Analyst manual

• Security Posture
  • Top Menu Bar Options
  • Operational Center
• Analyzing Compromises
  • Declaration of Compromise^®
• Analyzing Violations
  • Declaration of Policy Violation^®
• Analytics
  • Beaconing
  • Sightings
  • Detection Methods
  • Newly Registered Domains (NRD)
  • SMB Insights
  • Anatomy of a detection event
  • Additional resources
• Encryption
  • Introduction / Setup
  • Logs and detection
  • Machine Learning-Enabled TLS Beaconing Detection
  • Decryption
• Evidence
• Hunting
  • Introduction
  • Top Menu Bar Options
  • Understanding the search
  • Keyboard shortcuts
  • Hunting Examples
• Hunting Filters
  • Default hunting filters
  • Proactive Threat Hunting
  • Introduction to Guided Threat Hunting Filter Sets
  • User Defined Filters
  • IP Filter
  • ES Filters
  • Specific Filters
  • Creating Filter Sets
  • Complete List of Predefined Hunting Filter Sets
  • After the Initial Hunt
• Kibana Dashboards
  • Export Kibana visualizations as CSV file
  • Export Kibana visualizations and dashbords from Stack Management
  • Edit Kibana visualizations
  • Create Kibana visualizations
• Dashboards and Visualizations Reference
  • Dashboard: SN-ALERTS
  • Dashboard: SN-ALERTS-CVE
  • Dashboard: SN-ALERTS-EXE-HUNT-1
  • Dashboard: SN-ALERTS-PHISHING
  • Dashboard: SN-ALL
  • Dashboard: SN-ANOMALY
  • Dashboard: SN-BEACONING-TLS
  • Dashboard: SN-DCERPC
  • Dashboard: SN-DHCP
  • Dashboard: SN-DNP3
  • Dashboard: SN-DNS
  • Dashboard: SN-DNS-HUNT-Tunnel
  • Dashboard: SN-FILE-Transactions
  • Dashboard: SN-FLOW
  • Dashboard: SN-FLOW-DCERPC
  • Dashboard: SN-FLOW-DHCP
  • Dashboard: SN-FLOW-DNP3
  • Dashboard: SN-FLOW-DNS
  • Dashboard: SN-FLOW-ENIP
  • Dashboard: SN-FLOW-FTP
  • Dashboard: SN-FLOW-FTP-DATA
  • Dashboard: SN-FLOW-HTTP
  • Dashboard: SN-FLOW-HTTP2
  • Dashboard: SN-FLOW-HUNT-DNS-EXFIL
  • Dashboard: SN-FLOW-HUNT-ICMP-Possible-EXFIL
  • Dashboard: SN-FLOW-IKE
  • Dashboard: SN-FLOW-KRB5
  • Dashboard: SN-FLOW-MODBUS
  • Dashboard: SN-FLOW-MQTT
  • Dashboard: SN-FLOW-NFS
  • Dashboard: SN-FLOW-NTP
  • Dashboard: SN-FLOW-RFB
  • Dashboard: SN-FLOW-SIEMENS-S7
  • Dashboard: SN-FLOW-SIP
  • Dashboard: SN-FLOW-SIZE
  • Dashboard: SN-FLOW-SMB
  • Dashboard: SN-FLOW-SMTP
  • Dashboard: SN-FLOW-SNMP
  • Dashboard: SN-FLOW-SSH
  • Dashboard: SN-FLOW-TCP
  • Dashboard: SN-FLOW-TELNET
  • Dashboard: SN-FLOW-TFTP
  • Dashboard: SN-FLOW-TLS
  • Dashboard: SN-FLOW-UDP
  • Dashboard: SN-HTTP
  • Dashboard: SN-HTTP-HUNT
  • Dashboard: SN-HUNT-1
  • Dashboard: SN-IDS
  • Dashboard: SN-IKEv2
  • Dashboard: SN-IoC-Search
  • Dashboard: SN-KRB5
  • Dashboard: SN-MQTT
  • Dashboard: SN-Network-Overview
  • Dashboard: SN-Network-Overview-1
  • Dashboard: SN-Network-Overview-2
  • Dashboard: SN-NFS
  • Dashboard: SN-OVERVIEW
  • Dashboard: SN-POLICY-OLD-TLS
  • Dashboard: SN-POLICY-Violations
  • Dashboard: SN-POSTPROC-Stats
  • Dashboard: SN-Proxy
  • Dashboard: SN-RDP
  • Dashboard: SN-RFB
  • Dashboard: SN-SIGHTINGS
  • Dashboard: SN-SIGNATURE-Performance
  • Dashboard: SN-SIP
  • Dashboard: SN-SMB
  • Dashboard: SN-SMB-DCERPC-Lateral-1
  • Dashboard: SN-SMB_INSIGHTS
  • Dashboard: SN-SMTP
  • Dashboard: SN-SNMP
  • Dashboard: SN-SSH
  • Dashboard: SN-STAMUS
  • Dashboard: SN-STATS
  • Dashboard: SN-TFTP
  • Dashboard: SN-TLS
  • Dashboard: SN-TrafficID
  • Dashboard: SN-VLAN