Security Onion Solutions
Appliances
With upgraded storage, network, processing, and memory our latest appliances will make it even easier to make your adversaries cry!
We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization.
Security Onion's SOC interface provides appliance-specific information directly in the user-interface. Use this information to monitor the appliance's health in realtime. Also view the appliance front and rear panels, useful for walking through connectivity discussions with personnel in the data center. Only official Security Onion Solutions appliances are supported with this integration.
Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!
Appliance Comparison
| Model | Use Case(s) | Sensor Node Throughput † |
Standalone Throughput † |
Max Data Storage * |
Data Class |
Form Factor |
||
|---|---|---|---|---|---|---|---|---|
500 |
Sensor node in a branch office | 500 Mbps | N/A | 20 TB | SAS | 1U | ||
1000 |
Standalone node in a small organization Sensor node in a medium office |
1 Gbps | 500 Mbps | 40 TB | SAS | 1U | ||
2000 |
Standalone node in a small organization Sensor node in a medium office |
2 Gbps | 1 Gbps | 45 TB | NVMe | 1U | ||
5000 |
Sensor node in a data center | 5 Gbps | N/A | 200 TB | SAS | 2U | ||
10000 |
Sensor node in a large data center Network monitoring limited to alerts and metadata |
10 Gbps ‡ | N/A | 15 TB | NVMe | 1U | ||
MN |
Manager node in a distributed architecture Manager Search node in a small distributed architecture |
N/A | N/A | 15 TB | NVMe | 1U | ||
SN7200 |
Search node in a distributed architecture Manager Search node in a medium distributed architecture Warm Search node in a large distributed architecture Standalone node in a medium to large office |
N/A | 3 Gbps | 120 TB | SAS | 2U | ||
SNNV |
Search node in a distributed architecture Manager Search node in a medium distributed architecture Hot Search node in a large distributed architecture Standalone node in a medium to large office or data center |
N/A | 5 Gbps ‡ | 45 TB | NVMe | 1U |
* Disk storage sizes are approximate, and represent the largest configuration available for the appliance. When referring to drive capacity, one terabyte, or TB, equals one thousand billion bytes and one gigabyte, or GB, equals one billion bytes. The operating system may use a different standard of measurement and report a lower capacity. Some of the listed capacity is used for formatting and other functions and will not be available for data storage.
† Actual performance depends on network traffic. Stated specifications represent the fastest configuration available for the appliance, however, other configurations are also available for specific use cases. Sensor node estimates assume a separate Manager Node is used.
‡ The SOS 10000 Sensor Node Throughput rating and SOS SNNV Standalone rating are achieved without full packet capture.
§ Network transceivers sold separately.