Skip to content

Sekoia Documentation

Retarus

Initializing search

Sekoia Solutions
Getting started
Usecases
FAQ and troubleshooting
Integrations
API Documentation

Sekoia Documentation

Sekoia Solutions
Sekoia Solutions
- The Sekoia AI SOC Platform
- Threat Context (Intelligence)
  Threat Context (Intelligence)
  - Intelligence overview
  - Data Models
  - Consume
    Consume
    
    Intelligence
    
    Observables
    
    Telemetry
    
    Feeds
    Feeds
    
    Understand the feeds
    
    Create feeds
    
    Manage feeds
    
    Create a detection rule from a feed
    
    Graph Explorations
    
    Reports
    Reports
    
    FLINT Reports
    
    External Reports
    
    Export
    
    IOCs Collections
  - Monitor
    Monitor
    
    Dashboards
    
    Threat Landscape
  - External Integrations
    External Integrations
    
    Overview
    
    API
    
    TAXII
    
    Cortex Analyzer
    
    MISP Feed
    
    MISP - Import to IOC Collection
    
    Microsoft Sentinel
    
    OpenCTI Import Connector
    
    OpenCTI Stream Connector
    
    Splunk
    
    Splunk SOAR
    
    Swimlane Turbine
    
    Anomali ThreatStream
    
    PaloAlto Cortex XSOAR
    
    PaloAlto Cortex XSIAM
    
    ThreatQuotient
    
    Torq
- Detect, Hunt and Respond (Defend)
  Detect, Hunt and Respond (Defend)
  - Defend overview
  - Quick start guide
  - Collect
    Collect
    
    Integrations
    
    Update a custom integration
    
    Intakes
    
    Entities
    
    Assets
    
    Optimization rules
    Optimization rules
    
    Optimization rules overview
    
    Create an optimization rule
    
    Optimization rules technical references
  - Detect
    Detect
    
    IOCs Detection
    
    Rules Catalog
    
    Built-in Rules
    
    Built-in Geolocalisation
    
    Sigma
    
    Anomaly Detection
    
    IOCs Collections
    
    SOL detection rules
    SOL detection rules
    
    SOL detection rules overview
    
    Create a SOL detection rule
    
    Create an Event Drop rule
    
    Alert similarity
    
    Lag management
  - Investigate
    Investigate
    
    Alerts
    Alerts
    
    Alerts overview
    
    Alerts listing
    
    Alerts details
    
    Events page
    
    Eternal events
    
    Massive event export
    Massive event export
    
    Understand massive event export
    
    Export events with CLI
    
    Export events with API
    
    Massive export technical specifications
    
    Massive event export troubleshooting
    
    Cases
    Cases
    
    Cases overview
    
    Create and manage cases
    Create and manage cases
    
    Create a case
    
    Manage cases
    
    Case templates
    Case templates
    
    Case templates overview
    
    Create a case template
    
    Apply a case template
    
    Investigate cases
    Investigate cases
    
    Investigate case details
    
    Graph investigation
    
    AI Cases
    
    Run a playbook from a case
    
    Custom fields
    Custom fields
    
    Custom fields overview
    
    Use custom fields
    
    Manage custom field definitions
    
    Query custom fields
    
    Custom statuses
    Custom statuses
    
    Custom statuses overview
    
    Manage custom statuses
    
    Migrate custom statuses
    
    Custom verdicts
    
    Custom priorities
    
    Asset Context Panel
    
    Events Query Language
    
    Querying Events
    
    Query Builder
    Query Builder
    
    Discover the query builder
    
    Create and manage queries
    
    Share and duplicate queries
    
    Data visualization guide
    
    Query builder form mode reference
    
    Sekoia Operating Language
    Sekoia Operating Language
    
    SOL overview
    
    Getting started
    
    Understand SOL performance
    
    How-to guides
    
    SOL Datasets
    
    Query examples
    
    Reference: Datasources
    
    Reference: Operators
    
    Reference: Functions
    
    Notebooks
  - Report
    Report
    
    Dashboards
    Dashboards
    
    Understanding dashboards
    
    Create and manage dashboards
    
    Configure widgets and layout
    
    Filter data in dashboards
    
    Share dashboards
    
    Built-in widgets reference
    
    Threat Landscape
  - Automate
    Automate
    
    Playbooks
    
    Playbooks On-premises
    
    Manage accounts
    
    Navigate playbooks
    
    Build playbooks
    
    Triggers
    
    Operators
    
    Actions
    
    Debug playbooks
    
    Playbooks JSON Schema
  - External integrations
    External integrations
    
    FortiSOAR
    
    Harven
    
    Palo Alto Cortex XSOAR
    
    Qevlar
    
    Swimlane Turbine
- AI Agents (Elevate)
  AI Agents (Elevate)
  - Elevate overview
  - The investigation method
  - Elevate kick start guide
    Elevate kick start guide
    
    Activate Elevate
    
    Elevate analysis states
  - Investigate with Elevate
    Investigate with Elevate
    
    Investigate an alert
    
    Audit with Traces
    
    Override a verdict
    
    Trigger an analysis
  - Tune Elevate agents
    Tune Elevate agents
    
    Add custom instructions
    
    Customize a detection rule's runbook
    
    Write effective instructions
  - Manage Elevate
    Manage Elevate
    
    Override community settings
    
    Limit auto-analysis to specific rules
    
    Manage Elevate runs
- Asset Intelligence (Reveal)
  Asset Intelligence (Reveal)
  - Reveal overview
  - Get started with Reveal
    Get started with Reveal
    
    Reveal quick start guide
    
    Reveal enablement matrix
  - Asset connectors
    Asset connectors
    
    Create asset connectors
    
    Check asset connector health
    
    Troubleshoot asset connectors
  - Investigate assets
    Investigate assets
    
    Explore assets context
    
    Visualize attack paths
    
    Discover Points of Interest
    
    Check Endpoint Hygiene
    
    Leverage Vulnerability Enrichment
    
    Rely on Security Controls
Getting started
Getting started
- Overview
- Where to start
- Trainings
  Trainings
  - Training offer overview
  - Register for a training course
- Workspace setup
  Workspace setup
  - Join workspace
  - Create and manage communities
- Account setup
  Account setup
  - Create account
  - Setup account
- Security and access
  Security and access
  - Account security
    Account security
    
    Two-Factor Authentication
    
    Security tokens
    
    Password Management Policy
  - Workspace security
    Workspace security
    
    Session duration
    
    Two-Factor Authentication
    
    SSO with OpenID Connect
    
    SSO with Microsoft Entra ID (Azure AD)
    
    SSO with Okta
- Users and roles
  Users and roles
  - Invite users
  - Manage users
  - Deactivate inactive users
  - Roles and permissions
    Roles and permissions
    
    Built-in roles
    
    Custom roles
    
    Intake Restricted roles
- Notifications
  Notifications
- API Keys
- Subscriptions
  Subscriptions
- Usage
- Usage
- Sekoia regions
- Roy AI Assistant
- Best practices
- Troubleshooting tips
Usecases
Usecases
FAQ and troubleshooting
FAQ and troubleshooting
- General
- Alerts
- Events
  Events
- Storage
  Storage
- Intelligence
  Intelligence
- Assets
- Ingestion
  Ingestion
  - Delay with event ingestion or alert creation
- Sekoia.io Endpoint agent
- Datetime representation
- Reveal troubleshooting
Integrations
Integrations
- Introduction
- Ingestion methods
  Ingestion methods
  - Overview
  - Cloud & SaaS
    Cloud & SaaS
    
    Overview
    
    AWS S3
    
    Azure Event Hub
    
    Google Pub/Sub
  - HTTPS
    HTTPS
    
    Overview
    
    Formatting options
    
    Compression
    
    Forwarding logs using a third-party application
    
    Graylog
    
    Logstash
  - Syslog
    Syslog
    
    Overview
    
    Sekoia.io Forwarder
    
    Reduce volume in the Sekoia Forwarder
    
    Third-party syslog services
    
    Rsyslog
    
    Filter logs with Rsyslog
    
    Syslog NG
    
    Filter logs with Syslog-ng
    
    Secured forwarding
  - NetFlow
    NetFlow
    
    Sekoia.io NetFlow Concentrator
- List of Intakes
  List of Intakes
- List of Playbooks Actions
  List of Playbooks Actions
  - Applicative
    Applicative
    
    ElasticSearch
    
    Mandrill
    
    Mattermost
    
    New Relic
    
    PagerDuty
    
    ilert
  - Cloud Providers
    Cloud Providers
    
    AWS
    
    Azure Monitor
    
    Google Cloud
  - Collaboration Tools
    Collaboration Tools
    
    Atlassian JIRA
    
    Git
    
    ServiceNow
    
    The Hive
    
    The Hive V5
  - Email
    Email
    
    Microsoft Outlook
  - Endpoint
    Endpoint
    
    Bitdefender GravityZone
    
    CrowdStrike Falcon
    
    Eset
    
    HarfangLab
    
    Microsoft Windows Server
    
    MicrosoftDefenderXDR
    
    Palo Alto Cortex XDR (EDR)
    
    Palo Alto Cortex XSIAM
    
    Panda Security
    
    SentinelOne
    
    Sophos
    
    Stormshield SES
    
    TrendMicro VisionOne
    
    WithSecure
  - Generic
    Generic
    
    HTTP
    
    OpenAI
    
    RSS
    
    Sekoia.io
    
    Utils
  - IAM
    IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
  - Network
    Network
    
    DNS
    
    Fortigate Firewalls
    
    Sophos
    
    Stormshield
    
    Zscaler
  - Overview
  - Threat Intelligence
    Threat Intelligence
    
    Censys
    
    Certificate Transparency
    
    Detection Rules
    
    Digital Shadows
    
    GLIMPS
    
    IKnowWhatYouDownload
    
    IPInfo
    
    IPtoASN
    
    MISP
    
    MWDB
    
    OSINT
    
    Onyphe
    
    Public Suffix
    
    Shodan
    
    Tranco
    
    Triage
    
    VirusTotal
    
    Whois
- List of Asset Connectors
  List of Asset Connectors
  - Overview
  - Vulnerability
    Vulnerability
    
    ESET EDR
    
    Holm Security
    
    Tenable.io
  - Device
    Device
    
    AWS EC2
    
    Crowdstrike Falcon
    
    ESET EDR
    
    Harfanglab EDR
    
    Holm Security
    
    Microsoft Defender XDR (Microsoft 365 Defender)
    
    Okta
    
    SentinelOne EDR
    
    Sophos EDR
  - Software
    Software
    
    HarfangLab EDR
  - User
    User
    
    AWS IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
    
    Okta
    
    Sophos EDR
- How to develop a new Integration
  How to develop a new Integration
  - Overview
  - Automation
    Automation
    
    Overview
    
    Action
    
    Create a Module
    
    Development Guidelines
    
    Module
    
    Trigger
  - Formats
    Formats
    
    Overview
    
    Create a Format
    
    Datasources
    
    Definition of a structured event
    
    Definition of the taxonomy
    
    How to write a parser
    
    How to write smart descriptions
    
    Troubleshooting
    
    Best Practices
    Best Practices
    
    Overview
    
    Authentications
    
    Networks
    
    Endpoints
- FAQ
  FAQ
  - Overview
  - General Questions
    General Questions
    
    Bug VS Improvement Requests
API Documentation
API Documentation
- API Reference
- Quickstart
- Filtering
- Tutorials
  Tutorials

Table of contents

Configuration
Extra

Was this page helpful?

Retarus

Retarus

Retarus connector

Configuration

This module accepts no configuration.

Extra

Module Retarus v1.1.2

Copyright © 2026 - Sekoia

Made with Material for MkDocs