Security Onion Standalone Redundancy

[izidood]

Hey folks.
So i'm doing my final exams soon, and i would like to use security onion as my case.
The thing is, we are limited in devices, so i can't setup a distributed environment.

The teachers is very OBS about servers etc. is HA. and i was wondering if Standalone is possible to run with a fallover solution ?.

[dougburks]

Depending on what exactly you're trying to achieve, you might have a couple of options:

• for data redundancy, you could join a search node to your standalone and configure replicas in the Elasticsearch indices
• for pipeline redundancy, you could also join a receiver node to your deployment

A separate option might be to build a HA virtualization cluster (using something like Proxmox) and then run your Security Onion standalone as a VM in that cluster. So if a virtualization cluster node fails, then the VM automatically migrates to another cluster node.

[izidood]

so first i was thinking having a physical standalone. but we will be using ESXi hosts, and most likely vmware, but i guess the practice will be the same with having a cluster running there right ?

[dougburks]

You would need to research VMware high availability. We won't be able to help you any further as this is beyond the scope of this Security Onion discussion site.

[izidood]

All good Doug thanks. :D