#OOTB2025BKK - Security Onion: Scaling SIEM
P. Srisawang explores #OOTB2025BKK - Security Onion: Scaling SIEM.
Summary
Team and Project Context
Thai researchers from a former APP/network lab describe over a year customizing open-source Security Onion 2.3 for enterprise SIEM scale, emphasizing engineering lessons rather than sensitive customer data.
Why Open-Source SIEM
They chose open SIEM for lower license costs, customization freedom, code transparency, community support, and horizontal scaling on Elasticsearch-style stacks as log volume grows.
Tradeoffs and Security Onion Choice
Open platforms demand skilled staff, lack vendor SLAs, and may need custom features. Security Onion was selected for its all-in-one network and endpoint visibility plus active community, with a disclaimer that commercial Security Onion Pro exists.
Enterprise Enhancements
The case study covers performance tuning, custom development to fill enterprise gaps, and ongoing challenges when building production-grade detection on open tooling.
Related talks
Hack In The Box Security Conference·1 hr 2 min
Kristen Huang
Kristen Huang explores #OOTB2025BKK - Build Your Own SOC.
Hack In The Box Security Conference·22 min
Presenters detail vulnerability discovery and exploitation in #HITB2024BKK #COMMSEC D1: Design and Development of a Multi-Tenant SIEM Using Security Onion.
37th Annual FIRST Conference·31 min
Analysts investigate attack surfaces and defenses concerning Breaking the SIEM Confinement.