Sekoia Documentation
C45508cd cfd8 459b ad65 f085a38d9554
Initializing search
GitHub
Getting started
Sekoia Solutions
Usecases
FAQ and troubleshooting
Integrations
Self-hosted deployment
API Documentation
Sekoia Documentation
GitHub
Getting started
Getting started
Welcome to Sekoia
Understand Sekoia
Understand Sekoia
What is Sekoia
Workspace and communities
Navigate the platform
Glossary
Set up your account
Set up your account
Log in for the first time
Secure your account
Customize your interface
Understand your subscription and usage
Understand your subscription and usage
Understand your subscription
Monitor your usage
Log volume and fair use
Set up your workspace (Admin)
Set up your workspace (Admin)
Workspace setup overview
Users and roles
Users and roles
Invite users
Manage users
Roles and permissions
Manage API keys
Notifications
Notifications
Notification system overview
Create a notification
Manage notifications
Notification examples
Quick starts
Quick starts
Defend
Defend
Quick start: Defend
Step 1: Connect a data source
Step 2: Verify event reception
Step 3: Activate detection rules
Step 4: Triage your first alert
Step 5: Automate with playbooks
Defend best practices
Intelligence
Intelligence
Quick start: Intelligence
Step 1: Explore the threat intelligence database
Step 2: Investigate and disseminate threat intelligence
Reveal
Reveal
Quick start: Reveal
Elevate
Elevate
Quick start: Elevate
Training
Training
Training offer overview
Register for a training course
Get help
Get help
Roy AI assistant
Support and resources
Troubleshoot common issues
Sekoia Solutions
Sekoia Solutions
The Sekoia AI SOC Platform
Threat Context (Intelligence)
Threat Context (Intelligence)
Intelligence overview
Data Models
Consume
Consume
Intelligence
Investigate an object
Observables
Telemetry
Feeds
Feeds
Understand the feeds
Create feeds
Manage feeds
Create a detection rule from a feed
Graph Explorations
Reports
Reports
FLINT Reports
External Reports
Export
IOCs Collections
Monitor
Monitor
Dashboards
Threat Landscape
External Integrations
External Integrations
Overview
API
TAXII
Cortex Analyzer
MISP Feed
MISP - Import to IOC Collection
Microsoft Sentinel
OpenCTI Import Connector
OpenCTI Stream Connector
Splunk
Splunk SOAR
Swimlane Turbine
Anomali ThreatStream
PaloAlto Cortex XSOAR
PaloAlto Cortex XSIAM
ThreatQuotient
Torq
Detect, Hunt and Respond (Defend)
Detect, Hunt and Respond (Defend)
Defend overview
Quick start guide
Collect
Collect
Integrations
Update a custom integration
Intakes
Entities
Assets
Optimization rules
Optimization rules
Optimization rules overview
Create an optimization rule
Optimization rules technical references
Detect
Detect
IOCs Detection
Rules Catalog
Built-in Rules
Built-in Geolocalisation
Sigma
Anomaly Detection
IOCs Collections
SOL detection rules
SOL detection rules
SOL detection rules overview
Create a SOL detection rule
Create an Event Drop rule
Alert similarity
Lag management
Investigate
Investigate
Alerts
Alerts
Alerts overview
Alerts listing
Alerts details
Events page
Eternal events
Massive event export
Massive event export
Understand massive event export
Export events with CLI
Export events with API
Massive export technical specifications
Massive event export troubleshooting
Cases
Cases
Cases overview
Create and manage cases
Create and manage cases
Create a case
Manage cases
Case custom views
Manage case custom views
Case templates
Case templates
Case templates overview
Create a case template
Apply a case template
Investigate cases
Investigate cases
Investigate case details
Graph investigation
AI Cases
Run a playbook from a case
Custom fields
Custom fields
Custom fields overview
Use custom fields
Manage custom field definitions
Query custom fields
Custom statuses
Custom statuses
Custom statuses overview
Manage custom statuses
Migrate custom statuses
Custom verdicts
Custom priorities
Asset Context Panel
Interpret asset risk scores
Events Query Language
Querying Events
Query Builder
Query Builder
Discover the query builder
Create and manage queries
Share and duplicate queries
Data visualization guide
Query builder form mode reference
Sekoia Operating Language
Sekoia Operating Language
SOL overview
Getting started
Understand SOL performance
How-to guides
SOL Datasets
Query examples
Reference: Datasources
Reference: Operators
Reference: Functions
Notebooks
Report
Report
Dashboards
Dashboards
Understanding dashboards
Create and manage dashboards
Configure widgets and layout
Filter data in dashboards
Share dashboards
Built-in widgets reference
Threat Landscape
Automate
Automate
Playbooks
Playbooks On-premises
Manage accounts
Navigate playbooks
Build playbooks
Organize playbooks with custom fields
Restore a playbook version
Triggers
Operators
Actions
Debug playbooks
Playbooks JSON Schema
External integrations
External integrations
FortiSOAR
Harven
Palo Alto Cortex XSOAR
Qevlar
Swimlane Turbine
AI Agents (Elevate)
AI Agents (Elevate)
Elevate overview
The investigation method
Elevate kick start guide
Elevate kick start guide
Activate Elevate
Elevate analysis states
Investigate with Elevate
Investigate with Elevate
Investigate an alert
Audit with Traces
Override a verdict
Trigger an analysis
Tune Elevate agents
Tune Elevate agents
Add custom instructions
Customize a detection rule's runbook
Write effective instructions
Manage Elevate
Manage Elevate
Override community settings
Scope auto-analysis with filters
Manage Elevate runs
Measure Elevate impact
Asset Intelligence (Reveal)
Asset Intelligence (Reveal)
Reveal overview
Get started with Reveal
Get started with Reveal
Reveal quick start guide
Reveal enablement matrix
Asset connectors
Asset connectors
Create asset connectors
Check asset connector health
Troubleshoot asset connectors
Investigate assets
Investigate assets
Explore assets context
Asset risk scoring
Visualize attack paths
Discover Points of Interest
Check Endpoint Hygiene
Leverage Vulnerability Enrichment
Discover installed Applications status
Rely on Security Controls
Settings
Settings
Subscriptions
Subscriptions
Subscriptions overview
Create a subscription
Assign a subscription
Subscription notifications
Advanced configuration
Advanced configuration
Security and access
Security and access
Security tokens
Password management policy
Session duration
Workspace two-factor authentication
SSO with OpenID Connect
SSO with Microsoft Entra ID
SSO with Okta
User lifecycle
User lifecycle
Deactivate inactive users
Reference
Reference
Sekoia regions
Usecases
Usecases
Export large volumes of events
Implement a blocklist in Sekoia.io
Synchronize Alerts with an external tool
Synchronize Assets with an Active Directory
Send notifications to a Webhook using a playbook
Use your own CTI in Sekoia.io
Investigate overusage
Log volume reduction strategies
FAQ and troubleshooting
FAQ and troubleshooting
General
Alerts
Events
Events
Events FAQ
Events QA
Facing issues with logs collection
Storage
Storage
Data storage and retention
Restore Data from cold storage
Understand Exalog storage engine
Migrate to Exalog
Intelligence
Intelligence
Detection
Questions about IoC revokation
Questions about detection rules
Assets
Ingestion
Ingestion
Delay with event ingestion or alert creation
Sekoia.io Endpoint agent
Datetime representation
Reveal troubleshooting
Reveal troubleshooting
Troubleshoot Reveal module first steps
Troubleshoot application inventory
Integrations
Integrations
Introduction
MCP Server
MCP Server
Overview
Getting started
Install in Claude Code
SOC how-to guides
Threat intelligence how-to guides
Plugins and skills
Reference: Tools
Ingestion methods
Ingestion methods
Overview
Cloud & SaaS
Cloud & SaaS
Overview
AWS S3
Azure Event Hub
Google Pub/Sub
HTTPS
HTTPS
Overview
Formatting options
Compression
Forwarding logs using a third-party application
Graylog
Logstash
Syslog
Syslog
Overview
Configure the Sekoia.io Forwarder
Route multiple technologies through one port
Secure forwarder inputs with TLS
Monitor the Sekoia.io Forwarder
Reduce volume in the Sekoia Forwarder
Troubleshoot the Sekoia.io Forwarder
Third-party syslog services
Rsyslog
Filter logs with Rsyslog
Syslog NG
Filter logs with Syslog-ng
Secured forwarding
NetFlow
NetFlow
Sekoia.io NetFlow Concentrator
List of Intakes
List of Intakes
Overview
AI Agents
AI Agents
Blue41 Detections and Audit
Hodor Activity
Applicative
Applicative
1Password EPM
Apache HTTP Server
Azure Activity Logs
Azure Files
Azure MySQL
Cloudflare Audit Logs
Fastly WAF Audit logs
Github Audit Logs
Google Workspace / ChromeOS
Google Cloud Audit Logs
LockSelf LockPass/LockTransfer/LockFiles
Microsoft IIS
Microsoft Sentinel
Nutanix
New Relic Alerts
Salesforce
Sekoia.io activity logs
Sekoia.io forwarder logs
Systancia Cleanroom
Veeam Backup
Wiz Audit Logs
Email
Email
Checkpoint Harmony Email and Collaboration
Cisco Email Security Appliance
FortiMail
Hornetsecurity 365 Total Protection
Mimecast Email Security
Office 365
Office 365 Message Trace (deprecated)
Office 365 Message Trace (Graph API)
Postfix
Proofpoint On Demand
Proofpoint Targeted Attack Protection
Retarus Email Security
SpamAssassin
Trend Micro Email Security
Vade Cloud
Vade M365
Endpoint
Endpoint
Azure Windows
Bitdefender GravityZone
Check Point Harmony Mobile
CrowdStrike Falcon
CrowdStrike Falcon Telemetry
Cybereason MalOp
Cybereason MalOp activity
Eset Protect
Google Kubernetes Engine (GKE)
Harfanglab
IBM AIX
IBM iSeries (AS/400)
Kaspersky Endpoint Security
Kubernetes Audit Logs
Linux AuditBeat
Log Insight Windows
Lookout Mobile Endpoint Security
Microsoft Defender XDR (Microsoft 365 Defender)
Microsoft Defender XDR (Graph API)
Microsoft Defender XDR Incidents (Graph API)
Microsoft Intune
Nozomi Central Management Console
Nucleon EDR
Palo Alto Cortex XDR (EDR)
Panda Security Aether
Pradeo MTD
Proxmox VE
SentinelOne
SentinelOne Cloud Funnel 2.0
Sekoia Endpoint Agent
Sekoia Endpoint Agent
Overview
Install
Deploy at scale
Configure
Update and uninstall
Troubleshoot
Run alongside other software
Events and fields reference
Built-in detection rules
Reduce event volume with the Endpoint Agent
Sophos EDR
Stormshield SES
Symantec Endpoint Protection
TEHTRIS Endpoint Detection & Reponse
Tanium
Trellix ATD
Trellix EDR
Trend Micro Apex One / Vision One Endpoint
Trend Micro Vision One Workbench
Trend Micro Vision One Observed Attack Techniques
WatchGuard EPDR
VMWare ESXi
VMWare VCenter
Windows
Winlogbeat
WithSecure Elements
Generic
Generic
CEF
Raw
OCSF
IAM
IAM
Tenable Identity Exposure / Alsid
Azure Key Vault
Bitwarden Event Logs
BeyondTrust PRA Sessions
BeyondTrust PRA Syslog
BeyondTrust PRA Team
BeyondTrust PRA Vault Account Activity
Cisco Duo Security
Cyberark Digital Vault
CyberArk Identity Audit Logs
Delinea Platform Audit Logs
FreeRADIUS
Jumpcloud Directory Insights
Keycloak Events
ManageEngine ADAudit Plus
Microsoft Entra ID (Azure AD)
Microsoft Entra ID (via Graph API)
Okta System log
One Identity SPS Session logs
OpenLDAP
PingFederate
RSA SecurID
Rubycat PROVE IT
SentinelOne Singularity Identity
Silverfort Universal MFA
Wallix
Network
Network
Amazon VPC Flow Logs
Amazon VPC Flow Logs (Parquet)
Azure Application Gateway
ArubaOS Switch
BIND
Cato SASE
Cisco Catalyst SD-WAN
Cisco IOS
Cisco Meraki MX
Cisco NX-OS
Citrix NetScaler / ADC
Cloudflare Access Request
Cloudflare DNS Gateway
Cloudflare DNS logs
Cloudflare Gateway HTTP
Cloudflare Gateway Network
Cloudflare HTTP requests
Cloudflare Zero Trust Network Session Logs
Control D DNS
EfficientIP SOLIDServer DDI
Ekinops OneOS
F5 BIG-IP
Google VPC Flow Logs
HAProxy
ISC DHCP
Infoblox DDI
Juniper Network Switches
Microsoft Always On VPN
NGINX
Netfilter
OPNSense
OpenSSH
OpenVPN
PfSense
Pulse Connect Secure
Squid
Jizo AI / Sesame Jizo NDR
Umbrella DNS Logs
Unbound
Vigidomain
Zimperium MTD - Threats
Network Security
Network Security
Akamai Datastream2 Delivery
Akamai Guardicore On-Premises
Akamai Guardicore Saas
Akamai WAF
Aleph Alerts
Aruba ClearPass
AWS CloudTrail
Amazon CloudFront Logs
Amazon GuardDuty
Amazon WAF
Azure Front Door
Azure Network Watcher (NSG flow logs; deprecated)
Azure Network Watcher (Virtual Network Flow Logs)
Barracuda CloudGen Firewall
Bitsight SPM
Broadcom Cloud Secure Web Gateway
Broadcom Edge Secure Web Gateway
Broadcom Siteminder
Check Point
Cisco Identity Services Engine (ISE)
Cisco Secure Firewall
Cisco Secure Access - Cloud Firewall
Cisco Secure Access - DNS
Cisco Secure Access - File Events
Cisco Secure Access - IPS
Cisco Secure Access - Web
Cisco Web Security Appliance
Claroty xDome
Clavister Next-Gen Firewall
Cloudflare WAF / Firewall Events
Corelight
Cyberwatch Detection
Darktrace Threat Visualizer
Datadome Protection
Daspren Parad
Digital Shadows SearchLight
ExtraHop Reveal(x) 360
F5 Distributed Cloud
Fastly Next-Gen WAF
Forcepoint Secure Web Gateway
Forcepoint Management Server
Forcepoint NGFW
FortiProxy
FortiWeb
Fortigate
Gatewatcher AionIQ (<=v102)
Gatewatcher AionIQ (>=v103)
Gatewatcher AionIQ V2.5
Google Cloud Load Balancing
Imperva Web Application Firewall
Juniper Next Gen Firewall
Lacework Cloud Security
LocateRisk Cyberrisk Analysis
McAfee Web Gateway / Skyhigh Secure Web Gateway - On Prem
McAfee Web Gateway / Skyhigh Secure Web Gateway - SaaS
Nanocorp
NeroSwarm Honeypot
Netskope Events
Netskope Log Streaming (Transaction Events)
Netskope Transaction Events (deprecated)
Nozomi Vantage
OGO Shield WAF
Olfeo SAAS
Olfeo Secure Web Gateway
Palo Alto Next-Generation Firewall
Palo Alto Prisma access
Radware DefensePro
Seckiot Citadelle
Security Scorecard Vunerability Assessment Scanner
SonicWall Firewall
SonicWall SMA 100 Series (deprecated)
SonicWall SMA 1000 Series
Sophos Firewall
Sophos Threat Analysis Center
Stormshield Network Security
Suricata
Thinkst Canary
Trapster
Trellix Network Security
Trellix ePO
Trellix ePO - On Prem
Trend Micro Deep Security / Workload Security
Ubika Cloud Protector Next Generation Alerts
Ubika Cloud Protector Next Generation Traffic Logs
Ubika WAAP Gateway
Umbrella IP Logs
Umbrella Proxy Logs
Upwind
Varonis Data Security
Vectra Cognito Detect
Vectra Respond UX - Entity Scoring
WatchGuard Firebox
Wiz Cloud configuration findings
Wiz Issues
Wiz Threat Detections
Wiz Vulnerability Findings
Zscaler Internet Access
Zscaler Private Access
Threat Intelligence
Threat Intelligence
AUBE
Flare Events
MokN - Baits
Prodaft USTA
List of Playbooks Actions
List of Playbooks Actions
Applicative
Applicative
ElasticSearch
Mandrill
Mattermost
New Relic
PagerDuty
ilert
Cloud Providers
Cloud Providers
AWS
Azure Monitor
Google Cloud
Collaboration Tools
Collaboration Tools
Atlassian JIRA
EasyVista Service Manager
Git
ServiceNow
The Hive
The Hive V5
Email
Email
Microsoft Outlook
Endpoint
Endpoint
Bitdefender GravityZone
CrowdStrike Falcon
Eset
HarfangLab
Microsoft Windows Server
MicrosoftDefenderXDR
Palo Alto Cortex XDR (EDR)
Palo Alto Cortex XSIAM
Panda Security
SentinelOne
Sophos
Stormshield SES
TrendMicro VisionOne
WithSecure
Generic
Generic
HTTP
OpenAI
RSS
Sekoia.io
Utils
IAM
IAM
Microsoft Active Directory
Microsoft Entra ID
Network
Network
DNS
Fortigate Firewalls
Netskope
Sophos
Stormshield
Zscaler
Overview
Threat Intelligence
Threat Intelligence
Censys
Certificate Transparency
Detection Rules
Digital Shadows
GLIMPS
IKnowWhatYouDownload
IPInfo
IPtoASN
MISP
MWDB
MokN - Baits
Nextron Valhalla
OSINT
Onyphe
PolySwarm
Public Suffix
Shodan
Tranco
Triage
VirusTotal
Whois
List of Asset Connectors
List of Asset Connectors
Overview
Vulnerability
Vulnerability
ESET EDR
Holm Security
Microsoft Defender XDR (Microsoft 365 Defender)
Rapid7 InsightVM
Tenable.io
Device
Device
AWS EC2
Crowdstrike Falcon
ESET EDR
Harfanglab EDR
Holm Security
Microsoft Defender XDR (Microsoft 365 Defender)
Nozomi Networks
Okta
SentinelOne EDR
Sophos EDR
Software
Software
HarfangLab EDR
Sekoia Endpoint Agent
User
User
AWS IAM
Microsoft Active Directory
Microsoft Entra ID
Okta
Sophos EDR
How to develop a new Integration
How to develop a new Integration
Overview
Automation
Automation
Overview
Action
Create a Module
Development Guidelines
Module
Trigger
Formats
Formats
Overview
Create a Format
Datasources
Definition of a structured event
Definition of the taxonomy
How to write a parser
How to write smart descriptions
Troubleshooting
Best Practices
Best Practices
Overview
Authentications
Networks
Endpoints
FAQ
FAQ
Overview
General Questions
General Questions
Bug VS Improvement Requests
Self-hosted deployment
Self-hosted deployment
Introduction
Documentation versions
v1.0.1
v1.0.1
Overview
Architecture
Architecture
Reference architecture
Deployment
Deployment
Technical requirements
Network requirements
The deployment process
Configure the deployment
Deploy the platform
Operations
Operations
Set up the first administrator account
Use the SHC interface
Import the CTI database
Back up the platform
Update the security content
Apply a configuration change
Rotate the certificate and credentials
Patch and restart the nodes
Reset or destroy the platform
Monitoring and troubleshooting
Monitoring and troubleshooting
Monitor your platform
Run platform diagnostics
Platform alerts reference
Debug your deployment
Release notes
API Documentation
API Documentation
API Reference
Quickstart
Filtering
Tutorials
Tutorials
Overview
Search for rules
Create a SIGMA rule
Search events
C45508cd cfd8 459b ad65 f085a38d9554
Redirecting...
Redirecting...
Back to top