Can we use Security Onion 2 more like a SIEM than a NSM ?

[NRGLine4Sec]

Can we send log to SO with Fluentd for exemple, or vector and get the full other features provides by SO (Alerts, TheHive, Playbook ...) without NIDS capabilities (Suricata/Zeek)?

[dougburks]

The short answer is that Security Onion is open source and so anything is technically possible depending on how much time you want to invest in it! 😄