So Security Onion has been around 10+ years and very early on was architected for a distributed deployment model, as its early focus was NSM (network security monitoring), with the ability to deploy sensors around chokepoints in the network and then forward relevant data to the central server/s. This mode is still the recommended deployment scenario. You can set everything up on one server (Evaluation mode), but a more typical deployment is that you will have it in a more distributed setup.