SIEM
A series of helpful how-to guides on all things SIEM related.
By Alan and 1 other2 authors28 articles
General
A series of helpful guides on general SIEM topics
- Introduction to Lucene QueriesA quick introduction to how you can query your log data in Defense.com's log search using Lucene Query Language.
- Understanding RunbooksThis guide provides a high-level overview of runbooks and the role they play within our SIEM/SOC services.
- How to manage SIEM runbook suppressionThis guide will walk you through everything you need to start managing and tuning the detections and alerts generated by our SIEM platform.
- How to create scheduled reportsThis guide will show you how to create scheduled reports from saved detection rules.
- How to create saved detection rulesThis guide will walk you through how to create and save detection rules.
- How to run the Linux Troubleshooting ScriptThis guide walks you through downloading and running the troubleshooting script on a Linux system to collect diagnostic information.
- How to run the Windows troubleshooting scriptThis guide walks you through downloading and running the troubleshooting script on a Windows system to collect diagnostic information.
- How to configure file integrity monitoring on WindowsUnderstand how to configure Windows to log file integrity-related events and ship these to our SIEM platform.
- Architectural Overview: Data Sovereignty & Pipeline SecurityLearn how Defense.com can deliver data sovereign security services at scale.
- How to close security eventsThis guide covers all you need to know about how to close open security events.
Collectors
A series of helpful how-to guides on Installing, configuring and troubleshooting SIEM Collectors
Agents
A series of helpful how-to guides on Installing, configuring and troubleshooting SIEM Agents