Security Onion 3.2.0 Now Available with Agentic AI and Much More!

Security Onion 3.2.0 is now available and includes new features, updated components, and many quality of life improvements!

For a full screenshot tour, please see the First Time Users section of our documentation:

https://docs.securityonion.net/en/3/main/first-time-users

New Pro Features

• Initial implementation of agentic AI framework
• OnionAI added Gemma 4 31b as an option as a cost effective model

New Features

• Autodetect salt apply state from SOC config audit history
• Config audit history w/ restore
• Datastream Lifecycle Management
• Guided Analysis Progressive Loading #16091
• Limit certain config settings to specific node types #15972
• Map Antivirus Sigma rules to Elastic Defend #14468
• Sigma Playbooks - Initial Set #16090
• Support ES|QL in Sigma detections
• Support Suricata Transactional rule dir #15948
• Updated default Hunt query #16026

Updated Components

This release updates:

• alpine base images to 3.24.1 #15992
• Axios to 1.18.1 #15950
• CyberChef to 11.2.0 #15997
• Dompurify to 3.4.12 #15977
• Elasticsearch 9.3.7 #16063
• golang to 1.26.4 #15988
• InfluxDB to 2.9.1 (UI to 2.9.0) #15993
• js-yaml to 4.3.0 #15976
• Kafka to 4.3.1 #16001
• Kratos and Hydra google/x/net Go deps #16048
• Migration of more images to UBI 9.7 #16010
• nginx to 1.31.2 #15996
• node to 26.3.1 #15990
• OpenCanary to 0.9.8 #16003
• Oracle UEK8 Kernel
• Postgres to 17.10 #15998
• pySigma & sigma-cli #15616
• Redis to 7.4.9 #15994
• registry to 3.1.1 #15991
• SOC Go dependencies #16032
• Suricata to 8.0.6 #16042
• Telegraf to 1.39.0 #15995
• Zeek to 8.0.9 #16040

You can see major components and their version numbers in the Software Bill of Materials (SBOM) section of our documentation:

https://docs.securityonion.net/en/3/main/software-bill-of-materials/

Release Notes

There are many more improvements included in this release! For a complete list of all changes, please see the Release Notes:

https://docs.securityonion.net/en/3/main/release-notes#changes

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/3/main/release-notes#known-issues

About Security Onion

Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, and case management. 

For network visibility, we offer signature based detection via Suricata, rich protocol metadata and file extraction using your choice of either Zeek or Suricata, full packet capture, and file analysis. For host visibility, we offer the Elastic Agent which provides data collection, live queries via osquery, and centralized management using Elastic Fleet. Intrusion detection honeypots based on OpenCanary can be added to your deployment for even more enterprise visibility. All of these logs flow into Elasticsearch and we’ve built our own user interfaces for alerts, dashboards, threat hunting, case management, and grid management. 

Security Onion has been downloaded over 2 million times and is being used by security teams around the world to monitor and defend their enterprises. Our easy-to-use Setup wizard allows you to build a distributed grid for your enterprise in minutes!

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/3/main/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

New Installations

If this is your first time installing Security Onion, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/3/main/first-time-users

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/3/main/architecture

Existing 2.4 Installations

Security Onion 3 only supports Oracle Linux 9. If you are running Security Onion 2.4 on some other unsupported distro, then you will need to perform a fresh installation of Security Onion 3.

If you have an existing Security Onion 2.4 installation running on Oracle Linux 9, you can upgrade to Security Onion 3 as shown here:

https://docs.securityonion.net/en/3/main/appendix

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible.

2.4 EOL

Security Onion 2.4 will reach End Of Life (EOL) on October 1, 2026. If you are a Security Onion Solutions customer, please feel free to reach out to our Support team for assistance.

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Corey Ogburn
• Josh Patterson
• Mike Reeves
• Jorge Reyes
• Matthew Wright

Questions, Problems, and Feedback

If you have any questions or problems, please create a new Discussion at:

https://securityonion.net/discuss

Security Onion Pro

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonion.com/hardware

Cloud Installations

For new Security Onion 2 installations in the cloud, this new version will soon be available on the AWS, Azure, and GCP marketplaces!

AWS Marketplace and Documentation:

https://securityonion.net/aws/

https://docs.securityonion.net/en/3/main/cloud-amazon

Azure Marketplace and documentation:

https://securityonion.net/azure

https://docs.securityonion.net/en/3/main/cloud-azure

GCP Marketplace and documentation:

https://securityonion.net/google

https://docs.securityonion.net/en/3/main/cloud-google

Possible Software RAID Issue With Recent mdadm Package

We identified an issue with mdadm version "mdadm - v4.4 - 2024-11-07 - 4" that can cause software RAID issues after a reboot. We have removed this version and pushed a downgraded version "mdadm - v4.4 - 2024-11-07 - 2" to the Security Onion repo.

If you are not running software RAID, then you should not be affected at all.

If you are running software RAID, then you should check to see what version of the mdadm package is installed on all of your grid members to see if they need to be downgraded.

Please note that the following instructions assume that you installed using our official Security Onion ISO image. If you are using some other unsupported installation method, then your mileage may vary.

Check the existing mdadm version on all grid nodes:

sudo salt \* cmd.run 'mdadm --version'

If all grid nodes show version "mdadm - v4.4 - 2024-11-07 - 2", then you are running the correct version.

If one or more grid nodes have version "mdadm - v4.4 - 2024-11-07 - 4" then you need to downgrade mdadm:

sudo salt \* cmd.run 'echo y | dnf downgrade mdadm'

Once that completes, then verify the downgraded version on all nodes:

sudo salt \* cmd.run 'mdadm --version'

Security Onion 3.1.0 Now Available with Elastic 9.3.3, Suricata 8.0.5, Zeek 8.0.8, and much more!

Security Onion 3.1.0 is now available and includes new features, updated components, and many quality of life improvements!

For a full screenshot tour, please see the First Time Users section of our documentation:

https://docs.securityonion.net/en/3/main/first-time-users

New Features

Here are just a few of the new features in this release!

• Add bonded NIC support for management interfaces
• Simplified Onion AI setup for regions outside the US
• Onion AI support for Azure OpenAI endpoints

Updated Components

This release updates:

• CyberChef to 11.0.0
• Elastic to 9.3.3
• Kratos and Hydra to 26.2.0+pgx
• Nginx to 1.30.1
• SOC frontend 3rd party deps
• Suricata to 8.0.5
• Zeek to 8.0.8

You can see major components and their version numbers in the Software Bill of Materials (SBOM) section of our documentation:

https://docs.securityonion.net/en/3/main/software-bill-of-materials/

Security Issues

Sreejith Gopinath reported multiple security issues on April 26 and May 3. All validated findings have been resolved in this release. Thanks to Sreejith Gopinath for the responsible disclosure!

Release Notes

There are many more features and improvements included in this release! For a complete list of all changes, please see the Release Notes:

https://docs.securityonion.net/en/3/main/release-notes#changes

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/3/main/release-notes#known-issues

About Security Onion

Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, and case management. 

For network visibility, we offer signature based detection via Suricata, rich protocol metadata and file extraction using your choice of either Zeek or Suricata, full packet capture, and file analysis. For host visibility, we offer the Elastic Agent which provides data collection, live queries via osquery, and centralized management using Elastic Fleet. Intrusion detection honeypots based on OpenCanary can be added to your deployment for even more enterprise visibility. All of these logs flow into Elasticsearch and we’ve built our own user interfaces for alerts, dashboards, threat hunting, case management, and grid management. 

Security Onion has been downloaded over 2 million times and is being used by security teams around the world to monitor and defend their enterprises. Our easy-to-use Setup wizard allows you to build a distributed grid for your enterprise in minutes!

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/3/main/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

New Installations

If this is your first time installing Security Onion, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/3/main/first-time-users

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/3/main/architecture

Existing 2.4 Installations

Security Onion 3 only supports Oracle Linux 9. If you are running Security Onion 2.4 on some other unsupported distro, then you will need to perform a fresh installation of Security Onion 3.

If you have an existing Security Onion 2.4 installation running on Oracle Linux 9, you can upgrade to Security Onion 3 as shown here:

https://docs.securityonion.net/en/3/main/appendix

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible.

2.4 EOL

Security Onion 2.4 will reach End Of Life (EOL) on October 1, 2026. If you are a Security Onion Solutions customer, please feel free to reach out to our Support team for assistance.

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Corey Ogburn
• Josh Patterson
• Mike Reeves
• Jorge Reyes
• Matthew Wright

Questions, Problems, and Feedback

If you have any questions or problems, please create a new Discussion at:

https://securityonion.net/discuss

Security Onion Pro

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonion.com/hardware

Cloud Installations

For new Security Onion 2 installations in the cloud, this new version will soon be available on the AWS, Azure, and GCP marketplaces!

AWS Marketplace and Documentation:

https://securityonion.net/aws/

https://docs.securityonion.net/en/3/main/cloud-amazon

Azure Marketplace and documentation:

https://securityonion.net/azure

https://docs.securityonion.net/en/3/main/cloud-azure

GCP Marketplace and documentation:

https://securityonion.net/google

https://docs.securityonion.net/en/3/main/cloud-google

Security Onion and Linux Kernel Dirty Frag Vulnerability CVE-2026-43284

There is a new local privilege escalation called Dirty Frag (CVE-2026-43284):

https://access.redhat.com/security/cve/cve-2026-43284

Updated kernel packages should be coming soon to resolve this issue. If you can't wait until updated kernels are released and need to apply a temporary mitigation, please see the Mitigation section of the article above and also:

https://github.com/V4bel/dirtyfrag#mitigation

Security Onion 2.4.211 Hotfix 20260407 Now Available!

Last month, we released version 2.4.211:

https://blog.securityonion.net/2026/03/security-onion-24211-is-now-available.html

Today we are releasing a hotfix which resolves an issue with Suricata BPF handling in TRANSITION mode:

https://docs.securityonion.net/en/2.4/release-notes.html

Security Onion 2.4.211 Is Now Available and Resolves Several Issues!

Last week, we released Security Onion 2.4.210:

https://blog.securityonion.net/2026/03/security-onion-24210-now-available-with.html

We found and fixed a few issues resulting in today's release of Security Onion 2.4.211:

https://docs.securityonion.net/en/2.4/release-notes.html

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/2.4/release-notes.html#known-issues

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://docs.securityonion.net/en/2.4/soup.html

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/2.4/first-time-users.html

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/2.4/architecture.html

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.4/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

Questions, Problems, and Feedback

If you have any questions or problems relating to Security Onion 2.4, please use the 2.4 category at our Discussions site:

https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

Security Onion 3.0 Coming Soon!

Last week, we released Security Onion 2.4.210:

https://blog.securityonion.net/2026/03/security-onion-24210-now-available-with.html

This is our last major release in the 2.4 series! Our next major release will be Security Onion 3.0!

Security Onion 2.4

Security Onion 2.4 reached General Availability on August 15, 2023:

https://blog.securityonion.net/2023/08/security-onion-24-has-reached-general.html

Over the last 2.5 years, we've made lots of innovative changes to the platform but we kept the version number at 2.4. The time has come to move to Security Onion 3 to represent the innovation that we've already done and the innovation that we're planning to do!

Security Onion 3.0

Security Onion 3.0 is very similar to 2.4.210 and uses the exact same underlying operating system (Oracle Linux 9) and all of the same components with one exception: 3.0 no longer includes Stenographer and so full packet capture is handled by Suricata.

Also note that 3.0 will not work with anything but Oracle Linux 9. We will not test or support Ubuntu, Debian or any other distro. These other distros were not officially supported in 2.4 but we're officially removing them altogether in 3.0.

Upgrading from 2.4 to 3.0

Once Security Onion 3.0 is released, there will be a simple command to update from 2.4.210 to 3.0. If you are on an older version of 2.4.x, you will have to update to 2.4.210 first.

If you are still using Stenographer for your full packet capture, go ahead and change pcap mode to TRANSITION now so that Suricata can start doing pcap and old Stenographer data can roll off:

https://docs.securityonion.net/en/2.4/suricata.html#switching-pcap-from-stenographer-to-suricata

Security Onion 2.4.210 Now Available with Updated Components and New Features including Local Model Support for Onion AI!

For Security Onion Pro customers, we've made major improvements for our popular new Onion AI Assistant. Many folks have been asking for local model support. If your local model has an OpenAI compatible endpoint, then this release can connect to it!

Onion AI is a huge leap forward in leveraging AI to assist you in triaging alerts, working incidents, and tuning your deployment! For more information, please see:

https://securityonion.net/docs/assistant

Updated Components

This release updates several components including:

• Zeek to 8.0.6
• Elasticsearch to 9.0.8
• Docker to 29.2.1
• Saltstack to 3006.19

Release Notes

Security Onion 2.4.210 upgrades Salt to version 3006.19. This version of Salt has a configuration option minimum_auth_version for the Salt master. By default, this value is set to 3 and only minions on version 3006.12 or later support that version and are able to authenticate with the salt-master service. For this reason, during the soup to 2.4.210, we set the minimum_auth_version to 0. Since minions automatically update every 15 minutes, this allows older minion versions to authenticate, run a highstate, and upgrade to 3006.19.

After seven days, a background process will change the minimum_auth_version from 0 to 3 and restart the salt-master service. Once this is done, any minions in the environment that have not upgraded to a version greater than 3006.12 will be unable to authenticate with the salt-master. The likely cause of this would be a minion that is offline. Additionally, if a user attempts to install a new node, using a version less than 2.4.200 (salt-minion 3006.16), the install will fail since the salt-minion will not be able to authenticate with the salt-master.

For more information, please see the full Release Notes:

https://securityonion.net/docs/release-notes

Known Issues

For a list of known issues, please see:

https://securityonion.net/docs/release-notes#known-issues

About Security Onion

Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, and case management. 

For network visibility, we offer signature based detection via Suricata, rich protocol metadata and file extraction using your choice of either Zeek or Suricata, full packet capture, and file analysis. For host visibility, we offer the Elastic Agent which provides data collection, live queries via osquery, and centralized management using Elastic Fleet. Intrusion detection honeypots based on OpenCanary can be added to your deployment for even more enterprise visibility. All of these logs flow into Elasticsearch and we’ve built our own user interfaces for alerts, dashboards, threat hunting, case management, and grid management. 

Security Onion has been downloaded over 2 million times and is being used by security teams around the world to monitor and defend their enterprises. Our easy-to-use Setup wizard allows you to build a distributed grid for your enterprise in minutes!

Documentation

You can find our online documentation here:

https://securityonion.net/docs

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://securityonion.net/docs/first-time-users

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://securityonion.net/docs/architecture

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://securityonion.net/docs/soup

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

2.3 EOL

As a reminder, Security Onion 2.3 reached End Of Life (EOL) on April 6, 2024:

https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Corey Ogburn
• Josh Patterson
• Mike Reeves
• Jorge Reyes
• Matthew Wright

Questions, Problems, and Feedback

If you have any questions or problems, please create a new Discussion at:

https://securityonion.net/discuss

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonion.com/hardware

Cloud Installations

For new Security Onion 2 installations in the cloud, this new version will soon be available on the AWS, Azure, and GCP marketplaces!

AWS Marketplace and Documentation:

https://securityonion.net/aws

https://securityonion.net/docs/cloud-amazon

Azure Marketplace and documentation:

https://securityonion.net/azure

https://securityonion.net/docs/cloud-azure

GCP Marketplace and documentation:

https://securityonion.net/google

https://securityonion.net/docs/cloud-google

Security Onion Essentials 2026

We've updated our popular Security Onion Essentials video series!

Security Onion 2.4.201 now available with Suricata and Zeek Updates!

Last month, we released Security Onion 2.4.200:

https://blog.securityonion.net/2025/12/security-onion-24200-now-available-with.html

This week, a new version of Suricata was released which resolves some security issues:

https://suricata.io/2026/01/13/suricata-8-0-3-and-7-0-14-released/

There was also a new Zeek update as well:

https://github.com/zeek/zeek/blob/v8.0.5/NEWS

Both updates are included in today's release of Security Onion 2.4.201:

https://docs.securityonion.net/en/2.4/release-notes.html

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/2.4/release-notes.html#known-issues

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://docs.securityonion.net/en/2.4/soup.html

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/2.4/first-time-users.html

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/2.4/architecture.html

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.4/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

Questions, Problems, and Feedback

If you have any questions or problems relating to Security Onion 2.4, please use the 2.4 category at our Discussions site:

https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

New Video: Introduction to Security Onion 2.4

Check out the latest version of one of our most popular videos:

Introduction to Security Onion 2.4

Security Onion 2025 Year in Review

2025 has been our best year ever! Let's take a look at how Security Onion has improved this year.

Security Onion 2.4.120

https://blog.securityonion.net/2025/02/security-onion-24120-now-available.html

• Community
• Added our new AI Summary feature directly into the Alerts interface
• New Local IP Lookup Feature
• Additional Zeek parsers
• ATT&CK Navigator Improvements
• Elastic Agent MSI
• Improved SOC Cases Escalation
• Updated components
• Pro
• External API (https://docs.securityonion.net/en/2.4/connect.html)

Security Onion 2.4.130

https://blog.securityonion.net/2025/03/security-onion-24130-now-available.html

• Community:
• Updated Elastic Stack including support for all Elastic integrations
• Alerts Advanced interface can now be permanently enabled
• SOC Configuration interface is now even easier to use
• Additional Zeek parsers
• Updated components
• Pro:
• Active Query Management (https://docs.securityonion.net/en/2.4/aqm.html)

Security Onion 2.4.140

https://blog.securityonion.net/2025/03/security-onion-24140-now-available.html

• Community:
• SOC Config Improvements
• Updated components

Security Onion 2.4.150

https://blog.securityonion.net/2025/05/security-onion-24150-celebrating.html

• Community:
• Improvements to Elasticsearch deletion process
• Updated components
• Pro:
• Manager of Managers (https://docs.securityonion.net/en/2.4/mom.html)

Security Onion 2.4.160

https://blog.securityonion.net/2025/06/security-onion-24160-now-available.html

• Community:
• Playbooks and Guided Analysis
• Updated components
• Pro:
• MCP Server (https://docs.securityonion.net/en/2.4/mcp.html)
• Security Onion App for Splunk (https://docs.securityonion.net/en/2.4/splunk.html)

Security Onion 2.4.170

https://blog.securityonion.net/2025/08/security-onion-24170-now-available.html

• Community:
• JA4 Support
• More dashboards
• Updated components
• Pro:
• Hypervisor (https://docs.securityonion.net/en/2.4/hypervisor.html)

Security Onion 2.4.180

https://blog.securityonion.net/2025/09/security-onion-24180-now-available.html

• Community:
• Alert on Offline Agents
• Cancel Your Own Long Running SOC Query
• Enable Static Hostname Mapping without Reverse DNS Lookups
• Updated Components
• Pro:
• Manager Hypervisor (https://docs.securityonion.net/en/2.4/hypervisor.html)
• Reporting (https://docs.securityonion.net/en/2.4/reports.html)

Security Onion 2.4.190

https://blog.securityonion.net/2025/10/security-onion-24190-now-available.html

• Community:
• Updated components
• Pro:
• More hypervisor improvements (https://docs.securityonion.net/en/2.4/hypervisor.html)
• Onion AI Assistant (https://docs.securityonion.net/en/2.4/assistant.html)

Security Onion 2.4.200

https://blog.securityonion.net/2025/12/security-onion-24200-now-available-with.html

• Community:
• Updated components
• Pro:
• Major improvements to Onion AI Assistant (https://docs.securityonion.net/en/2.4/assistant.html)

Conclusion

2025 has been our best year ever! We've got some amazing things planned for 2026 so stay tuned!

Security Onion 2.4.190 now available including Onion AI Assistant for Pro Customers!

Security Onion 2.4.190 is now available and includes several new features, updated components, and many quality of life improvements! 

For Security Onion Pro customers, we've improved our hypervisor feature and added the new Onion AI Assistant!

Updated Components

This release updates several components including:

• ATT&CK Navigator
• ElastAlert
• Elastic Stack
• Golang
• Nginx
• Redis
• Telegraf
• Zeek
  
  

The Elastic and Redis updates resolve security issues so we highly recommend upgrading.

Security Onion Pro Feature: Hypervisor

In the recent 2.4.170 release, we added a new hypervisor feature for Security Onion Pro customers and then improved it in 2.4.180. This release continues to iterate on the Hypervisor feature making it even more powerful! For more information about the Hypervisor feature, please see:

https://docs.securityonion.net/en/2.4/hypervisor.html

Security Onion Pro Feature: Onion AI Assistant

Onion AI is a huge leap forward in leveraging AI to assist you in triaging alerts and working incidents!

https://docs.securityonion.net/en/2.4/assistant.html

Release Notes

There are many more features and fixes included in this release! For a complete list of all changes, please see the Release Notes:

https://docs.securityonion.net/en/2.4/release-notes.html#changes

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/2.4/release-notes.html#known-issues

About Security Onion

Security Onion is a free and open platform built by defenders for defenders. It includes network visibility, host visibility, intrusion detection honeypots, log management, and case management. 

For network visibility, we offer signature based detection via Suricata, rich protocol metadata and file extraction using your choice of either Zeek or Suricata, full packet capture, and file analysis. For host visibility, we offer the Elastic Agent which provides data collection, live queries via osquery, and centralized management using Elastic Fleet. Intrusion detection honeypots based on OpenCanary can be added to your deployment for even more enterprise visibility. All of these logs flow into Elasticsearch and we’ve built our own user interfaces for alerts, dashboards, threat hunting, case management, and grid management. 

Security Onion has been downloaded over 2 million times and is being used by security teams around the world to monitor and defend their enterprises. Our easy-to-use Setup wizard allows you to build a distributed grid for your enterprise in minutes!

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.4/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/2.4/first-time-users.html

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/2.4/architecture.html

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://docs.securityonion.net/en/2.4/soup.html

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

2.3 EOL

As a reminder, Security Onion 2.3 reached End Of Life (EOL) on April 6, 2024:

https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Corey Ogburn
• Josh Patterson
• Mike Reeves
• Jorge Reyes
• Matthew Wright

Questions, Problems, and Feedback

If you have any questions or problems, please create a new Discussion at:

https://securityonion.net/discuss

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Active Query Management
• External API
• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery
• Manager of Managers
• MCP Server
• Security Onion App for Splunk
• Hypervisor
• Reports
• Onion AI Assistant

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonion.com/hardware

Cloud Installations

For new Security Onion 2 installations in the cloud, this new version will soon be available on the AWS, Azure, and GCP marketplaces!

AWS Marketplace and Documentation:

https://securityonion.net/aws/?ref=_ptnr_soc_blog_250917

https://docs.securityonion.net/en/2.4/cloud-amazon.html

Azure Marketplace and documentation:

https://securityonion.net/azure

https://docs.securityonion.net/en/2.4/cloud-azure.html

GCP Marketplace and documentation:

https://securityonion.net/google

https://docs.securityonion.net/en/2.4/cloud-google.html