Sekoia Documentation

2f1c1e9b 7b8e 4150 879e 62a2a146c3c5

Initializing search

Getting started
Sekoia Solutions
Usecases
FAQ and troubleshooting
Integrations
Self-hosted deployment
API Documentation

Sekoia Documentation

Getting started
Getting started
- Welcome to Sekoia
- Understand Sekoia
  Understand Sekoia
- Set up your account
  Set up your account
- Understand your subscription and usage
  Understand your subscription and usage
- Set up your workspace (Admin)
  Set up your workspace (Admin)
  - Workspace setup overview
  - Users and roles
    Users and roles
    
    Invite users
    
    Manage users
    
    Roles and permissions
  - Manage API keys
  - Notifications
    Notifications
    
    Notification system overview
    
    Create a notification
    
    Manage notifications
    
    Notification examples
- Quick starts
  Quick starts
  - Defend
    Defend
    
    Quick start: Defend
    
    Step 1: Connect a data source
    
    Step 2: Verify event reception
    
    Step 3: Activate detection rules
    
    Step 4: Triage your first alert
    
    Step 5: Automate with playbooks
    
    Defend best practices
  - Intelligence
    Intelligence
    
    Quick start: Intelligence
    
    Step 1: Explore the threat intelligence database
    
    Step 2: Investigate and disseminate threat intelligence
  - Reveal
    Reveal
    
    Quick start: Reveal
  - Elevate
    Elevate
    
    Quick start: Elevate
- Training
  Training
  - Training offer overview
  - Register for a training course
- Get help
  Get help
Sekoia Solutions
Sekoia Solutions
- The Sekoia AI SOC Platform
- Threat Context (Intelligence)
  Threat Context (Intelligence)
  - Intelligence overview
  - Data Models
  - Consume
    Consume
    
    Intelligence
    
    Investigate an object
    
    Observables
    
    Telemetry
    
    Feeds
    Feeds
    
    Understand the feeds
    
    Create feeds
    
    Manage feeds
    
    Create a detection rule from a feed
    
    Graph Explorations
    
    Reports
    Reports
    
    FLINT Reports
    
    External Reports
    
    Export
    
    IOCs Collections
  - Monitor
    Monitor
    
    Dashboards
    
    Threat Landscape
  - External Integrations
    External Integrations
    
    Overview
    
    API
    
    TAXII
    
    Cortex Analyzer
    
    MISP Feed
    
    MISP - Import to IOC Collection
    
    Microsoft Sentinel
    
    OpenCTI Import Connector
    
    OpenCTI Stream Connector
    
    Splunk
    
    Splunk SOAR
    
    Swimlane Turbine
    
    Anomali ThreatStream
    
    PaloAlto Cortex XSOAR
    
    PaloAlto Cortex XSIAM
    
    ThreatQuotient
    
    Torq
- Detect, Hunt and Respond (Defend)
  Detect, Hunt and Respond (Defend)
  - Defend overview
  - Quick start guide
  - Collect
    Collect
    
    Integrations
    
    Update a custom integration
    
    Intakes
    
    Entities
    
    Assets
    
    Optimization rules
    Optimization rules
    
    Optimization rules overview
    
    Create an optimization rule
    
    Optimization rules technical references
  - Detect
    Detect
    
    IOCs Detection
    
    Rules Catalog
    
    Built-in Rules
    
    Built-in Geolocalisation
    
    Sigma
    
    Anomaly Detection
    
    IOCs Collections
    
    SOL detection rules
    SOL detection rules
    
    SOL detection rules overview
    
    Create a SOL detection rule
    
    Create an Event Drop rule
    
    Alert similarity
    
    Lag management
  - Investigate
    Investigate
    
    Alerts
    Alerts
    
    Alerts overview
    
    Alerts listing
    
    Alerts details
    
    Events page
    
    Eternal events
    
    Massive event export
    Massive event export
    
    Understand massive event export
    
    Export events with CLI
    
    Export events with API
    
    Massive export technical specifications
    
    Massive event export troubleshooting
    
    Cases
    Cases
    
    Cases overview
    
    Create and manage cases
    Create and manage cases
    
    Create a case
    
    Manage cases
    
    Case custom views
    
    Manage case custom views
    
    Case templates
    Case templates
    
    Case templates overview
    
    Create a case template
    
    Apply a case template
    
    Investigate cases
    Investigate cases
    
    Investigate case details
    
    Graph investigation
    
    AI Cases
    
    Run a playbook from a case
    
    Custom fields
    Custom fields
    
    Custom fields overview
    
    Use custom fields
    
    Manage custom field definitions
    
    Query custom fields
    
    Custom statuses
    Custom statuses
    
    Custom statuses overview
    
    Manage custom statuses
    
    Migrate custom statuses
    
    Custom verdicts
    
    Custom priorities
    
    Asset Context Panel
    
    Interpret asset risk scores
    
    Events Query Language
    
    Querying Events
    
    Query Builder
    Query Builder
    
    Discover the query builder
    
    Create and manage queries
    
    Share and duplicate queries
    
    Data visualization guide
    
    Query builder form mode reference
    
    Sekoia Operating Language
    Sekoia Operating Language
    
    SOL overview
    
    Getting started
    
    Understand SOL performance
    
    How-to guides
    
    SOL Datasets
    
    Query examples
    
    Reference: Datasources
    
    Reference: Operators
    
    Reference: Functions
    
    Notebooks
  - Report
    Report
    
    Dashboards
    Dashboards
    
    Understanding dashboards
    
    Create and manage dashboards
    
    Configure widgets and layout
    
    Filter data in dashboards
    
    Share dashboards
    
    Built-in widgets reference
    
    Threat Landscape
  - Automate
    Automate
    
    Playbooks
    
    Playbooks On-premises
    
    Manage accounts
    
    Navigate playbooks
    
    Build playbooks
    
    Organize playbooks with custom fields
    
    Restore a playbook version
    
    Triggers
    
    Operators
    
    Actions
    
    Debug playbooks
    
    Playbooks JSON Schema
  - External integrations
    External integrations
    
    FortiSOAR
    
    Harven
    
    Palo Alto Cortex XSOAR
    
    Qevlar
    
    Swimlane Turbine
- AI Agents (Elevate)
  AI Agents (Elevate)
  - Elevate overview
  - The investigation method
  - Elevate kick start guide
    Elevate kick start guide
    
    Activate Elevate
    
    Elevate analysis states
  - Investigate with Elevate
    Investigate with Elevate
    
    Investigate an alert
    
    Audit with Traces
    
    Override a verdict
    
    Trigger an analysis
  - Tune Elevate agents
    Tune Elevate agents
    
    Add custom instructions
    
    Customize a detection rule's runbook
    
    Write effective instructions
  - Manage Elevate
    Manage Elevate
    
    Override community settings
    
    Scope auto-analysis with filters
    
    Manage Elevate runs
    
    Measure Elevate impact
- Asset Intelligence (Reveal)
  Asset Intelligence (Reveal)
  - Reveal overview
  - Get started with Reveal
    Get started with Reveal
    
    Reveal quick start guide
    
    Reveal enablement matrix
  - Asset connectors
    Asset connectors
    
    Create asset connectors
    
    Check asset connector health
    
    Troubleshoot asset connectors
  - Investigate assets
    Investigate assets
    
    Explore assets context
    
    Asset risk scoring
    
    Visualize attack paths
    
    Discover Points of Interest
    
    Check Endpoint Hygiene
    
    Leverage Vulnerability Enrichment
    
    Discover installed Applications status
    
    Rely on Security Controls
- Settings
  Settings
  - Subscriptions
    Subscriptions
    
    Subscriptions overview
    
    Create a subscription
    
    Assign a subscription
    
    Subscription notifications
  - Advanced configuration
    Advanced configuration
    
    Security and access
    Security and access
    
    Security tokens
    
    Password management policy
    
    Session duration
    
    Workspace two-factor authentication
    
    SSO with OpenID Connect
    
    SSO with Microsoft Entra ID
    
    SSO with Okta
    
    User lifecycle
    User lifecycle
    
    Deactivate inactive users
    
    Reference
    Reference
    
    Sekoia regions
Usecases
Usecases
FAQ and troubleshooting
FAQ and troubleshooting
- General
- Alerts
- Events
  Events
- Storage
  Storage
- Intelligence
  Intelligence
- Assets
- Ingestion
  Ingestion
  - Delay with event ingestion or alert creation
- Sekoia.io Endpoint agent
- Datetime representation
- Reveal troubleshooting
  Reveal troubleshooting
  - Troubleshoot Reveal module first steps
  - Troubleshoot application inventory
Integrations
Integrations
- Introduction
- Ingestion methods
  Ingestion methods
  - Overview
  - Cloud & SaaS
    Cloud & SaaS
    
    Overview
    
    AWS S3
    
    Azure Event Hub
    
    Google Pub/Sub
  - HTTPS
    HTTPS
    
    Overview
    
    Formatting options
    
    Compression
    
    Forwarding logs using a third-party application
    
    Graylog
    
    Logstash
  - Syslog
    Syslog
    
    Overview
    
    Configure the Sekoia.io Forwarder
    
    Route multiple technologies through one port
    
    Secure forwarder inputs with TLS
    
    Monitor the Sekoia.io Forwarder
    
    Reduce volume in the Sekoia Forwarder
    
    Troubleshoot the Sekoia.io Forwarder
    
    Third-party syslog services
    
    Rsyslog
    
    Filter logs with Rsyslog
    
    Syslog NG
    
    Filter logs with Syslog-ng
    
    Secured forwarding
  - NetFlow
    NetFlow
    
    Sekoia.io NetFlow Concentrator
- List of Intakes
  List of Intakes
- List of Playbooks Actions
  List of Playbooks Actions
  - Applicative
    Applicative
    
    ElasticSearch
    
    Mandrill
    
    Mattermost
    
    New Relic
    
    PagerDuty
    
    ilert
  - Cloud Providers
    Cloud Providers
    
    AWS
    
    Azure Monitor
    
    Google Cloud
  - Collaboration Tools
    Collaboration Tools
    
    Atlassian JIRA
    
    Git
    
    ServiceNow
    
    The Hive
    
    The Hive V5
  - Email
    Email
    
    Microsoft Outlook
  - Endpoint
    Endpoint
    
    Bitdefender GravityZone
    
    CrowdStrike Falcon
    
    Eset
    
    HarfangLab
    
    Microsoft Windows Server
    
    MicrosoftDefenderXDR
    
    Palo Alto Cortex XDR (EDR)
    
    Palo Alto Cortex XSIAM
    
    Panda Security
    
    SentinelOne
    
    Sophos
    
    Stormshield SES
    
    TrendMicro VisionOne
    
    WithSecure
  - Generic
    Generic
    
    HTTP
    
    OpenAI
    
    RSS
    
    Sekoia.io
    
    Utils
  - IAM
    IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
  - Network
    Network
    
    DNS
    
    Fortigate Firewalls
    
    Sophos
    
    Stormshield
    
    Zscaler
  - Overview
  - Threat Intelligence
    Threat Intelligence
    
    Censys
    
    Certificate Transparency
    
    Detection Rules
    
    Digital Shadows
    
    GLIMPS
    
    IKnowWhatYouDownload
    
    IPInfo
    
    IPtoASN
    
    MISP
    
    MWDB
    
    OSINT
    
    Onyphe
    
    Public Suffix
    
    Shodan
    
    Tranco
    
    Triage
    
    VirusTotal
    
    Whois
- List of Asset Connectors
  List of Asset Connectors
  - Overview
  - Vulnerability
    Vulnerability
    
    ESET EDR
    
    Holm Security
    
    Microsoft Defender XDR (Microsoft 365 Defender)
    
    Tenable.io
  - Device
    Device
    
    AWS EC2
    
    Crowdstrike Falcon
    
    ESET EDR
    
    Harfanglab EDR
    
    Holm Security
    
    Microsoft Defender XDR (Microsoft 365 Defender)
    
    Nozomi Networks
    
    Okta
    
    SentinelOne EDR
    
    Sophos EDR
  - Software
    Software
    
    HarfangLab EDR
    
    Sekoia Endpoint Agent
  - User
    User
    
    AWS IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
    
    Okta
    
    Sophos EDR
- How to develop a new Integration
  How to develop a new Integration
  - Overview
  - Automation
    Automation
    
    Overview
    
    Action
    
    Create a Module
    
    Development Guidelines
    
    Module
    
    Trigger
  - Formats
    Formats
    
    Overview
    
    Create a Format
    
    Datasources
    
    Definition of a structured event
    
    Definition of the taxonomy
    
    How to write a parser
    
    How to write smart descriptions
    
    Troubleshooting
    
    Best Practices
    Best Practices
    
    Overview
    
    Authentications
    
    Networks
    
    Endpoints
- FAQ
  FAQ
  - Overview
  - General Questions
    General Questions
    
    Bug VS Improvement Requests
Self-hosted deployment
Self-hosted deployment
- Introduction
- Documentation versions
- v1.0.1
  v1.0.1
  - Overview
  - Architecture
    Architecture
    
    Reference architecture
  - Deployment
    Deployment
    
    Technical requirements
    
    Network requirements
    
    The deployment process
    
    Configure the deployment
    
    Deploy the platform
  - Operations
    Operations
    
    Set up the first administrator account
    
    Use the SHC interface
    
    Import the CTI database
    
    Back up the platform
    
    Update the security content
    
    Apply a configuration change
    
    Rotate the certificate and credentials
    
    Patch and restart the nodes
    
    Reset or destroy the platform
  - Monitoring and troubleshooting
    Monitoring and troubleshooting
    
    Monitor your platform
    
    Run platform diagnostics
    
    Platform alerts reference
    
    Debug your deployment
  - Release notes
API Documentation
API Documentation
- API Reference
- Quickstart
- Filtering
- Tutorials
  Tutorials

2f1c1e9b 7b8e 4150 879e 62a2a146c3c5

Redirecting... Redirecting...

Copyright © 2026 - Sekoia

Made with Material for MkDocs