The OPNids effort is being led by threat hunting firm Counterflow AI and security appliance provider Deciso, which also leads the Opensense security platform project. OPNids is built on top of the open source Suricata IDS, providing a new layer of machine learning based intelligence to help improve incident response and threat hunting activities.
“We created a pipeline that will actually take the Suricata logs lots and analyze the packets to provide context around any alerts,” Randy Caldejon, CEO and co-founder of Counterflow AI, told eWEEK. “We like to call this alert triage, it’s like taking it to the last mile of what the analysts would do anyhow, because typically when there’s an alert, they they want some context.”