v2.4.110 AI

[argwfm]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

256

Storage for /nsm

512

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Thanks to the SO team for releasing SOv2.4.110! Couldn't find anything in the docs relating to how the new AI features work... so wanted to ask if specifics could be provided. Is AI performed all w/in SO (on-box) or are user detections/rules sent to a cloud AI service for summarization? Thanks again!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

Hey there @argwfm! Nothing is sent from your Security Onion Grid to any AI/LLM provider. Your Grid is simply loading the pre- generated summaries, downloaded from our repo, found here: https://github.com/security-Onion-Solutions/securityonion-resources?tab=readme-ov-file#ai-generated-detection-summaries

The summaries are built from an internal process using the community Detections and a LLM.

This means that no custom Detections will have an AI-Generated summary.

Let us know if we can clarify anything else.