\sommario
NDR, acronym of Network Detection \& Response, refers to a set of advanced cybersecurity technologies and methodologies employed to identify anomalies and respond to threats in real time.
It plays a critical role in scenarios where continuous monitoring of network traffic is crucial to detect malicious activities which can lead to the compromise of IT systems.\newline
This document covers the studies carried out to assess the detection capabilities of Security Onion, an open source NDR solution that includes many integrated components, each allowing the platform to provide comprehensive capabilities in threat detection, threat hunting, real-time alerting, and system customization.\newline
As a result of these observations, the thesis illustrates the followings:
\begin{itemize}
    \item the architecture and configuration of the platform and its core services
    \item the test scenarios designed to evaluate the platform response
    \item the integration of an LLM agent 
\end{itemize}
Ultimately, a conclusion of this work is presented, discussing what can be done to enrich it or to enhance its suitability for enterprise production environments.