The biggest advantage I found when using Security Onion was that it has a combined set of tools, which is beneficial, as having one place with multiple tools is advantageous. I have used Elastic Stack for data visualization, last using it maybe a couple of months back. Elastic Stack was helpful for my security operations as it is an open-source tool, allowing me to use multiple tools in one place instead of using them all separately. I have also tried Zeek, but I do not use it multiple times. I did not have enough time to understand if Zeek was effective or not, and I did not see much benefit from it. I find the intrusion detection capabilities of Suricata beneficial. With Suricata, we can write different rules for different signatures, which allows for customized use cases. It was helpful to aggregate all the events and traffic in one place with Security Onion, so it is beneficial.
