Sneak Peek: Security Onion Playbooks

[dougburks]

We've got a new AI-powered Playbooks feature coming in Security Onion 2.4.160 that will turbocharge your analysis and incident response!
https://youtu.be/SLGRB3PxB-o

[UMHB-InfoSec]

That looks awesome! Thanks SO team!

[ross-tsc]

Hi guys! Looks great. Couple questions if I may.

• Are these playbooks/hunts/action pivots pre-generated? If so, I'm assuming these features currently only work on "default" alerts that come built in with SO?
• Is this an Pro only feature?

Thanks again for the hard work

[dougburks]

Are these playbooks/hunts/action pivots pre-generated? If so, I'm assuming these features currently only work on "default" alerts that come built in with SO?

Yes, they are pre-generated for our standard rules. However, you will eventually be able to add your own playbooks for your own rules.

Is this an Pro only feature?

No, we are releasing Playbooks to all users for free!
https://blog.securityonion.net/2025/06/security-onion-24160-now-available.html

[lunial-ca]

Congrats on the Playbooks, very nice add.

It seems that the playbooks are only available to superusers and not to the analysts, is this a bug or it's on purpose?

[dougburks]

This is a bug:
#14811

[lunial-ca]

Thanks Doug,

I noticed two other issues, but not sure if these are normal behaviour (because of Elastic) or bugs:

during the upgrade from 2.150 to 2.160 the custom logstash files located in /opt/so/saltstack/default/salt/logstash/pipelines/config/custom/ were lost, along with the custom logstash configuration in logstash / defined_pipelines

during the upgrade from 2.150 to 2.160 the logstash plugins installed manually were lost

[dougburks]

@lunial-ca please create a separate discussion since this is unrelated to Playbooks. Thanks!

[Zer0-cyber-web]

On "Guided analysis" tab - there is a notice says "Some of these playbooks were generated by AI and it's possible that they may not be 100% accurate. Please let us know if you see any issues.".
So - where to I can send report on issue? Like this one, for example:

while:

[dougburks]

@Zer0-cyber-web Please start a new discussion and then provide more details like:

• where are you monitoring traffic?
• are you monitoring a busy DNS server that perhaps might be sending queries to upstream DNS servers?