Nagios Log Server vs. Security Onion

Nagios Log Server facilitates the ability to search all entries of logs in a quick and easy way. Beyond that, it has allowed us to configure alerts for notification when there are potential threats (may they be security threats or only application-side problems), and to filter the data for audits and compliance.

Incentivized

Security Onion works well for setting up within a Linux environment. This brings a new platform to run and maintain though. The application its self has helped to keep track of logs and vulnerabilities in the environment. Alert triage and case creation is simple to start and follow through to the end.

• Log auditing.
• Server monitoring.

Incentivized

• GUI
• Support
• Easy of use

• A bit hard to install and configure.
• High price.

Incentivized

• Requires Linux
• Training

Nagios support is decent. Nothing bad to say about them, but nothing extraordinary too. We mostly asked them questions instead of actively asking them to change or fix things for us. The response time is OK, commonly you can get a response in the same day. You can also call, but they are available only during US office hours.

Incentivized

Windows Event Log doesn't have 10% of the capabilities of Nagios Log Server. No real-time alerts, no scheduling, no external plugins or APIs. Nothing. The only advantage is that it is a native Windows application.

Incentivized

Other vendors may have a more robust solution but for our needs, Security Onion was the one to move forward with. We have tested some of the others but the cost of those platforms makes the ROI not as desirable. There is a learning curve with Security Onion but it is worth it for the value provided.

• We could react in way less time to a lot of potential outages since we started using it.

Incentivized

• Makes Alert Triage easier to handle
• Analysis of threats simple