Grafana Loki vs. Security Onion

Grafana Loki can compile data logs for easy exploration of a service and enable quick troubleshooting and error tracing for engineers who may not have deeper access. However, Loki is dependent on the service logging complexity, which, depending on the logger, may not be robust enough and limit the value offered.

Incentivized

Security Onion works well for setting up within a Linux environment. This brings a new platform to run and maintain though. The application its self has helped to keep track of logs and vulnerabilities in the environment. Alert triage and case creation is simple to start and follow through to the end.

• Access to many open-source dashboards, access to add many data-sources to gather and visualize data from.
• Grafana Loki does well gathering of logs from various data-sources, we can also filter the logs based on our needs.
• One stop solution for all the logs and monitoring.

Incentivized

• GUI
• Support
• Easy of use

• Learning curve is very steep
• Longer term log insight is a challenge
• Very easy on AWS, integration with other systems can be more of a challenge

Incentivized

• Requires Linux
• Training

Grafana Loki makes accessing and viewing service logs easy for engineers who may not be familiar with going into service. However, useability can be limited if engineers are unaware of what the queries should look like or where in the service to direct Loki to look for logging.

Incentivized

First and foremost if Grafana Loki is based on CNCF open source projects so organizations can get freedom to choice to configure it at your own other main thing is Grafana Loki is totally free of cost and we can deploy it on our infrastructure. On compared with other managed services like Datadog, New Relic it is very expensive and we also don't have much control on the tools we use.

Incentivized

Other vendors may have a more robust solution but for our needs, Security Onion was the one to move forward with. We have tested some of the others but the cost of those platforms makes the ROI not as desirable. There is a learning curve with Security Onion but it is worth it for the value provided.

• Company wide (realtime) insights in complex aws setup is great
• Dashboarding options are easily set up

Incentivized

• Makes Alert Triage easier to handle
• Analysis of threats simple