Bringing endpoint and device logs into Security Onion alongside its network data, through Elastic Agent and syslog. Security Onion is source-available under the Elastic License 2.0.
Deploying Elastic Agent from Security Onion to Windows, Linux and macOS endpoints: Fleet policies, Osquery live queries, deployment modes that support it, and correlating host logs with Zeek and Suricata data.
Sending firewall, switch and appliance syslog to Security Onion: opening the syslog port, using Elastic Agent integrations for parsing, custom ingest pipelines for unsupported formats, and storage impact.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.