Effects of SIEM Recovery Time: Case Study on Security Onion

Security Onion is a widely used open-source SIEM platform built on top of popular open-source security tools like Snort, Suricata, Zeek, and Elasticsearch. It provides features for threat hunting, enterprise security monitoring, and log management. Prolonged recovery time after system failures can increase the vulnerability of the organizations. However, there are many strategies for minimizing recovery time, such as mitigating resource contention during recovery. In this paper, we investigate the factors influencing recovery time, comprising OS startup time and Security Onion service startup time, for both manager and search nodes, focusing on the impact of CPU and I/O contentions. To mimic CPU and I/O contentions, we give VMs a specific CPU budget and I/O bandwidth. Our experiments reveal that the manager node requires longer startup times than the search node due to its more complex startup processes. OS startup time remains relatively consistent across both node types. Both CPU and I/O contentions significantly influence startup time. These findings highlight the importance of resource allocation strategies for Security Onion deployments. Organizations can significantly reduce startup time and ensure rapid recovery of their Security Onion infrastructure.