Please see the :ref:`trouble-booting` section.
Please see the :ref:`installation` section.
We only support the English language at this time.
Please see the :ref:`soup` section.
Please see the :ref:`firewall` section.
Please see the :ref:`proxy` section.
No, we only support x86-64 (standard Intel/AMD 64-bit architectures). Please see the :ref:`hardware` section.
Please see the :ref:`passwords` section.
Please see the :ref:`adding-accounts` section.
Please see the :ref:`community-support` section.
Yes, we offer commercial support at https://securityonionsolutions.com.
No, Security Onion does not support blocking traffic. Most organizations have some sort of Next Generation Firewall (NGFW) with IPS features and that is the proper place for blocking to occur. Security Onion is designed to monitor the traffic that makes it through your firewall.
Please see the :ref:`tools` section.
Please see the :ref:`directory` section.
Please see the :ref:`timezones` section.
Please see the :ref:`timezones` section.
Security Onion records full packet capture to disk via :ref:`stenographer`.
Standard network connections to or from Security Onion are encrypted. This includes SSH, HTTPS, :ref:`elasticsearch` network queries, and :ref:`salt` minion traffic. Endpoint agent traffic is encrypted where supported. This includes the :ref:`elastic-agent` which supports encryption with additional configuration. SOC user account passwords are hashed via bcrypt in Kratos and you can read more about that at https://github.com/ory/kratos.
Please see the :ref:`email` section.
Please see the :ref:`bpf` section.
Please see the :ref:`bpf` section.
Please see the :ref:`bpf` section.
Please see the :ref:`firewall` section.
Please see the :ref:`new-disk` section.
back to top
Please see the :ref:`pcaps` section.
Please see the :ref:`ntp` section.
Security Onion automatically backs up some important configuration as described in the :ref:`backup` section. However, there is no automated data backup. Network Security Monitoring as a whole is considered "best effort". It is not a "mission critical" resource like a file server or web server. Since we're dealing with "big data" (potentially terabytes of full packet capture) of a transient nature, backing up the data would be prohibitively expensive. Most organizations don't do any data backups and instead just rebuild boxes when necessary.
Please see the :ref:`local-rules` section.
We understand the appeal of integrating with directory services like Active Directory and LDAP, but we typically recommend against joining any security infrastructure (including Security Onion) to directory services. The reason is that when you get an adversary inside your network, one of their first goals is going to be gaining access to that directory. If they get access to the directory, then they get access to everything connected to the directory. For that reason, we recommend that all security infrastructure (including Security Onion) be totally separate from directory services.