SecureVisio 6.0: Key Technical Updates at a Glance

SecureVisio 6.0 is the next generation of the cyber resilience management platform that integrates SIEM, SOAR, XDR, vulnerability management, UEBA, GRC, Threat Intelligence and CMDB in a single system. The new release concentrates on three priorities: more automation, a broader use of AI across the platform, and better everyday ergonomics for SOC operators and security experts.

This article summarizes the most important changes in SecureVisio 6.0 — from the expanded operator console and full-text log search to LLM-driven SOAR playbooks, the new AI Assistant and the multitenant central console.

Key Business Benefits of SecureVisio 6.0

Version 6.0 is not a collection of isolated features. Each area of the release supports a measurable operational outcome for the SOC:

• Faster incident detection and response. Advanced automation and AI allow incidents to be identified and handled more efficiently.
• Better SOC work ergonomics. The new operator interface and the AI Assistant reduce the time needed for analysis and decision-making.
• Lower operating costs. Automating routine engineering work — parsers, integrations, security rules — reduces the workload of the technical team.
• Scalability and flexibility. Multi-search, the central console and performance optimization make the platform suitable for managed security service providers (MSSP) and large, distributed organizations.
• Higher detection accuracy. New AI algorithms such as DiffValue and the expanded UEBA module mean fewer false positives and better anomaly detection.
• Compliance and risk management. CVSS 4.0 support, Threat Intelligence integration and the further development of the GRC module make it easier to meet regulatory requirements.

Two Work Interfaces: Operator Console and Expert Panel

SecureVisio provides two complementary work environments. The web-based operator console is used for daily work with incidents, vulnerabilities, and log and event analysis. The desktop Expert Panel is the application for advanced users: it is where the system is reconfigured and where correlation rules and parsers are created, tuned and visualized.

In version 6.0, the operator console has been significantly expanded with functions that were previously available only in the Expert Panel. In practice, operators can now complete more of their daily tasks in the browser, without switching tools.

What’s New in the Operator Console

UEBA directly in the web interface

User and Entity Behavior Analytics (UEBA) is now part of the operator console:

• Interactive lists of computers (EBA) and user accounts (UBA) with filters.
• Side panels showing the details of each resource — a computer or a user account.
• Drill-down from UEBA resources to the underlying logs, and a direct transition from a vulnerability or incident to its UEBA context.

New dashboard widgets

The operator dashboard presents more analytical context at a glance:

• Log and event charts with drill-down to the Log Viewer.
• Anomaly charts presenting the results of the AI algorithms running in SecureVisio.
• User and computer behavior statistics with drill-down to the details of a user, computer, category or rule.
• Charts with SOAR playbook processing statistics.

Log Viewer upgrades

Searching and filtering logs is faster and more precise in version 6.0:

• New search operators: Contains, StartsWith, EndsWith, Like and Null.
• Parentheses and the NOT operator in search filters (chips).
• A new ad-hoc (“freehand”) filter for quick manual queries.
• An aggregation panel for presenting search results.
• Auto-generated filters can now be edited during incident handling.
• A new animated tab opens the side panels: About, AI Assistant and Comments.

Faster Log Search and Indexing

Log search performance is one of the central themes of SecureVisio 6.0. New full-text search (FTS) filters for the Syslog and Beats collectors make it possible to index and quickly search arbitrary fragments of raw logs — without parsing them first. Selected event fields can now also be indexed, which significantly accelerates searches across large data sets.

The Log Viewer itself has been optimized as well: results load faster thanks to batch processing, and a new auto-refresh option loads incoming logs automatically.

Easier Implementation and Administration

Version 6.0 introduces a long list of engine-level improvements that shorten deployment and simplify daily administration:

• A new regexp operator for regular expressions in correlation rules and in log and event lookups.
• LIKE operator support for reference lists: the ReferenceSetPatternsLike() function checks whether strings from a list appear in an event field.
• Expanded reference lists: the system can generate a new log when a value on the list expires, and IP addresses can be added together with their netmasks.
• XDR agent: vulnerability detection by mapping installed software to the CPE format and comparing it with CVE entries.
• SOAR: Python support in scripting actions, including syntax hints (IntelliSense).
• Filtering of integration script results for the current incident or vulnerability.
• CVSS 4.0 support in the vulnerability management module — the new version of the NIST standard.
• Aggregation of null values in aggregation and accumulation event rules, with control over which values are required and which are optional.
• Support for the Nuclei scanner on the Linux platform.
• Detailed analysis of the rule that triggered an incident, opened directly from the incident form (side panel).
• Multi-search: dashboard charts, distributed UEBA search and the graphical log viewer can include data from multiple collectors at the same time.

Performance optimization

Administrators gain more control over how SecureVisio uses system resources. Multithreading can be enabled or disabled on all SIEM garbage collection (GC) threads, and the default thread count settings have been revised, including for FrameStore queues. The PolicyEngine service can also be separated into two independent services — one for correlation rules and one for CMDB detection rules — which improves stability under heavy load.

Smarter CMDB and Context Rules

The configuration management database (CMDB) in SecureVisio 6.0 builds a more accurate picture of the environment with less manual work:

• Group assets and security zones can be detected based on broadcast addresses in logs, network interface addressing, or a netmask and addressing table.
• Process parameters can now be detected.
• The addressing table can be synchronized with logical map objects.
• Zone and asset detection parameters (Asset Discovery, Zone Discovery) can be customized on individual and group assets.

AI and UEBA: More Accurate Anomaly Detection

The UEBA module receives a substantial AI upgrade in version 6.0. The dictionary of user and host profiles has been expanded, and administrators can now add new profiles or delete existing ones.

The headline addition is DiffValue, a new AI algorithm that detects new values in a frame field for a selected rule — for example, a process running from a different location than usual, or a connection to an application from a new country. Learned values for DiffValue can be previewed directly in the system.

Machine learning itself is now easier to tune for resource efficiency: inactive algorithms and selected profiles can be excluded from learning, and on the SIEM/ML side, selected rules — for example incident rules — can be excluded from profiles.

SOAR 6.0: LLM-Driven Playbooks and Deeper Automation

LLM integration in scenarios

SecureVisio 6.0 brings large language models (LLM) directly into SOAR playbooks:

• LLM models can be used within scenarios.
• Prompt sets can be selected in an advanced way and enriched with information from the current incident or vulnerability and with data from the system.
• Playbooks can be controlled automatically by LLM models.
• An AI model can be selected in the Condition, Script Condition and Search actions.
• The AI Prompts system actions in vulnerability scenarios have been improved.

New actions and scenario logic

The automation layer also gains several practical capabilities:

• A new action to merge incidents.
• A new action to add exclusions for Security Rules and Event Prioritization Rules — also available from the pop-up menu in UEBA and in the Log/Event Viewer.
• Host information can be retrieved through the XDR agent to automate responses — for example, terminating a process the moment it is detected.
• The “Force continuation in case of error” option lets a scenario continue after an action timeout. It now also covers the Script Condition, Search and Report actions — useful when, for example, a Threat Intelligence source does not respond.
• Playbooks can be triggered by operator inactivity — for example, no response for three hours automatically starts the playbook.

AI Assistant: Contextual Support Across the Platform

The AI Assistant is a new layer of contextual help built into the operator console. Prompts can be assigned to a specific functionality, to user groups, and to goals — such as summarizing logs or recommending the next steps in incident handling, adjusted to the operator’s experience level.

Prompt management is designed for teams, not individuals. Prompts can be versioned, updated and downloaded online. They can be chained: the response from one model can be passed to the next, and one model can even generate the prompt for another. Models and prompt profiles can be configured in bulk, and archived prompts are subject to retention rules to keep history fast and manageable.

The generative capabilities go beyond assistance with analysis. Based on queries to LLM models, SecureVisio 6.0 can:

• Create new parsers — with the option to attach sample logs when creating a parser and to learn from existing parsers.
• Create new security rules, using extended prompts with the context of Security Rules.
• Create new integrations.
• Analyze collected information — logs, incidents and vulnerabilities.

The AI Assistant is also available in the context of Script system actions, and logs can be added to a prompt directly from the AI Assistant when editing a parser.

Multitenant Central Console

For organizations that operate more than one SecureVisio installation, version 6.0 introduces a new central multitenant console. It enables central management of incident and vulnerability handling for multiple SecureVisio instances, including standalone deployments. There is no version compatibility requirement between the supported instances, and logs and events can be searched on multiple instances at the same time — both multitenant and standalone.

Combined with multi-search and the performance improvements, this makes SecureVisio 6.0 a strong fit for MSSPs and large organizations with distributed environments.

Summary: Why SecureVisio 6.0 Matters

SecureVisio 6.0 delivers a comprehensive set of new features across SIEM, SOAR, XDR, UEBA, GRC and CMDB, with a consistent focus on automation, the use of AI, and the ergonomics of SOC teams. In practical terms, version 6.0 allows organizations to deploy the system faster, detect threats more effectively, and automate a greater share of their security incident response.

Frequently Asked Questions

What is SecureVisio 6.0?

SecureVisio 6.0 is the latest generation of the SecureVisio cyber resilience management platform. It integrates SIEM, SOAR, XDR, vulnerability management, UEBA, GRC, Threat Intelligence and CMDB in one system, and extends the platform with AI-driven automation and a new AI Assistant.

Which modules does SecureVisio integrate?

SecureVisio combines SIEM, SOAR, XDR, vulnerability management, UEBA, GRC, Threat Intelligence and CMDB functionality in a single platform, so SOC teams can work with one consistent data and process model.

What is new in SOAR in version 6.0?

SOAR 6.0 introduces LLM support within playbooks — including automatic playbook control by LLM models — plus new actions such as merging incidents, adding rule exclusions, retrieving host information through the XDR agent, continuing scenarios after errors or timeouts, and triggering playbooks based on operator inactivity.

How does the AI Assistant in SecureVisio 6.0 work?

The AI Assistant provides contextual support in the operator console, with prompts assigned to specific functions, user groups and goals. It can summarize logs, recommend next steps in incident handling, and generate new parsers, security rules and integrations based on queries to LLM models.

Who is the multitenant central console for?

The multitenant central console is designed for MSSPs and organizations running multiple SecureVisio instances. It centralizes incident and vulnerability handling, requires no version compatibility between instances, and supports simultaneous log and event searches across all connected instances.