Security Onion 3.2.0: The Free Threat Hunting Platform Gets an Agentic Upgrade

Security Onion 3.2.0: The Free Threat Hunting Platform Gets an Agentic Upgrade

What's New in Security Onion 3.2.0

Getting It Installed and Configured

Security Onion Desktop and the Analyst Experience

A Brief Concluding Word

Security Onion has long been the go-to free and open platform for defenders who need network visibility, host visibility, intrusion detection honeypots, log management, and case management all under one roof, and the newly released 3.2.0 build, dated 29 July 2026, keeps that tradition firmly alive. Built by the team at Security Onion Solutions, this release blends genuinely new capability with a long list of dependability fixes and version bumps across the stack, and it's well worth a proper look for anyone running a security operations centre, a home lab, or anything in between.

 

What's New in Security Onion 3.2.0

The headline feature in this release is the initial implementation of an agentic framework, a foundational step that opens the door to more automated, assistant-driven workflows within the platform going forward. Sitting alongside it is a genuinely useful quality-of-life addition: Config Audit History with Restore, which pairs with a new feature that autodetects the Salt apply state from that same SOC config audit history, meaning administrators can track configuration changes over time and roll them back with far less fuss than before.

 

Data management also gets some welcome attention through Datastream Lifecycle Management, which should help teams keep a tighter handle on how their event data ages and rolls over. Analysts working the Hunt interface will notice Guided Analysis Progressive Loading, designed to make large-scale investigations feel snappier, alongside an updated default Hunt query to get people oriented faster.

 

On the detection side, this release maps Antivirus Sigma rules to Elastic Defend, giving analysts another lens through which to correlate endpoint alerts, and it introduces an initial set of Sigma Playbooks, a promising step towards guided response workflows built directly into detections. Sigma detections also gain support for ES|QL, Elastic's query language, widening the ways analysts can interrogate their data. On the network monitoring side, Suricata's transactional rule directory is now supported, and administrators managing large or complex deployments will appreciate the ability to limit certain configuration settings to specific node types, reducing the risk of applying the wrong setting to the wrong box.

 

Beyond the headline features, the fix list for 3.2.0 is substantial and covers real operational pain points. Soup, the platform's upgrade utility, can now run two full highstates on the manager during an upgrade and has been reworked around post-upgrade changes, while it also verifies that an upgrade is genuinely available before kicking off the Elasticsearch compatibility check, and it now runs the configuration backup script automatically. Elastic Fleet server state persistence has been fixed, and server URLs no longer auto-update when an administrator has deliberately opted out. There's a fix for Elastic Defend's incompatibility with newer Linux 7+ kernels, and the elastic agent installation routine now checks more thoroughly that a fresh install is genuinely healthy before declaring success.

 

A handful of niggling interface issues have also been tidied up, including a misaligned navigation bar hover state, an improved layout for group metrics on the Alert page, and a friendlier Hunt query box on smaller screens. Login security is tightened too, with a fix ensuring redirects can no longer point towards API URLs. Elsewhere, NIC names with periods are now accepted, Elasticsearch's garbage collection log rotation has been corrected, a partial duplicate index template issue has been resolved, and Suricata rule reloads no longer report a false failure when a reload is already under way. The Connect API has also been renamed to the Security Onion API for clarity, and refreshing the browser mid-hunt no longer drops your index filters, a small fix that will save plenty of analysts a moment of frustration.

 

The underlying components have had a thorough refresh as well. Elasticsearch moves to 9.3.7, Suricata to 8.0.6, Zeek to 8.0.9, and Kafka to 4.3.1. Golang jumps to 1.26.4, Node to 26.3.1, and nginx to 1.31.2. CyberChef reaches 11.2.0, InfluxDB moves to 2.9.1, Redis to 7.4.9, Postgres to 17.10, and Telegraf to 1.39.0, alongside upgrades to OpenCanary, the container registry, Alpine base images, and various Kratos, Hydra, and dependency libraries. Taken together, this is a release that pushes the platform's automation and analyst-assistance capabilities forward while also quietly hardening the plumbing that keeps a Security Onion grid reliable day to day.

 

Getting It Installed and Configured

Security Onion remains distributed as a free ISO image, downloadable and cryptographically verifiable via the project's official GitHub repository, where the signing key and detached signature files are published alongside the image itself. The verification process follows the familiar GPG pattern: import the project's signing key, fetch the ISO's accompanying signature file, download the ISO image, and then verify the pairing with a standard GPG check, confirming both the file's integrity and its authenticity before you trust it on any network. Anyone building a production sensor is strongly encouraged to follow this verification step rather than skip straight to booting the image. 

Once verified, installation follows a well-trodden path. Getting the hostname right before you begin matters a great deal, since Setup generates certificates based on it and changing the hostname afterwards isn't supported. Administrators deploying via the official Amazon, Azure, or Google Cloud images can bypass the ISO route entirely and jump straight to their preferred cloud's setup guide. For everyone else, the process is to review the hardware requirements and release notes, boot the verified ISO on hardware that meets the minimum specification, follow the on-screen prompts through to completion, and reboot into the freshly installed system.

Security Onion Setup then launches automatically on first login, and if it doesn't, it can be triggered manually from the command line. 

Configuration is where Security Onion really shows its flexibility, offering four distinct deployment paths depending on what you actually need. Newcomers who simply want to explore the platform, or who need to conduct forensic analysis of existing PCAP files or Windows EVTX event logs, are best served by the Import option, which the documentation itself recommends as the fastest way to get orientated. Evaluation mode suits classroom settings and small lab environments, though it's explicitly not intended for production use. For a single production box, the Standalone option delivers the full production-ready experience without the overhead of a distributed grid. 

Larger environments should look to the Distributed Deployment path, which begins with building a dedicated manager node, optionally combined with search capability, before joining additional sensor, search, or heavy nodes to it. Distributed builds do require a little more legwork around firewall rules on both the network and host levels, since nodes need to communicate freely with the manager and with each other, but the payoff is a grid that can scale from a single appliance right up to hundreds of nodes.

 

Security Onion Desktop and the Analyst Experience

For teams running full-time analysts, Security Onion Desktop deserves a special mention. It's a dedicated analyst workstation environment, built specifically so investigators can pick apart PCAPs, suspicious files, and other potentially risky artefacts without putting their everyday desktop, or the production Security Onion grid itself, at any risk.

The environment bundles a full set of analyst tooling including Chromium, NetworkMiner, and Wireshark, sparing analysts the hassle of sourcing and installing these tools themselves.

Security Onion Desktop is only supported on Oracle Linux 9, and the officially recommended route is the project's own ISO image, which includes a dedicated Desktop boot menu option that partitions the disk and runs the install immediately, requiring a minimum of 50GB of disk space. Administrators who'd rather bolt Desktop onto an existing system can use the standalone so-desktop-install command, which runs entirely independently of the main Setup wizard, whether before, after, or entirely instead of running Setup itself.

A third route exists for those doing a network installation directly on Oracle Linux 9, choosing the OTHER then ANALYST options within Setup, though it's worth noting the documentation flags network installations in general as unsupported.

 

One particularly neat touch is the option to join a Desktop installation to your existing grid, which lets it pull updates automatically, trust the grid's HTTPS certificate without manual intervention, and appear alongside your other nodes on the Grid page. If you'd rather keep Desktop standalone, you'll need to manually permit its traffic through the host-based firewall via the relevant analyst hostgroup setting. And for anyone who decides they don't need the graphical environment after all, the whole workstation component can be switched off cleanly through a simple Salt pillar setting, without disturbing the rest of the deployment. It all adds up to a thoughtful, low-friction way of giving analysts a proper toolkit, whether they're working solo or as part of a much larger distributed grid.

 

A Brief Concluding Word

Security Onion 3.2.0 is a release that rewards both the casual home-lab tinkerer and the enterprise security team running a sprawling distributed grid. The agentic framework groundwork and the raft of Sigma, Hunt, and configuration-management improvements point towards a platform that's steadily maturing its analyst-assistance capabilities, while the long tail of fixes and component upgrades shows a project that takes operational reliability just as seriously as flashy new features. Free, open, and backed by an active community, Security Onion remains a compelling choice for anyone serious about network and host visibility.

 

Disclaimer: Security Onion, Security Onion Solutions, and all other product names, logos, and trademarks mentioned in this article remain the property of their respective owners. This piece has been prepared in good faith from official project sources and is intended for general informational purposes; while every reasonable effort has been made to ensure accuracy, readers should always consult the official documentation before making deployment decisions. As ever, please use open-source software responsibly and in line with its applicable licence terms and your local laws.

 

References 

• Security Onion Solutions software overview

• Download and verify the Security Onion ISO image

• Security Onion Installation guide

• Security Onion Configuration guide

• Security Onion Desktop overview

• Security Onion Release notes, 3.2.0 (20260729) changes

---

(๑ᵔ🛡️ᵔ๑)

---

Back to top