When the free Security Onion edition is enough and when Pro is worth buying
The free Security Onion edition is enough for a small or single-site deployment that has no central identity mandate and no encryption-at-rest or FIPS requirement. A SOC lead in that position can run the Console, Suricata, Zeek, Elastic Fleet and packet capture under the Elastic License 2.0 without a license key. Pro starts to earn its cost when one of four things becomes a written requirement: OIDC single sign-on into the Security Onion Console, FIPS mode or OS STIG compliance, LUKS data-at-rest encryption, or vendor response times and multi-manager oversight through Manager of Managers. Check each item against your auditor's requirement list and your identity architecture before you assume any of them applies.
Pro is a paid license sold on 1 to 5 year terms that do not renew automatically, and no prices are published. Ask Security Onion Solutions for a written quote that states how many nodes it covers (Pro licenses up to ten nodes, with node packs for more), what the initial response SLA and four-business-hour option cover, and whether the two free health checks and two offline update shipments per year apply to your airgap or connected setup. Treat the license as a recurring cost in your budget, and ask what happens at renewal, since the terms do not auto-renew.
The downside risk is smaller than many buyers assume. If a Pro license expires, the installation reverts to community Security Onion until the key is updated, and free users keep the features they use today. Plan the Pro-only controls with that in mind: an expired license removes the features it unlocked, such as OIDC login, so keep a documented local administrator path and test it before go-live. Confirm with the vendor exactly which settings change on reversion before you rely on any Pro control for an audit.
Which Security Onion features are free and which need Pro
This table compares the Security Onion community distribution with the paid Security Onion Pro license, row by row, for the features most teams ask about first. Rows marked Pro only require a license, and the release that introduced each Pro feature is noted where the documentation gives it. Confirm current entitlements with Security Onion Solutions before you plan around a specific feature.
| Capability | Security Onion (free) | Security Onion Pro (paid) |
|---|---|---|
| OIDC single sign-on to the Console | Not included | Included, added in 2.4.70 |
| LUKS disk encryption at rest | Not included | Included, added in 2.4.70 |
| FIPS mode and OS STIG compliance | Not included | Included, added in 2.4.70; confirm the target OS build with the vendor |
| External notifications | Not included | Included, added in 2.4.70 |
| Security Onion API | Not included | Included in Pro; confirm the release that added it for your version |
| Manager of Managers | Not included | Included, added in 2.4.150 |
| Reports | Not included | Included, added in 2.4.180 |
| MCP server | Not included | Included, added in 2.4.160 |
| Onion AI assistant | Not included | Included, added in 2.4.190 |
| Cases time tracking | Not included | Included, added in 2.4.70 |
| Suricata, Zeek and full packet capture | Included in the distribution | Included, same stack as the free edition |
| Elasticsearch and Elastic Agent | Included in the distribution | Included, same stack as the free edition |
| Professional support SLA | Community support only | Included; one-business-day initial response, four-business-hour option |
How licensing, support and updates differ between the two editions
Both editions run the same Security Onion codebase under the Elastic License 2.0, so the difference lies in what you pay for and who answers when something breaks. The cards below cover the license, the free support path, Pro's term and node limits, the response commitments, the health checks and airgap updates, what happens at expiry, and who sells the official services.
Shared codebase under ELv2
Both editions are built from the same Security Onion components, which are published under the Elastic License 2.0 (ELv2). ELv2 is source-available rather than OSI approved, and it forbids offering the software as a managed service. Pro is a commercial license for the same product, not a different open-source project, so the license question for a managed service provider stays the same in both editions. Ask counsel to confirm how ELv2 applies to your planned use before you deploy either one.
Free edition community support
The free edition has no vendor support contract attached to it. Questions go to the community channels and the documentation, and no response time is promised. Teams that need a committed response window, or a person accountable for a fix, should plan to buy Pro or a services engagement. Confirm the community channels you will rely on and write down who inside your team owns upgrades and troubleshooting.
Pro term and node limits
Pro is sold on 1 to 5 year terms that do not renew automatically, so a lapsed term needs an explicit renewal decision. A license covers up to ten Security Onion nodes, and additional node packs are bought separately. Pricing is not tied to the number of data sources, and no prices are published, so ask for the node count of your planned distributed layout, including receivers and sensors, before requesting a quote.
Response commitments in the Pro SLA
Pro includes a one-business-day initial response SLA, and a four-business-hour SLA is available as an option. The difference matters for a SOC that cannot wait a full business day to hear back about a stalled sensor or a broken manager. Ask the vendor to confirm in writing what counts as the start of the clock, which severity levels apply, and whether the four-hour option covers your time zone and holidays.
Health checks and airgap updates
Pro includes two free one-hour health checks per year, which are useful for reviewing a deployment before an audit or after a major change. Airgap deployments also receive up to two free offline update shipments per year. Sites without internet access depend on these shipments, because the soup tool updates from newer ISO media. Plan the shipment schedule and the staff who will apply each update before you commit to an airgap design.
Expiry and the official provider
If a Pro license expires, the installation reverts to community Security Onion until the key is updated, and existing free features keep working. Pro-only functions such as OIDC single sign-on, notifications and Manager of Managers would stop being available, so check which of them your SOC relies on before a term ends. Security Onion Solutions, LLC states it is the only official provider of hardware appliances, training and professional services for Security Onion.
What Pro adds for identity, encryption and compliance hardening
OIDC single sign-on is the Pro control that changes who can reach the Console and how fast access is removed. With OIDC authentication enabled, analysts sign in through your identity provider rather than local Console accounts, so group membership, MFA policy and account disablement follow your existing directory. Before you plan the rollout, confirm with your identity team which OIDC features your provider supports, how group claims map to Security Onion roles, and what happens to sessions and API access when an account is disabled. The Console is the sensitive surface here because it holds detections, case data and alert history.
LUKS data-at-rest encryption and FIPS mode address different regulatory questions, and both need planning before installation. LUKS encrypts the disks that hold indexed logs, packet captures and configuration, which matters for media loss, decommissioning and shared hosting. FIPS mode restricts the OS to validated cryptographic modules, and it is a configuration choice that affects which services and client software will connect. Ask whether your assessor expects FIPS validation of the modules themselves or only FIPS-mode operation, and test your collectors and browsers against FIPS mode in a non-production node first. Because LUKS is applied at install time, confirm with Security Onion Solutions how it interacts with your planned Distributed layout.
OS STIG compliance covers the operating system beneath Security Onion, not the monitoring workflow. STIG profiles set controls on account policy, logging, services, file permissions and cryptography on the underlying Linux host. They do not, by themselves, prove that your detections are tuned, that alerts are triaged or that retention meets your policy. Your team still owns the control narrative, the system security plan, the evidence of configuration and the exception process for any STIG item you cannot apply. DeployOpen can help prepare systems, configuration baselines and evidence for an assessment, but it does not issue audit reports or certifications; independent assessors and certification bodies make those determinations, so agree with your assessor early which evidence they will accept.
What drives the cost of each edition
Security Onion is free to download, but running it is not free: hardware, storage and staff time carry the cost. Security Onion Pro adds a paid license on top, and its price is not published, so the quote is where the decisions get made.
Free edition hardware floor
The community edition has a published minimum. A standalone node needs 4 CPU cores, 24 GB RAM and 200 GB storage, and Security Onion suggests 32 GB of RAM or more when monitoring even a small amount of network traffic. Hardware is a one-time purchase or a recurring cloud or data center cost, and it rises with traffic volume, retention and the number of nodes. Size the hardware against your actual throughput before you compare it with any license fee.
Distributed layout multiplies nodes
Security Onion recommends a distributed design for production: a manager, sensors and search nodes. Each added node is more hardware, more operating system patching and more capacity to monitor. Sensor nodes need 12 GB RAM and 2 NICs at minimum, and manager or search nodes need 16 GB RAM at minimum. Count nodes first, because Pro licensing is also priced per node.
Staff time to operate
For the free edition, most of the recurring cost is people: upgrades, rule tuning, index and disk management, backups and troubleshooting. Security Onion 2.4 reached end of life on October 1, 2026, so a 2.4 installation on another distribution will need a fresh install to reach 3.x. Estimate the hours your team will spend each month, then compare that figure with what a Pro support tier would cover.
Pro per-node license terms
Security Onion Pro is licensed per node on 1 to 5 year terms that do not renew automatically. It licenses up to ten nodes, and additional node packs can be bought. Because terms do not renew automatically, you must plan the renewal date, and you should confirm with the vendor what happens to the node count if the deployment shrinks mid-term. Pricing is not tied to the number of data sources, so a noisy network does not raise the license price on its own.
Support tier and response times
Pro includes a one-business-day initial response SLA, with a four-business-hour SLA available, plus two free one-hour health checks per year. Ask which tier your team needs for the hours your SOC works and whether the health checks are enough for your change rate. Support hours in the quote are a cost driver, because a faster response time usually costs more than a standard one.
Airgap and quote checklist
Airgap deployments can receive up to two free offline update shipments per year under Pro, and the community ISO already carries packages and rules for networks without internet access. Before requesting a quote, state the node count, the term length, the support tier, whether airgap updates are required, and any implementation scope you want DeployOpen to cover. Ask the vendor for the total license cost by term and for the cost of each additional node pack.
Moving from free Security Onion to Pro and back
This sequence takes a free Security Onion installation to Pro and checks each change before production relies on it. It also shows what happens when a license lapses, because the installation reverts to community Security Onion until the key is updated.
Confirm the current release line
Start by checking which Security Onion release you run and whether it is still supported. Security Onion 3.3.0 is the latest tagged release, published September 11, 2026 as hotfix 20260911, and Security Onion 2.4 reached end of life on October 1, 2026. Installations on 2.4 with Oracle Linux 9 can upgrade to 3 after moving full packet capture from Stenographer to Suricata, while other distributions need a fresh install, so plan that work before you license anything. Done when the running version, its support status and the upgrade path are recorded in the change request.
License the nodes you need
Size the Pro license to the Security Onion nodes in your design. Pro is sold on 1 to 5 year terms that do not renew automatically, licenses up to ten Security Onion nodes, and accepts additional node packs. Pricing is not tied to the number of data sources, and no prices are published, so ask for a written quote that states the node count, term, node packs and renewal handling. Done when the license key is issued and the licensed node count matches your deployment record.
Move to a supported target release
If the upgrade identified in the first step is needed, complete it in a test copy before touching production. Pro features first appeared in the 2.4 line at 2.4.70, and the Pro documentation lists later additions, so confirm the feature list against the exact release you plan to keep. On airgap networks, plan the update path from newer ISO media. Done when a test installation reports the target version, the Console loads for a test user and the release notes for that version have been reviewed by your team.
Apply the license key
Enter the license key by following the activation steps in the Security Onion Pro documentation. Confirm which nodes the key covers and check that each licensed node shows Pro status in the way the documentation describes. Record which node holds the key, because the expiry behavior tested later applies to the installation. Done when every node in scope reports its Pro status and the activation is logged with the key owner's name.
Enable OIDC single sign-on
Configure OIDC authentication for the Security Onion Console against your identity provider, following the Pro documentation. Keep a local administrator account that works when the identity provider is unavailable, and test that account before removing password access. Confirm the claims, redirect settings and group mapping with your identity team, since your environment will set these values. Done when a test user signs in through OIDC, the break-glass administrator signs in successfully, and both test results are recorded.
Set LUKS, FIPS and STIG options
Enable LUKS data-at-rest encryption, FIPS mode and OS STIG compliance as your assessment requires. Check in the Pro documentation and with your installer whether each setting applies to an existing installation or only to a fresh build, because that decides whether this step needs a rebuild. Test the hardened settings against your monitoring workflow, since the documentation does not promise compatibility with every custom integration. Done when a test node runs with the settings applied, a compliance scan result is archived and the node still ingests and alerts.
Test the license expiry path
In a test environment, let a test license lapse or simulate expiry, then observe the result. The Pro documentation says that when a Pro license expires, the installation reverts to community Security Onion until the license key is updated, and free users keep the existing features they use today. Confirm which Pro-only features stop, whether OIDC logins fall back to another method, and whether your saved configuration survives the reversion. Done when the observed behavior is written down and reviewed by the operations and security owners.
Plan the renewal or return to free
Decide in advance whether the installation will renew Pro, stay on community Security Onion or move to a different platform if the license lapses. Because Pro terms do not renew automatically, tie a reminder to the term stated in your quote and add the key update procedure to the runbook. Ask the vendor how a lapsed key is replaced and whether any configuration changes are needed on return. Done when the runbook names an owner, the renewal date and the rollback steps you tested in the previous step.
When the free edition is the better fit
For many teams the free edition is the right answer, and the fit is clearest for small security teams, labs, evaluations and single-sensor sites. If the deployment does not need central sign-on through OIDC, LUKS encryption at rest, FIPS mode or STIG compliance for the operating system, most of the Pro feature list will sit unused. In that case, the budget and the hours a team would spend on licensing and onboarding a Pro license are often better spent tuning the Suricata, Sigma and YARA detections that the Console already manages. Tuning is where a small team finds out whether its alerts are useful, so an analyst who reviews noisy rules, writes suppressions and sets thresholds gets more value from the free edition than from an extra console feature.
Manager of Managers only matters when there is more than one manager node. A single Distributed deployment with one manager, several sensors and search nodes does not need it, and a lab or evaluation with a Standalone or Import install does not either. Before buying, confirm how many manager nodes the design will actually have, and confirm with Security Onion Solutions how the per-node license count applies to that layout, since Pro licenses up to ten nodes with additional node packs available. Also note that the Pro documentation describes the free edition as continuing to work after a Pro license expires, so an evaluation can start on the community release without a commitment.
The free edition still needs an owner. Without a vendor response commitment, the team carries upgrades, patching and troubleshooting itself, and Security Onion 2.4 reached end of life on October 1, 2026, so any installation still on that line needs a plan to move to 3.x. Before choosing the free edition, confirm internally who will handle upgrades and who will answer when the manager goes down, because search nodes stop indexing when they cannot reach Redis. If no one can own those tasks, the professional support tier may be the cheaper decision, and the Pro page is the place to ask what its response SLA covers.
Questions buyers ask before choosing Security Onion Pro
What does Security Onion Pro cost, and why isn't a price shown?
Security Onion Pro is a paid license, and no prices are published on the Pro page, so the cost must be confirmed with Security Onion Solutions directly. The license is sold on 1 to 5 year terms that do not renew automatically, which means the recurring commitment is the term you choose and any node packs you add. Cost drivers are the number of licensed nodes, the term length, and the support tier, since the Pro page notes that pricing is not tied to the number of data sources. Ask for a quote that itemizes the base license, node packs, term and support level, and confirm whether renewal pricing is set in advance.
How many nodes does a Security Onion Pro license cover?
A Pro license covers up to ten Security Onion nodes, and additional node packs can be purchased when you need more. Map your planned layout before you buy: a distributed production design has a manager, sensors and search nodes, and each of those counts toward the node total. Confirm with the vendor how receiver nodes, evaluation or lab installs and any future sensors are counted, because the node count drives the price more than data volume does.
What happens to Security Onion when a Pro license expires?
When a Pro license expires, the installation reverts to community Security Onion until the license key is updated. Free users keep the features they use today, so a lapse does not remove the platform itself. The practical risk is that Pro-only capabilities such as OIDC single sign-on, FIPS and STIG hardening, notifications, Manager of Managers and Onion AI stop being active, so any process that depends on them needs a fallback. Ask the vendor how a lapse affects support entitlements and whether a renewal can be applied without reinstalling.
Can our own team upgrade Security Onion Pro without outside help?
Yes, the platform is designed to be upgraded by the operator, and the release notes and hotfixes are published for that purpose. The effort depends on your deployment: a standalone install is simpler to move than a distributed design with manager, search and sensor nodes. Security Onion 3.0.0 supports only Oracle Linux 9, and 2.4 installs on other distributions need a fresh install rather than an upgrade, so check your operating system before planning. Pro includes two free offline update shipments per year for airgap deployments, which affects how you schedule updates on isolated networks.
How much internal staff time do activation and hardening take?
No duration is published, so the honest answer is that the effort depends on your identity provider, your disk encryption plan and your compliance target. Enabling OIDC single sign-on needs an identity provider configured for the Console, LUKS encryption needs a decision on key handling and recovery, and FIPS and STIG settings change the operating system baseline. Each of these requires testing against your own monitoring workflows before cutover. Ask the vendor for the activation steps and any dependencies, and plan internal time for change control and rollback testing.
What would an external implementation partner scope for a Security Onion Pro rollout?
A partner's scope is set by written agreement before work starts, and DeployOpen works this way: scope, deliverables and timelines are agreed in writing. For a Pro rollout, the typical scope items are the deployment layout and node count, identity integration for the Console, disk encryption and key custody, hardening evidence for the controls your auditors ask about, backup and upgrade procedures, and documentation for your operators. Support retainers and continuous testing are available separately. Note that DeployOpen does not issue audit reports or certifications; independent auditors do that work. Ask for a fixed-scope proposal that lists which items are in and out.
What support does Security Onion Pro include, and what does the SLA promise?
Pro includes a one-business-day initial response SLA, with a four-business-hour SLA available, along with two free one-hour health checks per year. Those are the published terms, so confirm which tier your license includes and whether the four-hour response is priced separately. Ask the vendor what counts as a business day in your time zone and how health checks are scheduled, since these terms determine how quickly a production incident is answered.
What to confirm with Security Onion Solutions before buying
Treat the Pro feature list as a moving target and confirm it against the release you will actually run. Pro features have been added across the 2.4 line and carried forward into 3.x, so the features in the Pro documentation for one release may not match what a new install or upgrade delivers. Ask Security Onion Solutions for the written list of Pro features in the exact version you plan to deploy, and ask which of them depend on the Security Onion Console, the API or a specific node role. The answer decides whether OIDC single sign-on, LUKS encryption, notifications or Manager of Managers belong in your design at all, and it changes how much internal or partner work the rollout needs.
Confirm the hardware and operating system path before you price anything. Security Onion 3.0.0 supports only Oracle Linux 9, and the hardware documentation sets minimums per node role, with a standalone node needing 4 cores, 24 GB RAM, 200 GB storage and 2 NICs, and x86-64 processors only. If your sensors or search nodes run another distribution, a move to 3.x may mean a fresh install rather than an in-place upgrade, which changes the project plan. Ask for node pack counts that match your planned manager, search, sensor and receiver layout, and ask how the license is applied when a node is rebuilt or moved. Pro licenses cover up to ten nodes, so node count drives the commercial conversation as much as the feature list.
Get the support coverage, renewal and expiry terms in writing. Pro includes a one-business-day initial response SLA, with a four-business-hour SLA available, so confirm which tier applies to your time zone and which hours count as business hours. Ask whether the two free health checks and the two offline update shipments per year are tied to specific sites, and how many are left after a fixed-term license starts. Pro terms run one to five years and do not renew automatically, so ask for the renewal notice period and the price basis for renewal. Also confirm what happens to your installation at expiry: the documentation says it reverts to community Security Onion until the key is updated, so ask what you must do to keep your Pro configuration working during a lapse.
How DeployOpen scopes Security Onion deployments and hardening
Moving from free Security Onion to Pro is mostly a question of identity, hardening and support obligations inside your own network. The cards below show where DeployOpen typically fits, what each piece of work involves, and what to confirm before any scope is agreed.
Planning the deployment type
Choosing between Import, Evaluation, Standalone and Distributed is the first scoping decision, and it shapes every later step. Distributed, with a manager, sensor and search nodes, is the layout Security Onion recommends for production. DeployOpen plans node counts, network placement and sizing against your traffic and retention targets, and documents which node roles each site needs before hardware is ordered.
Sizing hardware to the node role
Minimum hardware differs by role, so a single figure for the whole estate is misleading. Standalone, manager, search and sensor nodes each have their own floor, and the documentation suggests more memory once you monitor real traffic. Ask DeployOpen to size each role against measured throughput, and confirm x86-64 support for every host before procurement.
Configuring OIDC single sign-on
OIDC single sign-on to the Console is one of the Pro features most teams need first. The work covers the identity provider registration, role mapping to Security Onion analyst roles, and testing break-glass access before cutover. Confirm with your identity team which provider and claims you will use, and confirm that your Pro license is active before enabling it.
Hardening FIPS, STIG and disk encryption
FIPS mode, OS STIG compliance and LUKS data-at-rest encryption change the operating system baseline, not only the application. Each one needs a tested build, a documented exception list and validation on every node type. DeployOpen can plan and implement the baseline and prepare evidence, but it does not issue certifications, so ask your assessor which artifacts they expect.
Detection tuning and rule governance
The Detections interface manages NIDS rules for Suricata, Sigma rules for ElastAlert and YARA rules for Strelka, with suppression and threshold tuning. Without a documented owner and change process, tuning drifts and alerts lose meaning. DeployOpen can define rule ownership, review cadence and suppression records, and hand them over in writing.
Airgap installs and offline updates
Where monitored networks have no internet access, the ISO carries packages and rule sets, and the soup tool updates from newer media. Pro adds offline update shipments for airgap deployments, but the number included per year and the shipment process should be confirmed in writing. DeployOpen plans the media transfer, update rhythm and validation steps for air-gapped sites.
Fixed-scope delivery and support retainers
Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, and a quote follows from the written scope. Ongoing support, upgrades and continuous testing are available as retainers, and DeployOpen is not an official Security Onion Solutions partner or reseller. Note that Security Onion Solutions states it is the only official provider of professional services, so confirm the boundary of Pro support against your scope.
