Skip to content

Sekoia.io Documentation

ThreatQuotient

Initializing search

Getting started
Sekoia Defend (XDR)
Sekoia Intelligence (CTI)
Sekoia.io TIP
Integrations

Sekoia.io Documentation

Getting started
Getting started
- Overview
- Where to start
- Workspace setup
  Workspace setup
  - Join workspace
  - Create and manage communities
- Account setup
  Account setup
  - Create account
  - Setup account
- Security and access
  Security and access
  - Account security
    Account security
    
    Two-Factor Authentication
    
    Security tokens
  - Workspace security
    Workspace security
    
    Session duration
    
    Two-Factor Authentication
    
    SSO with OpenID Connect
    
    SSO with Microsoft Entra ID (Azure AD)
    
    SSO with Okta
- Users and roles
  Users and roles
  - Invite users
  - Manage users
  - Deactivate inactive users
  - Roles and permissions
    Roles and permissions
    
    Built-in roles
    
    Custom roles
    
    Intake Restricted roles
- Notifications
  Notifications
  - Create and manage notifications
  - Notification examples
- API Keys
- Sekoia regions
- Best practices
- Troubleshooting tips
Sekoia Defend (XDR)
Sekoia Defend (XDR)
- Introduction
- Quick start guide
- Features
  Features
  - Collect
    Collect
    
    Intakes
    
    Entities
    
    Assets
  - Detect
    Detect
    
    IOCs Detection
    
    Rules Catalog
    
    Built-in Rules
    
    Sigma
    
    Anomaly Detection
    
    IOCs Collections
  - Investigate
    Investigate
    
    Alerts
    
    Events
    
    Cases
    
    Events Query Language
    
    Querying Events
    
    Query Builder (beta)
  - Report
    Report
    
    Dashboards
    
    Threat Landscape
  - Automate
    Automate
    
    Playbooks
    
    Playbooks On-premises
    
    Manage accounts
    
    Navigate playbooks
    
    Build playbooks
    
    Triggers
    
    Operators
    
    Actions
    
    Debug playbooks
    
    Playbooks JSON Schema
  - External integrations
    External integrations
    
    FortiSOAR
    
    Palo Alto Cortex XSOAR
    
    Swimlane Turbine
- Usecases
  Usecases
- FAQ
  FAQ
  - General
  - Alerts
  - Events
    Events
    
    Events QA
    
    Facing issues with logs collection
  - Detection
  - Assets
  - Sekoia.io Endpoint agent
  - Datetime representation
- Develop
  Develop
  - REST API
    REST API
    
    Quickstart
    
    Authentication and Community
    
    Dashboard
    
    Configuration
    
    Parser
    
    Alert
    
    Assets
    
    Playbooks
    
    Query Builder
    
    Telemetry
Sekoia Intelligence (CTI)
Sekoia Intelligence (CTI)
- Introduction
- Features
  Features
  - Data Models
  - Consume
    Consume
    
    Intelligence
    
    Observables
    
    Telemetry
    
    Outgoing Feeds
    
    Graph Explorations
    
    Enrichers
    
    Export
    
    IOCs Collections
  - Monitor
    Monitor
    
    Dashboards
    
    Threat Landscape
  - External Integrations
    External Integrations
    
    Overview
    
    API
    
    TAXII
    
    Cortex Analyzer
    
    MISP Feed
    
    Microsoft Sentinel
    
    OpenCTI
    
    Splunk
    
    Splunk SOAR
    
    Swimlane Turbine
    
    Anomali ThreatStream
    
    PaloAlto Cortex XSOAR
    
    ThreatQuotient
- Develop
  Develop
  - REST API
    REST API
    
    Quickstart
    
    Authentication and Community
    
    Intelligence
    
    Enrichment
    
    Telemetry
    
    Dashboard
    
    Playbooks
    
    External Dynamic List
Sekoia.io TIP
Sekoia.io TIP
- Introduction
- Features
  Features
  - Data Models
  - Consume
    Consume
    
    Intelligence
    
    Observables
    
    Outgoing Feeds
    
    Graph Explorations
    
    Enrichers
    
    Export
    
    IOCs Collections
  - Produce and investigate
    Produce and investigate
    
    Content Proposals
    
    Incoming Feeds
    
    Warning Rules
    
    Expiration Rules
  - Monitor
    Monitor
    
    Dashboards
    
    Threat Landscape
  - External Integrations
    External Integrations
    
    Overview
    
    API
    
    TAXII
    
    Cortex Analyzer
    
    MISP Feed
    
    Microsoft Sentinel
    
    OpenCTI
    
    Splunk
    
    PaloAlto Cortex XSOAR
  - Automate
    Automate
    
    Playbooks
    
    Manage accounts
    
    Navigate playbooks
    
    Build playbooks
    
    Triggers
    
    Operators
    
    Actions
    
    Actions Library
    Actions Library
    
    Applicative
    Applicative
    
    Mandrill
    
    Mattermost
    
    Microsoft Windows Server
    
    PagerDuty
    
    Cloud Providers
    Cloud Providers
    
    AWS
    
    Google
    
    Collaboration Tools
    Collaboration Tools
    
    Atlassian JIRA
    
    Git
    
    ServiceNow
    
    The Hive
    
    The Hive V5
    
    Email
    Email
    
    Vade Secure
    
    Endpoint
    Endpoint
    
    CrowdStrike Falcon
    
    HarfangLab
    
    Panda Security
    
    SentinelOne
    
    Sophos
    
    WithSecure
    
    Generic
    Generic
    
    HTTP
    
    OpenAI
    
    RSS
    
    Sekoia.io
    
    Utils
    
    IAM
    IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
    
    Network
    Network
    
    Fortigate Firewalls
    
    Zscaler
    
    Overview
    
    Threat Intelligence
    Threat Intelligence
    
    BinaryEdge's API
    
    Censys
    
    Certificate Transparency
    
    Detection Rules
    
    Digital Shadows
    
    GLIMPS
    
    IKnowWhatYouDownload
    
    IPInfo
    
    IPtoASN
    
    MISP
    
    MWDB
    
    Nybble
    
    OSINT
    
    Onyphe
    
    Public Suffix
    
    RiskIQ
    
    Shodan
    
    Tranco
    
    Triage
    
    VirusTotal
    
    Whois
- Develop
  Develop
  - REST API
    REST API
    
    Quickstart
    
    Authentication and Community
    
    Intelligence
    
    Enrichment
    
    Dashboard
    
    Playbooks
Integrations
Integrations
- Introduction
- Ingestion methods
  Ingestion methods
  - Overview
  - Cloud & SaaS
    Cloud & SaaS
    
    Overview
    
    AWS S3
    
    Azure Event Hub
    
    Google Pub/Sub
  - HTTPS
    HTTPS
    
    Overview
    
    Formatting options
    
    Forwarding logs using a third-party application
    
    Graylog
    
    Logstash
  - Syslog
    Syslog
    
    Overview
    
    Sekoia.io Forwarder
    
    Third-party syslog services
    
    Rsyslog
    
    Syslog NG
    
    Secured forwarding
- List of Intakes
  List of Intakes
- List of Playbooks Actions
  List of Playbooks Actions
  - Applicative
    Applicative
    
    Mandrill
    
    Mattermost
    
    Microsoft Windows Server
    
    PagerDuty
  - Cloud Providers
    Cloud Providers
    
    AWS
    
    Google
  - Collaboration Tools
    Collaboration Tools
    
    Atlassian JIRA
    
    Git
    
    ServiceNow
    
    The Hive
    
    The Hive V5
  - Email
    Email
    
    Vade Secure
  - Endpoint
    Endpoint
    
    CrowdStrike Falcon
    
    HarfangLab
    
    Microsoft Defender
    
    Panda Security
    
    SentinelOne
    
    Sophos
    
    WithSecure
  - Generic
    Generic
    
    HTTP
    
    OpenAI
    
    RSS
    
    Sekoia.io
    
    Utils
  - IAM
    IAM
    
    Microsoft Active Directory
    
    Microsoft Entra ID
  - Network
    Network
    
    Fortigate Firewalls
    
    Zscaler
  - Overview
  - Threat Intelligence
    Threat Intelligence
    
    BinaryEdge's API
    
    Censys
    
    Certificate Transparency
    
    Detection Rules
    
    Digital Shadows
    
    GLIMPS
    
    IKnowWhatYouDownload
    
    IPInfo
    
    IPtoASN
    
    MISP
    
    MWDB
    
    Nybble
    
    OSINT
    
    Onyphe
    
    Public Suffix
    
    RiskIQ
    
    Shodan
    
    Tranco
    
    Triage
    
    VirusTotal
    
    Whois
- How to develop a new Integration
  How to develop a new Integration
  - Overview
  - Automation
    Automation
    
    Overview
    
    Action
    
    Create a Module
    
    Development Guidelines
    
    Module
    
    Trigger
  - Formats
    Formats
    
    Overview
    
    Create a Format
    
    Datasources
    
    Definition of a structured event
    
    Definition of the taxonomy
    
    How to write a parser
    
    How to write smart descriptions
    
    Best Practices
    Best Practices
    
    Overview
    
    Authentications
    
    Networks
    
    Endpoints
- FAQ
  FAQ
  - Overview
  - General Questions
    General Questions
    
    Bug VS Improvement Requests

External Integrations: ThreatQuotient

You can access Sekoia CTI feed through ThreatQuotient's market place.

PaloAlto Cortex XSOAR

Copyright © 2023 - Sekoia.io

Made with Material for MkDocs