\chapter{Introduction}
Cyber threats are becoming increasingly sophisticated, and for this reason organizations require robust and up-to-date solutions to monitor and respond to network (and other kinds of) anomalies in real time. Network Detection and Response (NDR) systems have emerged as critical tools in this domain, offering threat visibility and proactive threat mitigation.
\section*{The Evolving Cybersecurity Landscape}
Over the past two decades, the cybersecurity landscape has undergone through complex transformations. The very first threats, such as simple worms or viruses, have progressively paved the way to more complex and targeted attacks, including advanced persistent threats (APTs), supply-chain compromises, and large-scale ransomware campaigns. This escalation in both sophistication and frequency of attacks has put pressure on organizations of every size and sector.
\medskip \newline
Compared to the past, modern enterprises are exposed to a wider attack surface: cloud services, mobile devices, remote working policies, and the advent of Internet of Things (IoT) technologies destroy the traditional security perimeter, thus requiring an upgrade to by-now obsolete security approaches. Attackers leverage this complexity, using stealthy techniques such as lateral movement, living-off-the-land attacks, and encrypted command-and-control traffic. As a result, advanced detection and response capabilities are necessary as they have never been before.
\medskip \newline
Security Operations Centers (SOCs) have to account for additional challenges beyond the never-ending evolving threats. The increasing volume of security events often results in logging overhead, where analysts struggle to differentiate between benign anomalies and true incidents. False positives consume valuable resources, while false negatives increase the potential of attackers to go undetected for long periods of time.
\medskip \newline
Due to this, NDR solutions have gained importance: while traditional Security Information and Event Management (SIEM) platforms focus primarily on centralized log collection and correlation, and Endpoint Detection and Response (EDR) tools provide deep visibility at the host level, NDR covers a complementary and essential role. By monitoring traffic at the network level, NDR solutions can identify malicious behaviors that may evade endpoint or log-based monitoring. In other words, NDR provides a way to link endpoint activity with network flow analysis, enabling SOC teams to detect both signature-based threats and subtle behavioral anomalies.

\section*{Ricca IT}
This research project was conducted at Ricca IT, an Italian business that specializes in the design, integration, and administration of safe information technology systems. Originally established as Ricca S.r.l.'s IT department back in 1998 and then merged into a single organization in the year 2016, Ricca IT has established itself as a national leader in the integration of safe systems. Its offices are spread out throughout Ragusa, Catania, Bari, Naples, and Rome and serve a very heterogeneous client base that has both public and private institutions as customers, including research institutions and operators of vital infrastructures.
\begin{figure}
    \centering \includegraphics[width=0.75\linewidth]{figures/content/ricca-sites.png}
    \caption{Ricca IT - Sites}
    \label{fig:ricca-sites}
\end{figure} \newline
What makes Ricca IT especially relevant to this project is that it has a particular strong point in cybersecurity and innovation. Not only does the company provide system integration and managed security services, but it also has research and development initiatives involved in exploring next-generation technologies. By inviting this thesis project, Ricca IT showed that it wants to bring open-source platforms as part of its solutions portfolio. By collaborating with this thesis project, a direct connection could be made between research done at the academic level and real-world needs of the industry: deploying Security Onion was neither just a technical exercise nor a proof of the technical merit of the platform; it also proved the viability of offering a cost-effective yet enterprise-ready NDR solution to clients. Inevitably, this leads one to the choice of Security Onion as the platform of study. With a philosophy of open-source accessibility and yet with capabilities that are enterprise-ready, it fits very much with Ricca IT's vision of providing innovative, cost-effective, and secure solutions.

\section*{Why Security Onion?}
Security Onion represents a clear example from the world of cybersecurity. It acts as a free and open-source solution that integrates a variety of tools, ranging from Suricata and Zeek to the Elastic Stack, into a single interface. It has been created by defenders with their fellow defenders in mind and has the aim of decreasing the barrier of entry into security monitoring while ensuring advanced features are accessible only to professional analysts.
\medskip \newline
From a technical perspective, Security Onion becomes especially suitable for experimentation and research. Researchers and analysts enjoy the flexibility of analyzing raw logs directly, tuning rules, or adjusting dashboards, making the platform usable with testing scenarios or individually tailored enterprise IT environments. Scalability of the system further amplifies this suitability: it can work as a lightweight single-server sensor for small networks and yet has the capacity of scaling out into distributed configurations of several managers, forward nodes, and search clusters. All of this ensures that findings achieved through a controlled laboratory environment can easily be replicated in production-grade implementations with minimal changes in architecture.

\subsection*{Security Onion Solutions, LLC}
Although Security Onion has become well-known as an open-source platform, it has also been actively maintained and developed through Security Onion Solutions, LLC, established back in 2014 through Doug Burks. Security Onion Solutions' aim revolves around enabling the defenders through making network security monitoring environments easier and simpler to deploy and run.
\medskip \newline
Whereas numerous purely community projects are, Security Onion Solutions offers an integrated ecosystem around the platform. Along with sustaining the free distribution model, the organization also provides professional support, hardware configurations, and formal training opportunities. With this hybrid approach, Security Onion secures sustained access to researchers and tiny teams while also becoming a feasible solution for enterprises that demand compliance, reliability, and assurances of support.
\medskip \newline
The project has a notable level of community engagement. Formal documentation, ongoing support of stable versions, and publicly available educational resources assist the ongoing accretion of knowledge. Combining open-source collaboration and vendor responsibility adds an aspect of sophistication to Security Onion that sets it apart from a great many other free tools of a security nature and as such adds tremendously to its credentials as the platform utilized for this activity.

\subsection*{Comparison with Other Platforms}
Compared to other varieties of security solutions, Security Onion has a special position. While proprietary Security Information and Event Management (SIEM) systems like Splunk or IBM QRadar bring complete log management and integration capabilities with them, they come with a high cost of licensing and resource needs. Whereas Endpoint Detection and Response (EDR) tools like CrowdStrike or Microsoft Defender bring deep insight into host-level activities with them, while they are not directly able to monitor network traffic. Security Onion offers network-centric detection and monitoring through an open-source, customizable system.

\section*{Research Questions}
To guide this investigation, the following research questions were formulated:
\begin{itemize}
    \item To what extent can a standalone deployment of Security Onion provide comprehensive network visibility?
    \item How effective are Suricata and Zeek in detecting different categories of simulated attacks?
    \item What are the limitations of Security Onion in terms of scalability, noise reduction, and rule tuning?
    \item Can large-language models meaningfully reduce the time and expertise required to analyze logs and detect incidents?
\end{itemize}

\section*{Structure of the Thesis}
This Introduction outlines the research context of the thesis, whereas the following chapters go deep into the details of each portion of the research activity. Here follows the document structure: 
\begin{itemize}
    \item Chapter 2 provides a theoretical background, including fundamental concepts of threats, vulnerabilities, and attacks, as well as an overview of Network Security Monitoring and the main tools integrated in Security Onion, subject of these studies.
    \item Chapter 3 presents the research methodology, including the setup, installation, adjustment of rules, and design of attack scenarios.
    \item Chapter 4 describes in detail the installation and configuration of Security Onion.
    \item Chapter 5 presents the attack simulations, in order to evaluate the detection capabilities of Suricata and Zeek for each scenario.
    \item Chapter 6 discusses the integration of a Large-Language Model to Security Onion, in order to smoothen out the standard SOC procedures analysts usually follow.
    \item Chapter 7 ends the paper summarizing the results, limitations, and directions for future research, both for academic and enterprise purposes.
\end{itemize}
