Monitoring Your Home Network with Security Onion
What this is: the implementation guide for a home monitoring stack built from three separate machines. A cheap managed switch mirrors the internet link. Security Onion runs Zeek, Suricata, and the Elasticsearch store on a dedicated sensor box. A plain Python script polls the store every five minutes and prints only when something is new. When it finds a real threat it pushes the host to the router, and the router, running OpenWrt with ipset and iptables, drops it. I use TP-Link for the tap, Security Onion for detection, and a GL.iNet router for enforcement. Substitute your equivalents. ...