This is a SaltStack-based configuration management repository for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. The repository contains thousands of Salt states, Jinja templates, shell scripts, Python modules, and configuration files that automate the deployment and orchestration of a distributed security monitoring grid. The architecture is role-based, with distinct node types (manager, sensor, standalone, search node, hypervisor, etc.) each receiving tailored Salt states. Core services include Elasticsearch, Kibana, Logstash, Kafka, Redis, Zeek, Suricata, Strelka file scanner, Elastic Fleet/Agent, and a web-based Security Onion Console (SOC). The codebase demonstrates consistent patterns: per-service `map.jinja` merging defaults with pillar data, `enabled.sls`/`disabled.sls` toggling, license-gated features via `allowed_states.map.jinja`, and extensive use of Docker containers with static IPs on a custom bridge network. While the repository is actively maintained and follows professional SaltStack practices, it suffers from high repetition, hardcoded paths, and tight coupling between components, making reuse outside the Security Onion ecosystem difficult. Notable reusable components include the threat-intelligence analyzer framework, the YAML manipulation CLI utility `so-yaml.py`, and the Elasticsearch ingest pipeline normalization patterns.