Warning: You are viewing an older version of this documentation. Most recent is here: 40.0.1
Table of Contents¶
- Concepts
- Approaching Threat Hunting
- Declaration of Compromise
- Detection and Event Enrichment Flow
- The Most Powerful Capabilities
- Stamus Security Platform
- Stamus Central Server
- Stamus Networks Probe
- Security Posture
- Compromises
- Analytics
- Beaconing
- Sightings
- Signatures
- Newly Registered Domains (NRD)
- Anatomy of a detection event
- Application layer
- Flow_id
- Flow section
- Metadata section (flowbits)
- FQDN breakdown for HTTP, TLS and DNS
- Tagging and Classification
- SMTP Enrichment
- Source and Target
- Organisational Context
- MAC address
- FQDN additions
- Discovery info
- GeoIP
- TLS Cipher analytics
- TLS JA4
- TLS ALPN
- DCERPC function name mappings
- Number of transactions in a flow
- SSH hassh, client and server software
- Additional resources
- Hunting
- Hunting Filters
- Kibana Dashboards
- Feature Request
- Administration
- Overview
- Authentication
- SCS settings
- Capture Settings
- Network Security Monitoring Settings
- Change NSM settings for a probe
- Enable or disable protocols for a probe
- Common settings for protocols
- Add custom or extended HTTP information
- Add custom or extended SMTP information
- Add custom DNS information
- Add packet data or payload to the alerts information
- File handling capabilities
- Enable or disable file extraction for a probe
- Add Hahsum, file magic or mimetype information
- Rule Activity for a probe
- Declarations of Compromise
- Events Filtering
- File Extraction
- Conditional PCAP logging
- Global Configuration
- Network Definitions
- Probe Registration
- Probe Templates
- Stamus Loggers
- Run Your Own Defense (RYOD)
- Sources & Rulesets
- Splunk
- Suricata Sensors
- Threat Intelligence
- Webhooks
- Architectures
- Maintenance
- Developer Corner
- Community