warned about fewer than 4 cores or 12GB RAM, you can accept and continue for lab purposes [web:53].
- 4Set the hostname (e.g.
seconion) and description (e.g.Security Onion VM) [web:53]. - 5Select the management NIC by pressing Space on the right interface and hitting Enter [web:53].
- 6Choose DHCP or manual IP for management; for labs DHCP is fine, but fixed IP makes web access predictable [web:53].
- 7Select monitoring interfaces for sniffing; in a simple lab pick the interface attached to your “LAN” or mirrored network [web:53].
- 8Choose direct internet access unless you need a proxy; configure OS patch schedule (auto is fine for lab) [web:53].
- 9Set NTP servers (defaults are fine) and confirm email alert address and password if prompted [web:53].
- 10Review the configuration summary; tab to Yes and press Enter to begin actual deployment [web:53].
The installer warns that enabling many additional services increases RAM usage. In a small lab, start with default service set; you can always enable extra components later when you understand the performance impact [web:53].
Phase 6 — Security Onion Desktop & Web UI
ANALYST EXPERIENCESecurity Onion 2.4 ships with an optional graphical desktop environment that you can use locally on the sensor, alongside the browser‑based analyst interface [web:60]. This is handy for all‑in‑one lab deployments.
◈ Desktop Access
- 1After Setup completes and the VM reboots, log in at the graphical login screen using your Security Onion user credentials [web:60].
- 2The desktop provides shortcuts to Security Onion Console (SOC), terminal, and system tools [web:60].
- 3From the desktop, open the SOC web interface in Firefox using
https://<SO-IP>.
For real SOC workflows, you’ll typically access the Security Onion web UI from a separate analyst workstation (like an Ubuntu Desktop VM), leaving the sensor headless in the background [web:53].
Phase 7 — Allow Analyst Access with so-allow
REMOTE UI ACCESS
Security Onion includes a helper script so-allow to safely open the web interface
and related services to specific IPs or ranges — perfect for granting access from an external
Ubuntu analyst desktop as in the Medium lab [web:53].
◈ Add Analyst Workstation
- 1From your analyst Ubuntu VM, run
ifconfig(after installingnet-tools) to note its IP, e.g.10.0.2.4[web:53]. - 2SSH into Security Onion or open a local terminal on it.
- 3Run
sudo so-allowand enter your password [web:53]. - 4Choose option a to add an Analyst IP, then enter the IP address of your Ubuntu desktop (e.g.
10.0.2.4) [web:53]. - 5From the Ubuntu browser, navigate to
https://<SecurityOnion-IP>(e.g.https://10.0.2.15) and log in to the SOC UI [web:53].
$ sudo so-allow
# Choose 'a' for Analyst and enter workstation IP when prompted
Only add trusted IPs with so-allow. Treat SOC access like any other high‑value admin interface; restrict it to your analyst machines and management networks [web:53].
Incident Investigation with Security Onion
SOC WORKFLOWSOnce logs, alerts and PCAP are flowing, Security Onion becomes your go‑to platform for incident triage, threat hunting and forensic reconstruction [web:53].
When a user clicks a phishing link, Security Onion lets you trace every HTTP request, DNS lookup and IDS alert around that event.
- 1In SOC, open Hunt and filter by the user’s workstation IP over the time window of interest.
- 2Pivot into Zeek HTTP and DNS logs to see domains contacted and URIs requested.
- 3Check Suricata alerts for exploit kit, malware or C2 signatures on the same flows.
- 4If deeper analysis is needed, export the associated PCAP from the PCAP interface and open it in Wireshark.
- 5Document domains, IPs and URIs and feed them into your IOC scanner / block lists.
After an initial compromise, attackers move laterally. Security Onion gives you the internal visibility to catch that pivot behaviour early.
- 1Filter Hunt queries for the compromised host IP as both source and destination to see who it talks to internally.
- 2Focus on SMB, RDP, WinRM and SSH protocol logs in Zeek.
- 3Correlate with host logs (if forwarding to Security Onion) to confirm logon types and account usage.
- 4Use the Cases app to track each potential pivot as its own investigation item.
Because Security Onion ships with rich rule sets and logs, it’s an ideal sandbox for tuning Suricata rules, Zeek scripts and alerts before pushing changes into production.
- 1Simulate an attack in your lab (e.g. known C2 or malware traffic) and observe which alerts fire in SOC.
- 2Identify gaps — missing alerts or noisy signatures — and adjust rule sets accordingly.
- 3Use Dashboards and Grafana to measure alert volume before/after tuning.
- 4Once you’re happy with signal‑to‑noise, port the tuned rules into your production tooling.
With this install complete, you now have a full‑featured network security monitoring and threat hunting stack running on commodity hardware. Pair it with your existing log sources and IOC workflows and you have an incredibly capable blue‑team lab environment.
For more depth, the official docs and training material from Security Onion Solutions are worth going through end‑to‑end — they cover multi‑node deployments, tuning and advanced hunting [web:50].
◈ Stay Connected
Follow CyberHawk Threat Intel for deployment guides, threat intelligence and hands‑on SOC tooling content.
"They can't exploit you if you are the Exploit."