Celebrating 10 Years of Security Onion Solutions and Announcing Security Onion Pro!

From Doug Burks, Founder and CEO of Security Onion Solutions: 

There’s an old saying that it takes ten years to be an overnight success. Thanks to our customers and community for ten successful years of Security Onion Solutions as a company! We’re celebrating our “overnight success” by announcing Security Onion Pro!

History

Security Onion Solutions is celebrating ten years as a company and our free and open Security Onion platform recently celebrated fifteen years!

https://blog.securityonion.net/2024/06/on-this-day-in-2009-very-first-version.html

After releasing that first version of Security Onion in 2009, the community steadily grew and more and more folks started using Security Onion in production. Over time, enterprise organizations started asking for training and professional services. So on July 7, 2014, I announced Security Onion Solutions as the company to provide those services: 

Customers started asking for hardware appliances so we announced Security Onion Solutions appliances in 2018:

Customers then asked for cloud images so we started offering them in 2021:

We’ve continued to listen to feedback and today we’re excited to announce the next step in our journey!

Security Onion Pro

Our customers have been asking for enterprise features so we’ve spent the last few years building them! We first mentioned this back in 2022:

https://blog.securityonion.net/2022/08/security-onion-enterprise-features-and.html

If you're looking to get the most out of Security Onion in your enterprise, you should consider Security Onion Pro. The Pro license not only adds additional enterprise features, but also adds many additional benefits as well!

Here are some enterprise features and benefits available with a Security Onion Pro license as of today:

• Open ID Connect (OIDC)
  SOC supports single sign-on (SSO) authentication via OpenID Connect (OIDC) to one of several OIDC-compatible identity providers. For example, users can login to Security Onion using an Active Directory user, a GitHub user, a Google account, an Auth0 account, etc. 
• Data at Rest Encryption
  Storage-level encryption for data residing in your Security Onion grid.
• DoD Security Technical Implementation Guide (STIG) Compliance for the OS
  Automatically apply STIGs to your Grid using OpenSCAP.  For more information about STIGs, please see https://public.cyber.mil/stigs/.
• Federal Information Processing Standards (FIPS) Compliance for the OS
  Support for enabling FIPS during OS installation. For more information about FIPS, please see https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards.
• External Notifications in SOC
  The Detections module, specifically Sigma rules, can be enabled to send outbound notifications when alerts are generated. By default, no outbound notifications are enabled in a Security Onion installation. However, with the Pro license applied to a grid, notifications can be quickly configured via the Configuration screen.
• Time Tracking inside of Cases
  When adding a comment to a Case, you can also specify how many hours you spent working on that activity. You can then see the total time spent by all analysts in the Summary in the upper-right corner of the Case.
• Guaranteed Message Delivery
  If you need guaranteed message delivery, then you can enable Kafka which replaces Redis and Logstash on the Security Onion Manager node and Receiver nodes.
• Higher Priority Service Level Agreements (SLAs)
  Receive faster service with the one business day initial response SLA included with Security Onion Pro. A four-business-hour initial response SLA is also available. 
• Health Checks
  Security Onion Pro includes two free 1-hour Health Checks per year.
• Offline Update Service Shipments
  If you have an airgap deployment, we can ship two free offline updates per year when requested.
• Professional Services and Support
  For customers running Security Onion on their hardware or smaller SOS appliances, Security Onion Pro includes twenty hours of professional services and support time. Services include architecture planning, deployment, tuning, break/fix support, parsing, and other services around Security Onion. Additional hours packages are available.
• Included with larger hardware appliances
  Security Onion Pro is included with many of our larger hardware appliance models, such as the SOS SN7200, SOS SNNV, and SOS GoFast, at no additional charge. See our full appliance list at https://securityonion.com/hardware.
• Coverage for all the nodes in your Grid
  The base license includes licensing for up to ten nodes, with additional node packs available for purchase.

In addition to the list above, we will be adding more to Security Onion Pro in the future!

To learn more about Security Onion Pro, please see:

https://securityonion.com/pro

Community

Just because we’re adding enterprise features does not mean that we’re forgetting about our community! 

Our team worked for nine months on developing our new Detections interface and released the first version of that in 2.4.70:

https://blog.securityonion.net/2024/05/security-onion-2470-now-available.html

After release, we listened to feedback from the community about Detections and incorporated that feedback into 2.4.80:

https://blog.securityonion.net/2024/06/security-onion-2480-now-available.html

We have lots more improvements coming to the community version! It’s also important to note that existing community features will remain available to the community with no data limits and no evaluation period. Our continuing mission is to shift the advantage to defenders!

Thanks

Thanks again to our customers and community for your support throughout the years!

FAQ

What is Security Onion Pro?

Security Onion Pro includes all the features in our standard Security Onion platform and adds enterprise features and premium support.

What enterprise features are included in Security Onion Pro?

Security Onion Pro includes the following enterprise features:

• Open ID Connect (OIDC) authentication for Security Onion Console
• Data-at-Rest Encryption (LUKS)
• DoD Security Technical Implementation Guide (STIG) Compliance for the OS
• Federal Information Processing Standards (FIPS) Compliance for the OS
• External Notifications in Security Onion Console
• Time tracking inside of Cases
• Guaranteed Message Delivery (Kafka)

What kind of support is included in Security Onion Pro?

Security Onion Pro includes premium support:

• two free 1-hour health checks per year
• offline update service shipments
• architecture planning
• deployment
• tuning
• break/fix support
• parsing
• and other services around Security Onion

How do I purchase Security Onion Pro?

You can purchase Security Onion Pro by going to https://securityonion.com/pro and clicking the Purchase button to reach out to our Sales team.

If I purchase Security Onion Pro, do I have to rebuild my existing deployment?

In most cases, you can simply add the Security Onion Pro license key to your existing deployment to enable the enterprise features. An exception would be things like disk encryption that must be enabled during installation.

If I buy a Security Onion Solutions appliance, do I automatically get Security Onion Pro?

Security Onion Pro is included with many of our larger hardware appliance models, such as the SOS SN7200, SOS SNNV, and SOS GoFast, at no additional charge. See our full appliance list at https://securityonion.com/hardware.

If I am a free user and won’t be purchasing Security Onion Pro, will there be any changes?

No, you can continue using the existing Security Onion features that you use today.

How do I get more information about Security Onion Pro?

You can read more about Security Onion Pro at https://securityonion.com/pro. 

Security Onion Enterprise Features and Licensing

From Doug Burks, Founder and CEO of Security Onion Solutions:

I've been privileged to watch Security Onion grow as a security monitoring platform over the years. From its roots as a small software project in 2008, Security Onion has matured into a premier free solution for enterprise security monitoring, threat hunting, and log management for a global user base of all sizes and across all industry verticals. As our user and customer bases have grown, so too have the requests for enterprise features and licensing. The team at Security Onion Solutions continues to work with the community to shift advantage to defenders while growing an enterprise platform. 

Enterprise customers are asking for enterprise features and licensing and this requires significant time and effort to build the features and license key functionality. To prevent organizations from removing the license key functionality from the source code, we must change the license on the source code. We considered several options for changing the license, but introducing a new license would require more time and effort for our customers and community to understand the new license. We ultimately decided on Elastic License version 2 (ELv2) for the following reasons:

• It explicitly protects license key functionality.

• It is a known license and is already understood by our community.

• It has already been accepted by our users for the Elastic Stack components since the release of Security Onion 2.3.40 in March 2021:
  https://blog.securityonion.net/2021/03/security-onion-2340-now-available.html

Most of our users were not affected by the change to ELv2 in 2021. We expect most users will be similarly unaffected by moving Security Onion components to this license. 

You can read the ELv2 license in its entirety at:

https://www.elastic.co/licensing/elastic-license

We expect the license to go into effect upon release of Security Onion 2.4, anticipated in 2023.

Q&A

What is changing?

Security Onion components are changing license from GPL to Elastic License v2 (ELv2). This includes our active repos at https://github.com/Security-Onion-Solutions.

When is this change happening?

We expect this change to go into effect upon release of Security Onion 2.4, anticipated in 2023.

What changes are coming in Security Onion 2.4? The development focus for 2.4 is community features for the platform and the transition to ELv2 license.

Will there be paid features for Security Onion 2.4?

For the initial release of Security Onion 2.4.0, there are no planned paid features. We anticipate that later releases will add some paid features designed for enterprise customers.

I am a free community user. Can I use Security Onion 2.4 for free?

As long as you are adhering to the license, any free features in Security Onion 2.3 that carry over to Security Onion 2.4 will remain free.

I am a Managed Security Service Provider (MSSP) running Security Onion for my customers. How does this license change impact me? MSSP users who offer their services without customers accessing substantial portions of Security Onion functionality are not affected by this change. If you are a current Security Onion Solutions customer, please contact your account manager with questions.

What is ELv2?

ELv2 is the Elastic License version 2. You can read more about that at:

https://www.elastic.co/licensing/elastic-license

Is Security Onion owned by Elastic?

No, Security Onion is not owned by Elastic. Security Onion is simply adopting the ELv2 license. This is analogous to projects that use the Apache license but aren’t owned by the Apache Software Foundation.

Why did Security Onion choose the ELv2 license for its software?

Enterprise customers are asking for enterprise features and licensing and this requires significant time and effort to build the features and license key functionality. To prevent organizations from removing the license key functionality from the source code, we must change the license on the source code. We considered several options for changing the license, but introducing a new license would require more time and effort for our customers as many enterprise organizations must have software licenses reviewed by their legal departments. We ultimately decided on Elastic License version 2 (ELv2) for the following reasons:

• It explicitly protects license key functionality.

• It is a known license and is already understood by our community.

• It has already been accepted by our users for the Elastic Stack components since the release of Security Onion 2.3.40 in March 2021:
  https://blog.securityonion.net/2021/03/security-onion-2340-now-available.html

Has ELv2 been approved by the Open Source Initiative (OSI)?

No, ELv2 has not been approved by OSI as an open source license.

Can I continue to use 2.3 and not upgrade to 2.4? When we release Security Onion 2.4, we will announce an End Of Life (EOL) date for Security Onion 2.3.x. Security Onion 2.3.x will continue to receive security patches and priority bug fixes until it reaches EOL.

I am a current (paid) Security Onion Solutions customer and I have questions about this change. To whom should I reach out?

Please feel free to reach out to your account manager.

I am a community user of Security Onion and I have questions about this change. How may I ask those questions?

Please open a new discussion at https://securityonion.net/discuss.

UPDATE 2022/12/20 - changed 2.4 ETA to 2023