Cisco IPS Sensor (Discontinued) vs. Security Onion

IPS sensors are more suited for companies that do not have visibility into their network with third-party analyzing tools. Scenarios would be to place IPS sensors at the perimeter firewalls mainly. IPS sensors are less appropriate for companies that have third-party analyzing tools that will mitigate vulnerabilities and malicious traffic and activities already.

Incentivized

Security Onion works well for setting up within a Linux environment. This brings a new platform to run and maintain though. The application its self has helped to keep track of logs and vulnerabilities in the environment. Alert triage and case creation is simple to start and follow through to the end.

• Identifies and blocks malicious traffic.
• Detects unwanted traffic and allows your company to be proactive, let alone reactive.
• Comprehensive Threat protection allows companies to adjust thresholds and policies at will.

Incentivized

• GUI
• Support
• Easy of use

• The web GUI is somewhat slow.
• Sometimes difficult to adjust policies.
• Fail open feature may not work properly all the time.

Incentivized

• Requires Linux
• Training

Cisco TAC has been great at helping with configurations and issues that may arise

Incentivized

IPS sensors provides the necessary network visibility my company needs to satisfy its security appetite. By doing so, we have been able to stay compliant and up to date with today's network security requirements and procedures. We are able to be proactive with vulnerabilities and reactive to malicious traffic and intrusions in our day to day operations.

Incentivized

Other vendors may have a more robust solution but for our needs, Security Onion was the one to move forward with. We have tested some of the others but the cost of those platforms makes the ROI not as desirable. There is a learning curve with Security Onion but it is worth it for the value provided.

• Provided less need to purchase third party analyzing tools.
• Needed more dedicated staff to build/review/and maintain policies and such.
• Answers companies need for network security.

Incentivized

• Makes Alert Triage easier to handle
• Analysis of threats simple