Connecting log sources, how events are normalised, the detection library, tuning a rule, search, dashboards and retention.
32 articles
Logs and detection
An API reference: run a pipe query as a background job, poll and page it, and the 40 built-in ATT&CK hunts, bookmarks and saved snapshots — none of this has a console screen yet.
Logs and detection
What runs on incident create and update, the seven action types, the precise conditions under which a playbook actually fires versus only ever proposing one, and the proposals queue.
Logs and detection
The platform learns each person's normal hours, country and daily volume, then stamps four fields on every event. What it measures, how long it takes, and the three-sigma line.
Logs and detection
Reading CloudTrail from an S3 bucket: what it configures, what the logs actually contain, the SigV4 signing we implement, and where this source stops.
Logs and detection
What the parser reads from a Cloudflare HTTP request log, which fields reach a searchable column, and how to tell a WAF block from a 404.
Logs and detection
Reading the Admin SDK Reports API: which activity reports we pull, why the token report matters most, and what domain-wide delegation actually costs you.
Logs and detection
Sending auditd records to Qorionix: the two routes in, which fields are extracted, and which record types reach the shipped execution detections.
Logs and detection
The highest-value log source: how it is configured, which activity feeds we read, why Audit.AzureActiveDirectory is the one that matters, and its honest status.
Logs and detection
There is no Okta poller — you forward. How to do it, what Okta's own fields become, why replaying a page is safe, and which events land in the catch-all category.
Logs and detection
RFC 3164 and 5424 over TLS on port 6514, which devices use it, the private CA your sender must trust, and the address-to-tenant registration every appliance needs before a single line is kept.
Logs and detection
Which Windows channels are read, how events reach the platform, what Sysmon adds and whether you need it, and the event IDs that carry most of the value.
Logs and detection
Declare a codeless HTTP polling connector — endpoint, auth, pagination, a JSON path to the record array — and the platform polls it and normalises every record with no code shipped.
Logs and detection
What a log source actually is, which one to connect first and why, how to prove events are arriving, and which sources work end to end today.
Logs and detection
Nothing ships pre-built. What you get is a builder, three starter dashboards and four chart types — plus the sampling limits that make the numbers approximate.
Logs and detection
VirusTotal and AbuseIPDB reachable through an automation rule's enrich action — and the precise process boundary that determines whether it actually runs.
Logs and detection
Why one attack should produce one incident rather than forty alerts: windowed aggregation, risk per entity, and the one unified incident object that now merges notable events and risk incidents.
Logs and detection
Every source is mapped to one schema before a rule or a search sees it. What that buys you, which field names you can actually use, and why OCSF is nested.
Logs and detection
The credential every log shipper uses: how to issue one, what it is scoped to, how long it lasts, rate limits, rotation, revocation, and what to do if one leaks.
Logs and detection
How long your logs stay searchable, what actually happens at expiry now that archiving is real, how to search your archive once data has aged out of live search, and how to get data out before it stops being visible.
Logs and detection
CSV-uploaded reference tables with a key column, used in a scheduled rule's absence-mode watch list and in automation's enrich action — built from scratch, nothing ships pre-populated.
Logs and detection
A second rule shape alongside the always-on stream rules: threshold and absence modes, cadence and suppression, a cron-expression schedule override, and a 104-template gallery you can enable in one click.
Logs and detection
The query language, the fifteen fields you can search, the limits on a result set, and worked examples you can copy — plus what is deliberately not searchable.
Logs and detection
The OpenTelemetry logs endpoint: exact path, JSON-only transport, which attributes map to which fields, and the one defect that should decide your choice.
Logs and detection
The exact endpoint, header, payload shapes, limits and every response code for posting logs over HTTPS — with a request you can copy and run.
Logs and detection
How to silence a legitimate cause of noise without manufacturing a blind spot — what a suppression can and cannot express, and why it is never permanent by itself.
Logs and detection
Write your own rule or retune a shipped one, then replay it over the events you actually received. What the tester covers, what it cannot query, and what shadow mode is for.
Logs and detection
What detection content ships, how a rule is put together, which parts are mandatory and why, and the contract that stops a rule claiming coverage it lacks.
Logs and detection
The full grammar of the new KQL-shaped Query tab: every stage, every operator and function, the field aliases, and the safety limits — a second engine, separate from classic search.
Logs and detection
Why most detections raise no alert, how risk accumulates against a person or a machine until an incident opens, and what the three buttons on it do.
Logs and detection
Exactly which parts of a shipped rule your organisation may change, which parts it may not, how to make the change, and what the change does to your risk scores.
Logs and detection
An unconfigured syslog source no longer produces a bare generic shape: 13 vendor and host-log decoders now auto-detect and extract real fields, and 10 of them can also be selected explicitly.
Logs and detection
Field by field, what the Cisco ASA, FortiGate and Palo Alto parsers extract, which clock the event time comes from, and what is still only reachable through the raw line.