news
Security Onion 2.4.160 now available including Playbooks, Guided Analysis, MCP Server, and more!
Security Onion 2.4.160 is now available and includes Playbooks and Guided Analysis to help you more quickly triage and respond to alerts! Security Onion Pro customers will also have access to our new MCP Server and Security Onion App for Splunk!
Playbooks and Guided Analysis
Have you ever had an alert and were unsure of what to do next? In this release, when you expand an alert you'll see a new tab called Guided Analysis. This leverages Playbooks to show you plays associated with the alert. These plays include questions which help guide your investigation. Each question has an associated query and the results of that query will be automatically displayed to help you answer the question. This makes you faster and more efficient than ever before!