Questions About Checking and Adding Nodes in Security Onion (Distributed Deployment)

[SankaGamage]

Hello everyone,

I have installed Security Onion using the distributed deployment type, and I have a few simple questions:

1. How can I check the nodes I have (e.g., manager, search, sensor, etc.)?
2. What are the steps to add more nodes to my Security Onion setup?
3. Do I need to install Security Onion again on new machines to add nodes?
4. If anyone has documentation or step-by-step guides for these processes, I’d greatly appreciate it.

Thank you in advance for your help!

[rh-ops]

(1.) You can view your current nodes on the Grid page in SOC (Security Onion Console).

(2&3.) You would need to install SO on the other nodes, configuring them as the respective nodes you want in your grid. So for example, if you need a sensor, you would need to install the sensor deployment of SO on another machine. During the installation, it will ask you for your managers ID and IP. That's when you will enter it, and the node will appear in the Grid Members page of your SOC where you will need to approve it.

(4.) https://docs.securityonion.net/en/2.4/configuration.html#production-server-distributed-deployment