The best part of Security Onion 12.04 for me was the pre-built Snorby instance, which was pure hell to install manually due to all the old Ruby/Rails dependencies that it had.