$ show Security-Onion-Solutions/securityonion
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
The LLM identified 3 files worth highlighting for reuse:
A collection of 15+ threat intelligence analyzers (VirusTotal, URLhaus, OTX, GreyNoise, Spamhaus, etc.) each structured as an independent Python module with a consistent interface. Each analyzer includes a Python class that implements `run()` and `supported_types()`, a JSON metadata file, a YAML config template, and a `requirements.txt`. The `helpers.py` provides shared functions for loading metadata, configuration, and artifact parsing. This framework is extractable as a standalone enrichment pipeline for any SIEM or SOAR platform, requiring only the `helpers.py` and an event loop to invoke analyzers.
A general-purpose YAML file manipulation CLI that supports add, remove, replace, append, and get operations with file locking. It handles nested keys via dot notation, type conversion, and preserves YAML formatting. The tool is used across Security Onion scripts for configuration management but is completely self-contained (only depends on Python standard library and PyYAML) and could be reused in any project requiring programmatic YAML editing.
A custom Salt beacon that polls two rule directories (Suricata and Sigma) for changes using a watermark file to track last-checked state. It uses `os.stat()` to compare modification times instead of inotify, avoiding known Salt bugs with inotify leaks. The beacon emits events with changed file paths, which Salt reactors can use to trigger rule reloads. This pattern is reusable for any file-change detection scenario where inotify is unreliable or unavailable.