Administration

• Overview
  • Interface Overview
• Authentication
  • Local Authentication
  • Authentication (LDAP, local)
  • Authentication using the SAML protocol
• SCS settings
  • Use a proxy
  • Use elasticsearch
  • Use an external Elasticsearch server
  • Custom login page banner text
  • Automatic logout
• Capture Settings
  • Change interface settings for a probe
  • Add Berkeley packet filter to adjust probes inspection
  • Add threads to an interface inspection on a probe
  • Network card load balancing
• Network Security Monitoring Settings
  • Change NSM settings for a probe
  • Enable or disable protocols for a probe
  • Common settings for protocols
  • Add custom or extended HTTP information
  • Add custom or extended SMTP information
  • Add custom DNS information
  • Add packet data or payload to the alerts information
  • File handling capabilities
  • Enable or disable file extraction for a probe
  • Add Hahsum, file magic or mimetype information
  • Rule Activity for a probe
• Declarations of Compromise
  • Declarations of Compromise (DoC) Overview and Key Features
  • Custom Declarations of Compromise
  • Editing/Deleting a Custom Declaration of Compromise
  • DoC Suppression
  • Email Notifications for DoC Events
• Declarations of Policy Violation
  • Declarations of Policy Violation (DoPV) Overview and Key Features
  • Custom Declarations of Policy Violations
  • DoPV Suppression
• Events Filtering
  • Filters
• File Extraction
  • Concept
  • File Extraction Activation
  • How File Extraction Works
  • Getting Files from the REST-API
• Conditional PCAP logging
  • Concept
  • Conditional PCAP Activation
  • How Conditional PCAP logging works
  • Rest API pcap file extraction automation
• Global Configuration
  • HTTPS
  • Certificate authority
  • Log retention
  • Database status and health
  • Forwarding Events (output plugin)
  • Sending Emails
  • NTP
  • Stamus Probe Global Parameters
  • Expert configuration
• Network Definitions
  • Introduction
  • Managing Network Definitions
  • Assigning a Network Definition
  • Known Bug
• Probe Registration
  • Registering a Stamus Network Probe
  • Register a Stamus Network Probe via SSL VPN
  • Enable VPN proxy on Network Probes
  • Finish registration of a Stamus Probe
  • Remove/delete a probe
  • Retry probe registration
• Probe Templates
  • Using Templates
  • Override Settings
  • Template Inheritance
  • Delete Template
• Stamus Loggers
  • Setting up Stamus Loggers
• Run Your Own Defense (RYOD)
  • Introduction
  • Basic usage
  • Container lifecycle
  • Backup
  • Disable RYOD
  • Log rotation RYOD
• Sources & Rulesets
  • Overview
  • Definitions
  • Sources
  • Rulesets
  • Using Custom Rules
  • Threat Intelligence Sources for Datasets
  • Suppression and Thresholding
  • Rule Transformations
  • Custom Suricata keywords
  • Suricata keywords recommendations
  • Suricata signature rule writing guidelines
• Splunk
  • Forwarding SCS logs to Splunk
  • Stamus App for Splunk
• Suricata Sensors
  • Alerts Enrichment
  • Register a Suricata Sensor
• Threat Intelligence
  • Threats Update
  • Homoglyph Attacks
  • IP Reputation List
• Webhooks
  • What are Webhooks?
  • Objects & Variables
  • Conditional webhooks
  • Examples
• External Links Templates
  • Concept
  • Key Features
  • Creating a Template
  • Using the Template
  • Example Usage
  • Detailed Insight from External Databases