What network security monitoring costs when you build, partner or buy SaaS
A security lead who needs sensor coverage across several sites has to decide who pays for sensor hardware, taps, storage, tuning and analyst time. The software itself is not the main line item. Suricata and Zeek are open source under GPL-2.0 and a BSD-style license, and the Security Onion repository is available under the Elastic License 2.0, which is source-available rather than OSI-approved. Read that license with counsel before you assume it fits a managed service or a redistribution model. The real costs are sensors and taps at each site, storage for full packet capture and metadata, the people who tune rules and triage alerts, and whether you buy Security Onion Pro, a paid subscription on 1 to 5 year terms that adds OIDC single sign-on, FIPS mode, OS STIG compliance and professional support.
The total depends on three variables: how many sites and network segments need a sensor, how much traffic each one carries, and how long you keep packet capture and metadata. Hardware is one-time for the sensor and recurs as you refresh it. Storage recurs because it grows with traffic and retention, so a longer retention window raises the cost every year. Tuning and triage are recurring staff effort that does not shrink on its own. For sizing, the Security Onion hardware documentation lists minimum specifications for standalone, manager, search and sensor nodes, but production sizing for your traffic is a separate exercise that a quote should include. Ask each bidder to state assumed link speeds, retention periods, number of sensors and the analyst hours behind tuning.
DeployOpen does not publish prices. A quote follows from a written scope that names sites, sensor count, tap or span design, retention, Security Onion edition, support hours and who operates the platform after go-live. Ask whether the price covers the hardware or only the labor, whether it includes Pro licensing, and which renewals recur. Compare three models on the same assumptions: running it in house, engaging a partner to build and hand over, or buying a managed NDR service that hosts the sensors and analytics for you. Each model moves cost between capital, subscription, and staff, so the comparison should be made on a five-year view that shows each cost as one-time or recurring.
Which cost components sit with you, a partner or a SaaS vendor
This table compares in-house, partner-led and managed NDR delivery across the main cost components of Security Onion, Suricata and Zeek monitoring. Read each row as a question of who buys the item, whether it is one-time or recurring, and what changes the bill. The main takeaway is that the sensor hardware and analyst time are often the largest lines, and a managed service moves ownership of them without removing the cost.
| Cost component | In-house build | Partner-led deployment | Managed NDR service |
|---|---|---|---|
| Sensor hardware and taps per site | One-time: you buy x86-64 sensors and taps. Minimum sensor is 4 cores, 12 GB RAM and 2 NICs (Security Onion hardware docs) | One-time: you usually still buy hardware, and the partner specifies it against your link speeds | Recurring or bundled: the vendor usually owns and refreshes sensors. Confirm who pays for taps and refresh cycles |
| Storage for packet capture and metadata | Recurring: you size and pay for disk growth. Minimum standalone node is 200 GB storage (Security Onion hardware docs) | One-time sizing plus recurring storage you own and operate | Recurring: priced by retention and volume. Ask how packet capture retention is billed |
| Initial deployment and design | One-time: internal engineering time for architecture, Distributed layout and testing | One-time: fixed-scope project fee, with scope agreed in writing before work starts | Often one-time onboarding plus recurring subscription. Confirm what onboarding covers |
| Analyst and tuning time | Recurring: your SOC staff review alerts, tune NIDS rules and manage suppressions | Recurring for your staff, plus optional retainer for tuning and rule updates | Recurring: partly included in the service. Confirm tuning scope, alert review hours and escalation paths |
| Security Onion Pro (if needed) | Recurring license on a 1 to 5 year term if you want OIDC SSO, FIPS mode or OS STIG compliance (Security Onion Pro page) | Recurring license you buy, with the partner handling configuration | Usually included or resold by the vendor. Confirm which Pro features are included |
| Support, upgrades and patching | Recurring: your team tracks releases and follows end-of-life dates, such as 2.4 end of life on October 1, 2026 (Security Onion EOL docs) | Recurring retainer for upgrades, testing and evidence, or one-time for a single upgrade project | Recurring: included in the subscription. Confirm upgrade windows for air-gapped or segmented zones |
| Who pays, in short | Your budget covers every line | You pay the partner for design and support, and still own hardware, storage and staff | You pay a subscription that bundles most lines, but data residency and retention costs still apply |
How sensor hardware, taps and site count set the base cost
Every monitored segment needs its own sensor with a tap or span port, and that hardware is usually the largest one-time cost in a network security monitoring build. Security Onion runs only on x86-64 processors. The published minimums for a sensor are 4 cores, 12 GB RAM and 2 NICs, while a standalone node needs 4 cores, 24 GB RAM, 200 GB of storage and 2 NICs. These are floors, not sizing advice. Budget lines also depend on whether you buy appliances, rent cloud instances for sensors that can see traffic, or reuse existing servers, and each option carries different costs for taps, cabling, rack space and support contracts.
The count multiplies quickly. Each site, each zone boundary you want to watch and each high-speed link adds a sensor, a tap or span configuration and a path for mirrored traffic. Link speed changes the hardware class of every sensor on that link, and redundancy doubles parts you would otherwise run once. Security Onion's recommended production design is Distributed, with a manager node, one or more sensor nodes and one or more search nodes. The architecture documentation also notes that search nodes stop indexing if they lose contact with the manager, and that receiver nodes add pipeline redundancy and load balancing. Each of those roles is a separate machine you must buy, power, patch and back up, so ask any partner to price the Distributed layout itself, not a single all-in-one box.
Confirm sensor count and sizing with a vendor-neutral traffic assessment before you request quotes. Ask for peak and average throughput per link, packet rates, the share of encrypted traffic, and the retention period you need for full packet capture. Ask whether the assessment covers tap versus span trade-offs and packet loss at peak. A quote built from site count alone will likely miss the sensors your busiest links need. Ask each bidder to state which hardware, taps and node roles their price includes, what they assume about link speed, and what changes if traffic grows after go-live.
What moves network monitoring cost up or down
Network monitoring cost follows the number of places you must watch, how much traffic those places carry, and how long you keep what you see. Tuning effort and Security Onion Pro licensing add recurring cost on top of the hardware, so ask every partner or vendor to price each driver separately.
Site and segment count
Each site or network segment that needs visibility usually needs its own tap or span point and a sensor, and a manager or search node may sit in a central location. More sites add hardware, rack space, cabling, remote access and install visits, and each site adds a recurring maintenance point. Ask for a sensor count per site, the placement method for each segment, and whether remote hands are included.
Sustained traffic and link speed
Sensor sizing follows the busiest sustained load, not average load, so faster links push you toward larger CPUs, more memory and more NICs. Peak bursts that cause packet loss create blind spots that you then pay to fix. Ask the partner which link speeds and peak rates the quote assumes, and whether the sizing includes headroom for growth.
Packet capture retention window
Full packet capture is usually the largest storage cost because it grows with traffic volume and the number of days you keep it. Shortening the retention window reduces disks and backup capacity, but limits how far back an investigation can reach. Ask for the retention period in days, the storage per day at your measured traffic, and whether backups of capture data are priced separately.
Metadata volume
Zeek logs and Suricata alert and flow records are smaller than packet capture but grow with connection count and the number of protocols you enable. Indexing that metadata in Elasticsearch takes search node capacity and storage that recur every month. Ask how the quote estimates daily metadata volume, which logs are enabled by default, and how long indexed metadata is kept.
Rule and detection tuning effort
Suricata rules, Sigma rules and YARA rules need continuous tuning to suppress noisy alerts in your environment, and that analyst time recurs for as long as the sensors run. Tuning is usually the largest ongoing labor cost after storage. Ask the partner how many hours of tuning the quote includes, who owns suppression decisions, and how rule updates are tested before they reach production.
Security Onion Pro features
Security Onion Pro is a paid edition sold on 1 to 5 year terms, and it adds OIDC single sign-on, LUKS data-at-rest encryption, FIPS mode, OS STIG compliance and professional support. Those features matter when your assessors or policies require them, and they become a recurring license line in the total cost. Ask which Pro features you need, the term length and renewal terms, and whether the quote includes the work to configure them.
Why packet capture storage becomes the recurring cost
Full packet capture is usually the largest recurring cost in a network security monitoring build, because it grows with the traffic each sensor sees and with how long you keep it. Security Onion 3.0.0 replaced Stenographer with Suricata for full packet capture, so the capture pipeline you size is the one Suricata runs, not a separate tool. The Security Onion hardware and architecture documentation covers node roles and sensor sizing, but it does not give a storage figure for your traffic. Treat any generic terabytes-per-day number as a placeholder until you measure your own peak and average throughput at each tap or span point.
Metadata adds a second, smaller stream that also accumulates. Zeek logs connections, DNS, HTTP, and protocol records, and Suricata writes alerts and flow data, all of which land in the Elastic-based search tier. Each of these stores is a separate line item to size, and metadata often has a longer useful life than raw packets, so it may need a different retention period. Ask your partner to report capture and metadata volumes separately in the sizing model, and to show what happens to index storage when a sensor is added or traffic grows.
Retention is set by policy or regulation, not by the tool, so storage cost is a recurring decision. Every extra day of packet capture adds disk, backup, and replication cost each month for as long as you keep it. Before you request a quote, confirm the retention periods your internal policy, contracts, and any applicable regulation require for packet data versus metadata, and ask for pricing at more than one retention option so you can see the cost curve. Also confirm who owns the storage, whether it sits in your data center or cloud account, and who pays for expansion when traffic rises.
When in-house, partner or managed NDR fits your team
Your team owns the whole lifecycle: sizing, sensor placement, rule selection, tuning, upgrades and triage. This suits organizations that already run a SOC with spare analyst capacity and engineers who can operate Linux, Elasticsearch-backed consoles and packet capture. The software cost is license-free for the open-source components, so most of the spend is people, hardware and storage.
- Staffing: Analyst and engineering hours for tuning, alert triage and on-call coverage recur every month and are usually the largest line item.
- Hardware and taps: Sensors, network taps or span ports, and storage for packet capture are one-time purchases with refresh cycles.
- Upgrades: Security Onion 2.4 reached end of life on October 1, 2026, so an in-house team must plan migrations on its own calendar.
- Data location: Packet captures and metadata stay in your data centers or cloud accounts, which helps with residency and air-gap requirements.
- Audit evidence: Your team holds the rule history, tuning records and alert review logs directly.
Confirm that you can staff review of alerts across all monitored zones before you commit to this model.
A partner plans, deploys and hardens the stack under a written, fixed scope, then hands it over with documentation and training. Retainer support can cover upgrades, rule maintenance and periodic reviews afterward. This suits teams that need a working deployment quickly but want to keep operating the platform themselves, or that want an outside party to design sensor placement across segmented zones.
- Fixed-scope deployment: The scope, sensor count, sites and deliverables are agreed in writing before work starts, which makes the cost of the build visible.
- Handover: Confirm that runbooks, tuning decisions and configuration are delivered to your staff, not held by the partner.
- Retainer support: Ongoing upgrades, rule updates and testing are priced separately and recur, so ask what is included each month.
- Data location: The platform still runs in your environment, so packet data and metadata remain under your control, including in air-gapped networks.
- Audit evidence: Ask who produces the configuration records and change logs and who keeps them after handover.
Check whether the partner's scope includes the air-gap update path and how Security Onion upgrades will be handled in each zone.
A vendor runs the sensors, the analytics and often the alert triage on a subscription. Your team receives findings and responds. This suits organizations with little monitoring staff or a need for 24/7 coverage they cannot build internally. The trade-off is less control over where data is processed, how rules are written and how long records remain available.
- Subscription cost: Fees recur, and they often scale with traffic volume, site count or sensor count, so request the pricing basis in writing.
- Data location: Confirm where packet metadata and captures are stored and processed, and whether that meets your residency rules.
- Air-gap needs: Most SaaS models depend on a connection to the vendor cloud, so confirm whether any offline option exists for isolated networks.
- Rules and tuning: You may have limited ability to change detection logic, which affects false positive control.
- Audit evidence: Ask what the vendor exports, how long it keeps logs, and whether you can obtain records for an assessment.
Identify the exact data your assessor will request and confirm the vendor can supply it in that format.
How to build your own network monitoring cost estimate
This sequence turns a vague budget question into a written estimate that separates one-time build costs from recurring operating costs, so build, partner and SaaS options can be compared on the same basis.
Inventory monitored segments and link speeds
The network team lists every segment, uplink and site that needs sensor coverage, with the link speed, the traffic direction and the points where a tap or span port is physically possible. Security and network engineers sign off the list together. You know this step is done when each monitored point has a site, a link speed, a tap or span method and an owner, and any segment where a tap cannot be installed is flagged for a separate decision. Sensor count and hardware cost follow directly from this list, so gaps here carry into every later line of the estimate.
Choose the Security Onion deployment type
The security lead compares the Security Onion deployment types (Import, Evaluation, Standalone and Distributed) against the inventory. Distributed, with a manager node, sensor nodes and search nodes, is the design the project documentation recommends for production, but it adds nodes that each need hardware, operating system work and patching. You know this step is done when the chosen type is recorded with a reason, the node count is known, and the cost lines for manager, search and sensor nodes can be written separately.
Size sensors and storage from measured traffic
The engineering team measures peak and average throughput on each monitored link for a representative period, then sizes sensor CPU, memory and NIC capacity against the published minimums and their own peak figures. Storage is sized separately for Suricata full packet capture and for Zeek and Suricata metadata, using the retention periods set by the compliance owner. You know this step is done when each sensor has a written hardware specification, a storage figure per retention period, and a note on who pays for disks, backup and replacement. Retention is usually the largest storage driver, so ask for it to be stated as a separate assumption.
Estimate analyst and tuning hours
The SOC manager estimates the hours needed to review alerts, tune NIDS rules, write suppressions and thresholds in the Security Onion Detections interface, and investigate sensor health issues. Staff who will do this work are named, and their time is split between one-time onboarding and recurring weekly operations. You know this step is done when there is a monthly hours figure per role, a one-time tuning period estimate, and a clear statement of whether the work is in house, partnered or bought as a service. Tuning hours are often underestimated, so treat them as a line item rather than an overhead.
Decide whether Security Onion Pro is needed
The security and compliance leads check the requirements that the paid Security Onion Pro edition adds, including OIDC single sign-on to the Console, LUKS data-at-rest encryption, FIPS mode, OS STIG compliance and professional support, against the controls the organization must evidence. The edition is sold on 1 to 5 year terms, so the decision adds a recurring subscription line. You know this step is done when the team has recorded yes or no with the specific requirement that drove the decision, and a quote for the chosen term is requested from the vendor.
Price the partner scope or SaaS subscription
Procurement requests written scopes from implementation partners and written quotes from managed NDR or SaaS providers, using the same inventory, sensor count, retention and hours assumptions from the earlier steps. Each quote must list the work or service included, what the client supplies, and what is excluded. You know this step is done when every option is priced against the same assumptions, and the differences in scope are documented, not just the totals. Partners and SaaS vendors should also confirm where packet data is stored and who can access it.
Add upgrade and support time for the release cycle
The platform owner plans the recurring effort to keep Security Onion, Suricata and Zeek current, including testing in a non-production environment, applying updates through the supported upgrade path, and tracking end-of-life dates in the vendor documentation. Security Onion 2.4 reached end of life on October 1, 2026, which shows why this line cannot be left out. You know this step is done when a yearly hours or cost line for upgrades and support is in the estimate, and the owner has confirmed which upgrade path applies to each node.
Compare written quotes with one-time and recurring lines separated
Finance and the security lead put every option into one table with separate rows for one-time costs (hardware, taps, implementation, initial tuning) and recurring costs (licensing or subscription, storage growth, staff hours, support and upgrades). Each vendor or partner is asked to split its quote the same way and to state the assumptions behind any figure. You know this step is done when each option has a complete one-time and recurring breakdown in writing, the assumptions are listed beside the totals, and the team can explain what would change the cost if traffic or retention changes.
Network monitoring cost questions buyers ask before hiring help
Does Suricata, Zeek or Security Onion cost anything to license?
Suricata and Zeek have no license fee for the software itself. Suricata is licensed under GPL-2.0 and Zeek under a BSD-style license from the Regents of the University of California, so you can run both without a subscription. Security Onion is different. Its repository is licensed under the Elastic License 2.0, which is source-available rather than OSI-approved, and it is free to use, but the paid Security Onion Pro edition is sold separately. Your real costs sit elsewhere: sensor hardware, taps or span ports, storage for packet capture and metadata, and the staff time to deploy, tune and run the stack. Read the license terms with your legal team before you build a product or service on top of the platform.
How long does a network monitoring rollout take?
No duration is fixed for this work, because it depends on the number of sites, the link speeds to be monitored, the deployment type and how much change control your network requires. A small single-site standalone deployment differs greatly from a distributed design with a manager, sensors and search nodes across several segments. Most engagements are fixed-scope, so the timeline is written into the scope document before work starts. Ask any partner for a written scope that lists the sensor locations, the systems in scope, the acceptance tests and the change windows they expect, then compare timelines against that scope rather than against a general estimate.
Can our own team run network security monitoring without a partner?
Your team can run it without a partner if it has Linux administration skills, network engineering access for tap and span design, and analysts who can review alerts and tune rules every week. Security Onion's Distributed deployment is the recommended production design, and its hardware minimums and architecture need planning before purchase. The practical risks are slow sensor placement decisions, packet loss at peak traffic, alert noise that buries real events and upgrades that lapse into end-of-life. Estimate your staff hours honestly, including on-call coverage, and decide which parts you will keep in house. A partner can cover the build and handover while your team keeps daily operations.
What does Security Onion Pro add, and how long is the contract?
Security Onion Pro is a paid edition sold on 1 to 5 year terms. It adds OIDC single sign-on to the Security Onion Console, LUKS data-at-rest encryption, FIPS mode, OS STIG compliance, the Security Onion API, external notifications, Manager of Managers, an MCP server, the Onion AI assistant and professional support. Compare these features with your identity provider, encryption standards and assessment obligations before you buy. Confirm current pricing and terms directly with Security Onion Solutions, because a quote depends on your node count and term length. Standalone Security Onion remains free to use without Pro, so Pro is a decision about specific features and support, not a requirement for monitoring.
What recurring work continues after go-live?
Monitoring is an ongoing service, so several costs recur after go-live:
- Rule and detection tuning, including suppressions and thresholds for NIDS rules managed in the Security Onion Console
- Platform upgrades and patches, plus testing in a staging environment
- Storage growth for packet capture and metadata, and retention reviews
- Analyst review of alerts, and periodic health checks on sensors and taps
- End-of-life moves: Security Onion 2.4 reached end of life on October 1, 2026, and installations on Oracle Linux 9 can upgrade to 3 after moving full packet capture from Stenographer to Suricata, while other distributions need a fresh install
Plan for these as an annual budget line, not a one-time project cost.
How do we compare a partner quote with a managed NDR subscription?
Put both options on the same basis: total cost over the period you will keep the system, with one-time and recurring costs listed separately. A partner quote for a self-hosted build usually covers design, deployment, tuning and handover, and you still pay for hardware, storage, licenses for any Pro features and internal staff. A SaaS subscription typically bundles the platform, storage and some monitoring service, but it may limit packet capture retention, data location and customization. Ask each vendor what is in scope, which data leaves your environment, how sensors reach air-gapped or segmented zones, and what happens at contract end. Ask for written assumptions for both options before comparing totals.
What drives the hardware and storage cost of each sensor site?
Cost per site rises with the traffic you must capture, the number of links you tap, and how long you keep data. Security Onion requires x86-64 processors, and its documented minimums are 4 cores, 12 GB RAM and 2 NICs for a sensor, 4 cores and 16 GB RAM for a manager or search node, and 24 GB RAM and 200 GB storage for a standalone node. These are floors, not sizing advice. Peak throughput, full packet capture retention, the protocol mix and the number of rules enabled all change the requirement. Ask your partner for a sizing worksheet that shows link speeds, retention days and the assumed storage growth per site, then check it against your own traffic measurements.
How upgrades and end-of-life dates change the budget
Budget upgrade windows as a recurring line item, not an afterthought. Security Onion 2.4 reached end of life on October 1, 2026, and 2.3 reached end of life on April 6, 2024. Any cost model built on a version that is already out of support will need a migration inside the first year of operation. The upgrade path depends on the operating system. Installations on Oracle Linux 9 can move to Security Onion 3 after full packet capture is switched from Stenographer to Suricata. Other distributions need a fresh install, which means new sensor builds, re-validated taps and re-tuned detections. Ask any partner to price the 2.4 to 3 path separately for each operating system in your estate.
Version churn creates labor that repeats for the life of the platform. Security Onion 3.0.0 was released on March 31, 2026, and the latest tagged release is 3.3.0, published September 11, 2026. Each migration consumes engineering time for testing, rule and dashboard review, and regression checks against sensor performance. If sensors must be rebuilt rather than updated in place, the hardware, rack time and change approvals become part of the cost too. Confirm with the vendor and your partner whether a given upgrade is in-place or a rebuild, because that single answer can change the budget by an order of magnitude. Also confirm the support status of the Oracle Linux release you plan to standardize on.
Air-gapped deployments add a planning step that connected sites skip. Security Onion's soup tool updates an airgapped installation from newer ISO media, so each upgrade depends on someone producing, approving, transferring and verifying that media. Budget for the media pipeline, the cross-domain transfer process and the time between a release and its arrival inside the enclave. Where rule sets also move across the gap, add that cycle to the same calendar. Schedule at least one upgrade window per year on paper, and ask your partner to show how a missed window will be handled before end of life.
How DeployOpen scopes and delivers a fixed-scope monitoring implementation
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For network security monitoring cost, that means agreeing in writing which sensors, taps, storage and analyst tasks are in scope, so the buyer can compare build, partner and managed options on the same basis before any money is committed.
How we scope
- Inventory the sites, tap or span points and link speeds that a monitoring design must cover.
- Agree in writing which sensor hardware, storage tiers and retention periods the quote includes.
- Document which parts are one-time build work and which are recurring tuning, upgrade and support work.
How we build
- Deploy Security Onion in the topology agreed in scope, with sensors, manager and search nodes in your environment.
- Load and tune Suricata and Zeek rule sets against your traffic, recording each suppression and threshold change.
- Test sensor coverage and alert paths, including packet loss checks at expected peak traffic, before handover.
How we hand over
- Provide architecture, sizing, runbook and upgrade documentation written for your own operations team.
- Walk through alert triage, detection management and retention settings with the staff who will run the platform.
- Record the evidence that compliance assessors commonly request for monitoring controls, without issuing any attestation.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer, scoped separately from the build.
- Plan Security Onion version upgrades and end-of-life moves into the retainer or a separate fixed-scope change.
- Confirm with your team which support hours, response paths and upgrade windows the retainer must cover.
