Feedback on Appliance Setup – Evaluation Mode (Proxmox VM)

[alexanderchangalbert]

Dear Security Onion Team,

I'd like to provide some constructive feedback based on my experience with the appliance setup in evaluation mode, running on a virtual machine in a Proxmox cluster.

The ISO file is over 12 GB – yet a large amount of data is still downloaded afterward.
This feels excessive and contradictory. If most components are being fetched during setup anyway (rules, templates, configs), a smaller ISO would make more sense. Alternatively, if the ISO is large to provide everything upfront, there should be no need for additional heavy downloads right after installation.

The visual noise during setup is overwhelming.
A constant stream of automated backend processes scrolls across the screen – many of which are not directly relevant to the actual installation progress. This creates a confusing and stressful user experience.
A cleaner solution would be to present a graphical progress view with an optional “Show Details” button. That way, users interested in technical depth can expand the view, while others can focus on the main installation steps without being flooded.

Entry barrier too high for non-enterprise evaluators.
Even though the platform clearly targets enterprise-level deployments, evaluation mode is still an entry point for people who want to explore the system in a smaller, controlled environment. The current setup experience, however, is far too complex and visually overwhelming for that purpose. A more structured, minimalistic and user-friendly setup process would significantly improve accessibility – without reducing functionality for advanced users.

Thank you for your work – Security Onion is technically impressive, but a more focused onboarding experience would make it much more approachable for a wider range of evaluators.

Best regards,
Alex

[dougburks]

Hello @alexanderchangalbert and welcome to the Security Onion community!

I'd like to provide some constructive feedback based on my experience with the appliance setup in evaluation mode, running on a virtual machine in a Proxmox cluster.

We always appreciate constructive feedback!

The ISO file is over 12 GB – yet a large amount of data is still downloaded afterward.
This feels excessive and contradictory. If most components are being fetched during setup anyway (rules, templates, configs), a smaller ISO would make more sense. Alternatively, if the ISO is large to provide everything upfront, there should be no need for additional heavy downloads right after installation.

What exactly are you seeing it download? If you're using our most recent ISO image, it should only be a few updates.

If you don't want it to download anything, you could choose the Airgap option:
https://docs.securityonion.net/en/2.4/airgap.html

The visual noise during setup is overwhelming.
A constant stream of automated backend processes scrolls across the screen – many of which are not directly relevant to the actual installation progress. This creates a confusing and stressful user experience.

In previous versions, we used to hide all of the information behind a progress bar and received overwhelming feedback that users were unable to know if it was hung up on something.

In the current version, the information scrolling across the screen is really there just in case something breaks. At the very end, it will tell you if it was successful or not. If troubleshooting is necessary, the information scrolled to the screen can later be found in the logs for further analysis.

A cleaner solution would be to present a graphical progress view with an optional “Show Details” button. That way, users interested in technical depth can expand the view, while others can focus on the main installation steps without being flooded.

The install process is based off of a minimal OS install which means that there are not a lot of tools available to get creative with different options.

Entry barrier too high for non-enterprise evaluators.
Even though the platform clearly targets enterprise-level deployments, evaluation mode is still an entry point for people who want to explore the system in a smaller, controlled environment. The current setup experience, however, is far too complex and visually overwhelming for that purpose. A more structured, minimalistic and user-friendly setup process would significantly improve accessibility – without reducing functionality for advanced users.

Did you try following our First Time Users guide? It's intended to provide that structured and minimalistic process to help folks while they're getting acclimated to the Security Onion platform:
https://docs.securityonion.net/en/2.4/first-time-users.html

Thank you for your work – Security Onion is technically impressive, but a more focused onboarding experience would make it much more approachable for a wider range of evaluators.

Thanks for your constructive feedback!