Security Onion functions as a "Swiss Army knife" for defenders by bundling several best-of-breed open-source tools:
Features the Security Onion Console (SOC) , which provides built-in dashboards, threat-hunting interfaces, and case management.
The (or ISO) is a bootable distribution designed for network security monitoring (NSM) , intrusion detection, and log management. While modern versions (2.4+) focus on permanent installations for scalability, the Live environment remains a critical entry point for quick network evaluations and forensic testing. Core Purpose and Use Cases
