Trisul 8.0 is out, and it’s the biggest release we’ve shipped in years. If you run Trisul today, you’re probably here to find out what’s new and whether it’s worth the upgrade. If you’re evaluating Trisul, you want to know what a modern network analytics platform should do. Either way, this post is your tour.

The short version: you can now talk to your network. Trisul 8.0 brings an AI chat into WebTrisul that answers in charts and builds dashboards for you. Every relevant alert now carries MITRE ATT&CK context, and WebTrisul logins get two-factor authentication. Underneath, we rebuilt the IPDR and CGNAT pipeline, added new NetFlow visibility tools, and brought full IPv6 support to Home Networks.

Here are the release highlights, and where each one fits in your day.

Trisul AI is a chat built into WebTrisul. You type a question about your traffic, and it answers with a chart drawn from your own Trisul data, not a paragraph of guesses.

The interesting part is what happens next. Trisul AI can generate a full dashboard from the conversation, and you can install that dashboard straight from the chat. The question you asked once becomes a view your team opens every morning.

A few details that matter in practice:

• Context-scoped queries. Questions run against a specific context, so answers stay tied to the data set you care about.
• Derived counter groups. Trisul AI can build derived counter groups as part of answering, instead of being limited to what’s already configured.
• Your AI server. WebTrisul connects to a Trisul AI API server through new settings, and the chat is powered by the Trisul AI CLI.
• Bring your own LLM. Trisul AI works with any LLM that exposes an OpenAI-compatible API, cloud-hosted or self-hosted. WebTrisul connects to a Trisul AI API server through new settings, and the chat is powered by the Trisul AI CLI.

If you’re preparing dashboards for a manager or a weekly review, this is the feature to try first. Dashboards can also be previewed from JSON before saving, so you can check what the AI built before it goes live.

Want to see it build one end to end? Read our walkthrough: Building dashboards with Trisul AI.

Don’t take our word for it. Watch Trisul AI answer questions, build dashboards, generate reports and chase down root causes, all in 90 seconds.

Trisul 8.0 adds MITRE ATT&CK support across the whole stack: Probe, Hub and WebTrisul. Alerts now carry MITRE ATT&CK fields on the alert object. Every mapped alert shows its tactic ID and technique ID, and where a sub-technique applies, the sub-technique ID too. That context travels with the alert instead of living in an analyst’s head.

In WebTrisul, you get two new ways to look at it:

• ATT&CK matrix with search. See which tactics and techniques your alerts map to, and search across them.
• MITRE timeline view. Lay alerts out over time by ATT&CK context, so a sequence like discovery followed by lateral movement reads as a sequence, not as unrelated noise.

For SOC analysts, this shortens the first triage question: what stage is this? For NOC teams that share alerts with security, it gives both sides a common vocabulary. And because the alert still lives in Trisul, you can drill from the ATT&CK view back into the flows and packets behind it.

For the full story on how Trisul maps alerts to ATT&CK, read MITRE ATT&CK in Trisul.

WebTrisul shows your entire network: hosts, flows, subscriber records, packet captures. A single stolen password shouldn’t be enough to open it.

Trisul 8.0 adds two-factor authentication for WebTrisul logins.

2FA pairs with a second access-security addition: audit logs in the UI. Audit logs are now viewable in WebTrisul, with session IDs and an authentication log summary page. You can answer “who logged in, and what did they do” without leaving the product.

If you run Trisul for an ISP or a regulated environment, turn 2FA on as part of your upgrade checklist.

If you’ve been tracking IPv6 hosts with workarounds, you can stop. Home Networks now fully support IPv6, built on a reworked hybrid lookup engine. You define IPv6 home networks the same way you define IPv4 ones.

What comes with it:

• Dedicated IPv6 host meters and Internal/External IPv6 counter groups, so IPv6 hosts get their own traffic views.
• IPv6 ASN lookup, so IPv6 traffic resolves to the networks it belongs to.
• New Lua API methods for IPv6 Home Networks, for when you script your own logic.

In Trisul 8.0, Geo (geo0) operates as a first-class domain member. For distributed deployments, that means fewer moving parts to manage by hand:

• Starting and stopping a domain with trisulctl_probe also manages a co-located Geo instance.
• The Geo certificate is installed automatically with the probe.
• The add_probe script now supports Geo installation.
• The Hub distributor script disables probe0 automatically when a distributed domain is configured.

• IPDR and CGNAT: a high-performance IPDR processing path with lower memory use, CGNAT port-range support for Cisco NetFlow, NAT IP search in Bulk Query, and IPDR AI with commercial or locally hosted LLMs. The default IPDR compressor changes to lz4-ip-call-log-with-nat-ultra-mac.
• NetFlow: Flow Map for visualizing flows, NetFlow IP Tracker to monitor expected flow exporters, eight new FlowGen meters, and the netflow.feed_type key attribute.
• Lua: one script can attach to multiple counter groups, scripts can load selectively into specific contexts, and the Lua configuration file can be edited in the Admin UI.
• REST API: new endpoints for toppers, counter group information and timeslices.
• UI: a redesigned login page and navigation menu, with a light theme by default and an updated dark mode.

Existing users: read the upgrade notes before moving from Trisul 7.0. Trisul 8.0 also adds packages for EL9 (RHEL and Oracle Linux 9).

New to Trisul? Sign up and grab the download at trisul.org/get-started.

The full list of changes is in the Trisul 8.0 release notes. Try Trisul AI on your own traffic, and tell us what you asked it first on the forum.