Analyst Manual

The Analyst Manual

Cybersecurity and data analysts use the Analyst Manual to:

• Query and investigate event data
• Write, deploy, and tune detection rules
• Track hosts, users, and services as assets
• Create parsing rules and enrichments
• Build dashboards and notifications

To learn day to day navigation in the web app, visit the User Manual. For installation and cluster setup, see the Administration Manual and the Reference guide.

---

Start here

Pick the job you need to do. Each link goes to a focused guide.

Investigate events

Goal	Start here
Search and filter raw logs	Queries
Use the Discover screen (UI)	User Manual: Discover
Build charts and dashboards	Dashboards

Deploy and tune detections

Goal	Start here
Understand what a detection rule is	About detections
Enable rules in production	Detection rule deployment
Write a window correlation rule	Window correlation guide
Read metrics and fix slow rules	Monitoring detection performance
Use lookups in rules	Lookups in detections
Threat intelligence in rules	Threat intelligence feeds
Advanced multi stage rules	Advanced correlation rules

Manage assets

Goal	Start here
Inventory, risk, stale alerts, new-asset notices	Asset management
Normalize user.name from Active Directory	LDAP / AD user identity feed
Detection driven risk scores	Risk scoring

Parse and enrich data

Goal	Start here
Parsing overview	Parsing rules
Geolocation zones	Geolocation lookups
ASN (network owner) enrichment	ASN enrichment
Custom MaxMind database	Custom MaxMind enricher

Notify and respond

Goal	Start here
Email from detections or alerts	Notifications
Notices when a new asset is discovered	Asset management: new-asset notifications
Email templates	Creating email templates

---

Detection engineering path

If you are new to writing rules, follow this order:

1. What is a detection?
2. Window correlation example
3. How to write a window correlation rule
4. Predicates and Triggers
5. Detection rule deployment: enable rules on the Detections screen
6. Monitoring detection performance

---

Quick reference

• Queries: Writing queries to find and filter data
• Dashboards: Designing visualizations for data summaries and patterns
• Parsing rules: Creating and customizing parsing rules
• Detections: Creating custom detections for activity and patterns
• Detection rule deployment: Enabling rules for your tenant
• Asset management: Hosts, users, services, risk, stale alerts, and new-asset notifications
• LDAP / AD user identity feed: Fill usernames2userid from Active Directory for automatic user.id normalization
• Lookups in detections: Whitelists, blacklists, using lookups in correlation rules, and seeding lookup data in rule tests
• Geolocation lookups: Custom IP range zones
• ASN enrichment: Autonomous System number and organization on IP fields
• Custom MaxMind enricher: Attach your own .mmdb and map attributes onto events
• Threat intelligence feeds: Filling IOC lookups from feeds and wiring them into detections and risk scoring
• Advanced correlation rules: Multi stage detections in the library and how to validate them in a lab
• MITRE coverage: ATT&CK matrix views for built in rules and for built in rules plus Sigma
• Monitoring detection performance: Reading metrics on the Detections screen and tuning slow rules
• Notifications: Sending messages via email from detections or alerts