Question about honeypot mode

[timcva]

If I deploy a honeypot only node does it require a tap or span port?

[dougburks]

No, honeypot nodes do not require a tap or span port.

For more information, please see the IDH section of the documentation:
https://docs.securityonion.net/en/2.4/idh.html

[timcva]

I see that the documentation requires connecting to an existing standalone or distributed management node. Is there a community resource available where one can ask questions about either types of deployments?

[dougburks]

You can ask about standalone or distributed deployments on this Discussions site (https://securityonion.com/discuss). Just start a new Discussion with an appropriate title.