You use it to monitor network activity similar to NIDS products from vendors like Cisco or Enterasys. You'd either set up network taps or mirrored switch ports

You use it to monitor network activity similar to NIDS products from vendors like Cisco or Enterasys. You'd either set up network taps or mirrored switch ports, and you'd feed the resulting network traffic to one or more Security Onion sensors. The distribution includes a variety of different intrusion detection systems, e.g., Snort, Bro, together with a few different analysis tools, e.g., Barnyard, Sguil. You'd usually tap your network core or distribution layers because they naturally aggregate traffic flowing between security domains (e.g., data center/office, intranet/extranet, public/private) and because it's generally too costly to tap all but the most critical assets at the network access layer (although switches with integrated IDS are becoming a thing).