From first sign-in to a reviewed incident report.

1. Open File Upload.
2. Select Purpose: Log analysis, RAG Knowledge, Incident evidence, Threat intelligence, or General.
3. Choose the file. Drag it into the intake area or select Browse. The maximum is 25 MB per file.
4. Check the summary. Confirm the displayed filename, extension, size, and selected purpose.
5. Select Upload. The service validates the extension, content type, size, and file content before saving it.
6. Open Recent. Review the stored file and choose an available next action such as Analyze Log, Open Knowledge, Extract Indicators, or Attach to Incident.
7. Review scan status. If malware scanning is configured and the file has not been scanned, use the available scan or retry control before trusting it.

1. Open Log Analysis.
2. Choose a source type. Use Auto detect unless you know the events are Windows Security, Linux Authentication, Syslog, Firewall, Web Server, JSON, CSV, or Generic Text.
3. Add evidence. Paste raw events in Log Intake, or choose a TXT, LOG, JSON, JSONL, or CSV file up to 25 MB.
4. Start analysis. Select Analyze Logs for pasted content or Upload and Analyze Logs for a selected file.
5. Review the result. Inspect severity, risk score, detected findings, supporting event details, mapped techniques, warnings, and limitations.
6. Reopen saved work. Use Analysis History to return to a completed run.
7. Continue or export. For a completed analysis, select Enrich & Review Investigation or Export Report.

1. Complete a Log Analysis and select it from Analysis History.
2. Select Enrich & Review Investigation.
3. Queue the investigation if it has not started automatically. Background processing may take time; use Refresh to load the latest state.
4. Review extracted observables, supported enrichment, correlated findings, and the investigation timeline.
5. Open the draft report and check each conclusion against the linked evidence.
6. Approve, revise, or reject proposed items through the available review controls. Retry a failed job only after checking the failure reason.

1. Open Chat Assistant and select New chat, or reopen a saved conversation.
2. Provide context. State the evidence, environment, question, and desired output. Do not include passwords, API keys, access tokens, or unnecessary sensitive production data.
3. Attach a file if needed. Use the paperclip, confirm the selected filename, and add an analysis focus in the message.
4. Select Send. Wait for the message and any file triage to complete.
5. Verify the answer. Check cited or quoted evidence, assumptions, uncertainty, and recommended next checks.
6. Manage the thread. Rename it for the investigation, search saved conversations, or delete it when no longer needed.

Add a document

1. In File Upload, choose RAG Knowledge, select a supported file, and upload it.
2. Open Knowledge Base and select Add Uploaded Document.
3. Select the previously uploaded file, add a clear title, choose a collection, and optionally add a description.
4. Select Add to Knowledge Base. Wait while the document moves through extraction, preparation, chunking, and indexing.
5. Use the document only after its status is Ready. Open details if processing fails.

Ask a grounded question

1. Open the Ask Knowledge tab.
2. Enter one specific question.
3. Select the document scope and, where useful, a collection.
4. Select Ask Question.
5. Review the answer together with its source context. If the available sources do not support a claim, treat it as unresolved.
6. Use Query History to reopen prior account queries or clear history when appropriate.

Investigate one indicator

1. Open Threat Intelligence → Investigate.
2. Leave the type on Auto Detect or select the known type, such as IP, domain, URL, email, hash, CVE, filename, process, registry key, or ASN.
3. Enter the exact indicator and select Investigate.
4. Review normalization, provider evidence, source freshness, internal sightings, score, confidence, limitations, and proposed next actions.
5. Record a disposition and analyst notes only after comparing the external context with internal evidence.

Additional workspaces

1. Open Vulnerability Intelligence. Check Source health before relying on a recently updated record.
2. Search or filter. Enter a CVE, vendor, product, or description; optionally filter by severity or Known exploited and choose a sort order.
3. Review the queue. Compare CVSS, EPSS and percentile, exploit signal, contextual risk, and remediation status.
4. Open a record. Review Overview, Affected Products, Asset Context, AI Analysis, and Remediation.
5. Confirm applicability. Verify the affected product and version against your approved asset inventory or other authoritative internal evidence.
6. Prioritize remediation. Use exploitation evidence, exposure, criticality, and compensating controls—not severity alone.
7. Track the decision. Document owner, target date, exception, or mitigation through the available workflow.

1. 1
   Describe Incident

   Enter a description and detection time. Add a title, affected asset, affected account, input source, and supported evidence file when available. Select Analyze Incident.

2. 2
   Incident Summary

   Review classification, severity, confidence, observed facts, hypotheses, and evidence gaps. Do not confirm compromise from an unsupported hypothesis.

3. 3
   What to Check Next

   Work through prioritized evidence checks. Record findings as supported, unsupported, or unresolved based on what was actually observed.

4. 4
   Response Actions

   Review proposed containment, eradication, and recovery actions. Approve disruptive actions only through your organization’s authorized process.

5. 5
   Outcome & Report

   Validate scope, containment, recovery, and residual risk. Generate the report, review it, then copy or download the PDF.

Reopen saved incidents

1. Select View Incident History.
2. Search by incident text or filter by status and severity.
3. Open the intended incident and confirm its incident number and title before editing or exporting.