A few months ago I configured an all in one (server and sensor) Security Onion VM on my ESXi box. It took a while, but I finally found a good box that I could use for a physical sensor. I bought this Barracuda ethernet TAP back around 2007-9, and while it worked great, after I moved to my house, it has literally been collecting dust in my basement for years. Lucky for me, it still works!
This is a non aggregating TAP, which means I have two "output" cables coming from the TAP to my IDS. On the physical server, I installed Security Onion as a sensor only, and the TAP interfaces ended up being eth0 and eth2 (eth1 is the mgmt. interface).
I quickly realized that I only knew how to bond two interfaces together on CentOS/RedHat. It took a few hours of googling and trial and error, but I finally got eth0 and eth2 bonded/bridged together.
Aside from the Security Onion install, and configuring the interfaces (as shows below), the only other thing I needed to do was to install the bridge-utils package. Until I did that, even though my interfaces file was configured properly, the br0 interface would not come up.
I don't want to lose the config that ended up working, so here is the final config for Ubuntu/Xubuntu: