• Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • The Devo data analytics platform
    • How Devo indexes data
    • How Devo works
    • Key concepts
  • Getting started
    • Sign up and log in
    • Navigating the Devo app
      • Navigation pane
      • Home area
    • User preferences
    • Devo video tutorials
      • Domain administration videos
      • Sending data to Devo videos
      • Searching data videos
      • Activeboards videos
      • Panels videos
      • Applications videos
  • Domain administration
    • Users and roles
      • Managing users
      • Monitoring user activity
      • Managing roles
        • Assign resources to a role
      • Role permissions
      • Role mapping
    • Security credentials
      • Access keys
      • X.509 certificates
      • Authentication tokens
    • Applications gallery
    • Domain preferences
    • User authentication
      • Password
      • SAML
        • Google as an identity provider
        • Okta as an identity provider
        • OneLogin as an identity provider
        • O365/Azure AD as an identity provider
      • OpenID
    • Data processes and feeds
      • Aggregation tasks
      • Injections
      • Permalinks
      • API & OData feeds
  • Sending data to Devo
    • The Devo In-House Relay
      • Installing the Devo Relay
        • Install the Relay on an Ubuntu box (v1.4.2)
        • Install the Relay on a Red Hat or CentOS box (v1.4.2)
        • Install with Docker
      • Configuring the In-House Relay
        • Relay rules
          • Defining a relay rule
          • The 4 predefined relay rules
          • 5 common relay rule scenarios
            • Scenario 1: Apply a fixed tag to all events
            • Scenario 2: Apply a Devo tag based on data found in the inbound event
            • Scenario 3: Filter out unwanted events
            • Scenario 4: Assign dynamic Devo tag using inbound source data
            • Scenario 5: Appending the inbound syslog tag to the outbound Devo tag
          • Using regex in relay rules
        • Customizing In-House Relay settings
        • Managing the relay on the command line
        • Setting up High-Availability with Keepalived (v1.4.2)
        • Relay buffers
      • Relay migration
      • Sending SSL/TLS encrypted events to the Devo relay
      • Relay troubleshooting tips (v1.4.2)
        • Relay troubleshooting tips (v1.4.0)
        • Relay troubleshooting tips (for versions prior to 1.4.0)
    • Event sources
      • Unix-like machines
        • Installing Devo packages for *nix
        • Third-party syslog tools configuration
          • rsyslog
            • Simple sending using rsyslog
            • Secure sending using rsyslog
            • Monitoring files using rsyslog
            • Obsolete legacy format
              • Simple sending using rsyslog (Obsolete legacy format)
              • Secure sending using rsyslog (Obsolete legacy format)
              • Monitoring files using rsyslog (Obsolete legacy format)
          • syslog-ng
            • Simple sending using syslog-ng
            • Secure sending using syslog-ng
            • Monitoring files using syslog-ng
          • syslog/syslogd
        • SELinux configuration conflicts
      • Windows
        • Devo Agent for Windows
        • Configuring WMI for Devo file monitoring
        • NXLog for Windows event collection
      • MacOS X
      • Cloud services
        • AWS S3 Buckets
      • Commercial products
      • Custom apps
        • Java apps
          • JDK java.util.logging
          • Scoja client library
          • Sample code
        • Node.js apps
        • Python apps
      • Universal Agent
        • Deployment scenarios
        • Pre-integrated query packs
        • Data querying in Devo
        • Universal Agent Manager deployment
          • Generic deployment guidelines
          • Universal Agent Manager - CentOS 7 Deployment
          • Universal Agent Manager - CentOS 8 Deployment
          • Universal Agent Manager - Debian 9 Deployment
          • Universal Agent Manager - Debian 10 Deployment
          • Universal Agent Manager - RHEL 7 Deployment
          • Universal Agent Manager - RHEL 8 Deployment
          • Universal Agent Manager - Ubuntu 18 Deployment
        • Universal Agent deployment
        • Universal Agent Manager user manual
          • Using queries
          • Managing query packs
        • Operational guidelines
          • Files fetcher
        • Performance considerations
    • Other data collection methods
      • HTTP endpoint
      • Logstash
      • Fluentd
      • NXLog
    • Uploading log files
    • Devo software
  • Parsers and collectors
    • About Devo tags
    • Special Devo tags and data tables
      • Union tables
    • List of Devo parsers
      • Business & Consumer
      • Cloud technologies
        • casb.netskope
        • cdn.akamai
        • cloud.aws.cloudtrail.events
          • Forwarding the events using Node.js
          • Forwarding the events using Python
        • cloud.aws.cloudwatch.events
        • cloud.azure
        • cloud.cloud_foundry
        • cloud.office365.siem
      • Databases
        • db.mysql
      • Host and Operating Systems
        • box.unix
        • box.vmware
        • box.win
        • box.win_nxlog
        • box.win_snare
      • Network and application security
        • auth.cisco
        • auth.secureauth
        • auth.securenvoy
        • av.mcafee
        • av.sophos
        • box.iptables
        • edr.carbonblack
        • edr.cylance
        • edr.fireeye.alerts
        • edr.minervalabs.events
        • edr.paloalto
        • endpoint.symantec
        • firewall.checkpoint
        • firewall.cisco firepower and vpn.cisco
        • firewall.fortinet
        • firewall.huawei
        • firewall.juniper
        • firewall.paloalto
          • Sending Palo Alto events to Devo relay using SSL
        • firewall.pfsense
        • firewall.sonicwall
        • firewall.sophos
        • firewall.sophos.xgfirewall
        • firewall.stonegate
        • firewall.windows
        • ids.extrahop
        • mail.proofpoint
        • nac.aruba
        • network.meraki
        • network.versa
        • network.vmware
        • proxy.bluecoat
        • proxy.forcepoint
        • proxy.squid
        • proxy.zscaler
        • uba.varonis
        • vuln.beyondtrust
        • vpn.pulsesecure.sa
        • vpn.zscaler
      • Network connectivity
        • netstat.netflow
        • dns.bind
        • dns.windows
        • ftp.iis
      • Web servers
        • web.apache
        • web.apache.mod-security
        • web.iis
        • web.jboss
        • web.nginx
        • web.tomcat
      • Technologies supported in CEF syslog format
        • cef0.forcepoint.security
        • cef0.forescoutTechnologies.counteract
        • cef0.zscaler
    • Collectors
      • AWS collector
      • Google Cloud Platform collector
      • G Suite collectors
        • G Suite Alerts collector
        • G Suite Reports collector
      • Microsoft Azure collector
      • Microsoft Graph collector
      • Office 365 collector
      • Okta collectors
        • Okta collector
        • Okta Advanced Server Access collector
      • OneLogin collector
      • Rapid7 InsightVM collector
      • Salesforce collector
      • Sophos Central collector
  • Searching data
    • Accessing data tables
      • Run a search using a finder
        • Use a custom finder
          • Create a custom finder
          • Assign a custom finder to a role
          • Edit a custom finder
        • Use the aliased finder
          • Add a search to your aliased finder
      • Run a global search
      • Run a LINQ free text query
      • Run a search with selected columns only
        • Selecting specific columns with the Finder
        • Selecting specific columns in LINQ
        • Selecting unrevealed columns
    • Building a query
      • Data types in Devo
      • Build a query in the search window
        • Filter data
        • Filter column data using the OR selector
        • Create columns
        • Group data
        • Aggregate data
      • Build a query using LINQ
        • LINQ query examples
      • Working with JSON objects in data tables
      • Subqueries
      • Operations reference
        • Aggregation operations
          • Average (avg)
          • Count (count)
          • First (first)
          • First not null (nnfirst)
          • HyperLogLog++ (hllpp)
          • HyperLogLog++ Count Estimation (hllppcount)
          • Last (last)
          • Last not null (nnlast)
          • Maximum (max)
          • Median / 2nd quartile / Percentile 50 (median)
          • Minimum (min)
          • Non-null average (nnavg)
          • Non-null standard deviation (biased) (nnstddev)
          • Non-null standard deviation (unbiased) (nnustddev)
          • Non-null variance (biased) (nnvar)
          • Non-null variance (unbiased) (nnuvar)
          • Percentile 10 (percentile10)
          • Percentile 25 / 1st quartile (percentile25)
          • Percentile 5 (percentile5)
          • Percentile 75 / 3rd quartile (percentile75)
          • Percentile 90 (percentile90)
          • Percentile 95 (percentile95)
          • Standard deviation (biased) (stddev)
          • Standard deviation (unbiased) (ustddev)
          • Sum (sum)
          • Sum Square (sum2)
          • Variance (biased) (var)
          • Variance (unbiased) (uvar)
        • Arithmetic group
          • Absolute value (abs)
          • Addition, sum, plus / Concatenation (add, +)
          • Ceiling (ceil)
          • Cube root (cbrt)
          • Division (div, \)
          • Division remainder (rem, %)
          • Floor (floor)
          • Modulo (mod, %%)
          • Multiplication, product (mul, *)
          • Power (pow)
          • Real division (rdiv, /)
          • Rounding (round)
          • Sign (signum)
          • Square root (sqrt)
          • Subtraction, minus / Additive inverse (sub, -)
        • Conversion group
          • Duration (duration)
          • Format date (formatdate)
          • From base16, b16, hex (from16)
          • From base64, b64 (from64)
          • From UTF8 (fromutf8)
          • From Z85, base85 (fromz85)
          • Human size (humanSize)
          • Make byte array (mkboxar)
          • Parse date (parsedate)
          • Regular expression, regexp (re)
          • Template (template)
          • Timestamp (timestamp)
          • To base16, b16, hex (to16)
          • To base64, b64, hex (to64)
          • To BigInt (bigint)
          • To boolean (bool)
          • To Float (float)
          • To image (image)
          • To Int (int)
          • To IPv4 (ip4)
          • To IPv4 net (net4)
          • To IPv6 (ip6)
          • To IPv6 compatible (compatible)
          • To IPv6 mapped (mapped)
          • To IPv6 net (net6)
          • To IPv6 translated (translated)
          • To MAC address (mac)
          • To string (str)
          • To string (stringify)
          • To UTF8 (toutf8)
          • To Z85, base85 (toz85)
        • Cryptography group
          • MD5 hash function (md5)
          • SHA1 hash function (sha1)
          • SHA256 hash function (sha256)
          • SHA512 hash function (sha512)
        • Date group
          • Day / Day of the month (day)
          • Day of the week (dayofweek)
          • Day of the year (dayofyear)
          • Epoch milliseconds (epoch)
          • Hour (hour)
          • Millisecond (millisecond)
          • Minute (minute)
          • Month (month)
          • Period (period)
          • Second (second)
          • Today (today)
          • Tomorrow (tomorrow)
          • Year (year)
          • Yesterday (yesterday)
        • Flow group
          • Conditional (ifthenelse)
          • Decode, switch (decode)
          • Null value locator (nvl)
        • General group
          • Is not null (isnotnull)
          • Is null (isnull)
        • Geolocation group
          • Coordinates distance (distance)
          • Geocoord (geocoord)
          • Geographic coordinate system (coordsystem)
          • Geohash (geohash)
          • Geohash string (geohashstr)
          • Geolocated Accuracy Radius with MaxMind GeoIP2 (mm2accuracyradius)
          • Geolocated ASN (mmasn)
          • Geolocated ASN with MaxMind GeoIP2 (mm2asn)
          • Geolocated AS Organization Name with MaxMind GeoIP2 (mm2asorg)
          • Geolocated AS owner (mmasowner)
          • Geolocated City (mmcity)
          • Geolocated City with MaxMind GeoIP2 (mm2city)
          • Geolocated Connection Speed (mmspeed)
          • Geolocated connection type with MaxMind GeoIP2 (mm2con)
          • Geolocated Coordinates (mmcoordinates)
          • Geolocated coordinates with MaxMind GeoIP2 (mm2coordinates)
          • Geolocated Country (mmcountry)
          • Geolocated Country with MaxMind GeoIP2 (mm2country)
          • Geolocated ISP (mmisp)
          • Geolocated ISP name with MaxMind GeoIP2 (mm2isp)
          • Geolocated Latitude (mmlatitude)
          • Geolocated Latitude with MaxMind GeoIP2 (mm2latitude)
          • Geolocated Level 1 Subdivision with MaxMind GeoIP2 (mm2subdivision1)
          • Geolocated Level 2 Subdivision with MaxMind GeoIP2 (mm2subdivision2)
          • Geolocated Longitude (mmlongitude)
          • Geolocated Longitude with MaxMind GeoIP2 (mm2longitude)
          • Geolocated Organization (mmorg)
          • Geolocated organization name with MaxMind GeoIP2 (mm2org)
          • Geolocated Postal Code (mmpostalcode)
          • Geolocated Postal Code with MaxMind GeoIP2 (mm2postalcode)
          • Geolocated Region (mmregion)
          • Geolocated Region Name (mmregionname)
          • ISO-3166-1 Continent Alpha-2 Code (continentalpha2)
          • ISO-3166-1 Continent Name (continentname)
          • ISO-3166-1 Country Alpha-2 Code (countryalpha2)
          • ISO-3166-1 Country Alpha-2 Continent (countrycontinent)
          • ISO-3166-1 Country Alpha-3 Code (countryalpha3)
          • ISO-3166-1 Country Latitude (countrylatitude)
          • ISO-3166-1 Country Longitude (countrylongitude)
          • ISO-3166-1 Country Name (countryname)
          • Latitude (latitude)
          • Latitude and longitude coordinates (latlon)
          • Longitude (longitude)
          • Parse geocoord format (parsegeo)
          • Represent geocoord format (reprgeo)
          • Round coordinates (gridlatlon)
        • JSON group
          • Jq evaluation (jqeval)
          • Jq filter compilation (jqcompile)
          • Json value type (label)
          • To json (jsonparse)
        • Logic group
          • And (and)
          • Not (not)
          • Or (or)
        • Mathematical group
          • Arc cosine (acos)
          • Arc sine (asin)
          • Arc tangent (atan)
          • Bitwise AND (band, &)
          • Bitwise left shift (lshift, <<)
          • Bitwise NOT (bnot, ~)
          • Bitwise OR (bor, |)
          • Bitwise right shift (rshift, >>)
          • Bitwise unsigned right shift (urshift, >>>)
          • Bitwise XOR (bxor, ^)
          • Cosine (cos)
          • e (mathematical constant) (e)
          • Exponential: base e (exp)
          • Hyperbolic cosine (cosh)
          • Hyperbolic sine (sinh)
          • Hyperbolic tangent (tanh)
          • Logarithm: base 2 (log2)
          • Logarithm: base 10 (log10)
          • Logarithm: natural / arbitrary base (log)
          • Pi (mathematical constant) (pi)
          • Sine (sin)
          • Tangent (tan)
        • Meta Analysis group
          • Pragma value (pragmavalue)
          • Table name (tablename)
        • Name group
          • Any name matches (anymatches)
          • Glob pattern on names (nameglob)
        • Network group
          • HTTP Status Description (httpstatusdescription)
          • HTTP Status Type (httpstatustype)
          • IP Protocol (ipprotocol)
          • IP Reputation Score (reputationscore)
          • IP Reputation Tags (reputation)
          • IPv4 legal use (purpose)
          • IPv6 host number (host)
          • IPv6 routing number (routing)
          • Is IPv4 (ipip4)
          • Is Private IPv4 (isprivate)
          • Is Public IPv4 (ispublic)
          • Squid Black Lists Flags (sbl)
        • Order group
          • Equal (eq, =)
          • Equal - case insensitive (eqic)
          • Greater or equal (ge, >=)
          • Greater than (gt, >)
          • Less or equal (le, <=)
          • Less than (lt, <)
          • Not equal (ne, /=)
        • Packet group
          • Ethernet destination MAC address (etherdst)
          • Ethernet payload (etherpayload)
          • Ethernet source MAC address (ethersrc)
          • Ethernet status (etherstatus)
          • Ethernet tag (ethertag)
          • EtherType (ethertype)
          • Has Ethernet frame (hasether)
          • Has IPv4 datagram (hasip4)
          • Has TCP segment (hastcp)
          • Has UDP datagram (hasudp)
          • IPv4 destination address (ip4dst)
          • IPv4 differentiated services (ip4ds)
          • IPv4 explicit congestion notification (ip4ecn)
          • IPv4 flags (ip4flags)
          • IPv4 fragment offset (ip4fragment)
          • IPv4 header checksum (ip4cs)
          • IPv4 header length (ip4hl)
          • IPv4 identification (ip4ident)
          • IPv4 payload (ip4payload)
          • IPv4 protocol (ip4proto)
          • IPv4 source address (ip4src)
          • IPv4 status (ip4status)
          • IPv4 time to live (ip4ttl)
          • IPv4 total length (ip4len)
          • IPv4 type of service (ip4tos)
          • TCP ACK (tcpack)
          • TCP checksum (tcpcs)
          • TCP destination port (tcpdst)
          • TCP flags (tcpflags)
          • TCP header length (tcphl)
          • TCP payload (tcppayload)
          • TCP sequence number (tcpseq)
          • TCP source port (tcpsrc)
          • TCP status (tcpstatus)
          • TCP urgent pointer (tcpurg)
          • TCP window size (tcpwin)
          • UDP checksum (udpcs)
          • UDP destination port (udpdst)
          • UDP length (udplen)
          • UDP payload (udppayload)
          • UDP source port (udpsrc)
          • UDP status (udpstatus)
        • Statistical group
          • Approximated estimation (estimation)
          • HyperLogLog++ pack (pack)
          • HyperLogLog++ unpack (unpackhllpp)
        • String group
          • Contains (has, ->)
          • Contains - case insensitive (weakhas)
          • Contains tokens (toktains)
          • Contains tokens - case insensitive (weaktoktains)
          • Edit distance: Damerau (damerau)
          • Edit distance: Hamming (hamming)
          • Edit distance: Levenshtein (levenshtein)
          • Edit distance: OSA (osa)
          • Ends with (endswith)
          • Format number (formatnumber)
          • Hostname public suffix (publicsuffix)
          • Hostname root domain (rootdomain)
          • Hostname root prefix (rootprefix)
          • Hostname root suffix (rootsuffix)
          • Hostname subdomains (subdomain)
          • Hostname top level domain (topleveldomain)
          • Is empty (isempty)
          • Is in (`in`, <-)
          • Is in - case insensitive (weakin)
          • Length (length)
          • Locate (locate)
          • Lower case (lower)
          • Matches (matches, ~)
          • Peek (peek)
          • Replace all (replaceall)
          • Replace first (replace)
          • Shannon entropy (shannonentropy)
          • Split (split)
          • Split regexp (splitre)
          • Starts with (startswith)
          • Substitute (subs)
          • Substitute all (subsall)
          • Substring (substring)
          • Trim both sides (trim)
          • Trim the left side (ltrim)
          • Trim the right side (rtrim)
          • Upper case (upper)
        • Web group
          • Absolute URI (absoluteuri)
          • Opaque URI (opaqueuri)
          • URI authority (uriauthority)
          • URI fragment (urifragment)
          • URI host (urihost)
          • URI path (uripath)
          • URI port (uriport)
          • URI query (uriquery)
          • URI scheme (urischeme)
          • URI ssp (urissp)
          • URI user (uriuser)
          • URL decode (urldecode)
          • User Agent Company (uacompany)
          • User Agent Company URL (uacompanyurl)
          • User Agent Device Icon (uadeviceicon)
          • User Agent Device Information URL (uadeviceinfourl)
          • User Agent Device Type (uadevicetype)
          • User Agent Family (uafamily)
          • User Agent Icon (uaicon)
          • User Agent Information URL (uainfourl)
          • User Agent is Robot (uaisrobot)
          • User Agent Name (uaname)
          • User Agent OS Company (uaoscompany)
          • User Agent OS Company URL (uaoscompanyurl)
          • User Agent OS Family (uaosfamily)
          • User Agent OS Icon (uaosicon)
          • User Agent OS Name (uaosname)
          • User Agent OS URL (uaosurl)
          • User Agent Type (uatype)
          • User Agent URL (uaurl)
          • User Agent Version (uaversion)
    • Working in the search window
      • Generate charts
        • Affinity chord diagram
        • Availability timeline
        • Bipartite chord diagram
        • Bubble chart
        • Chart aggregation
        • Custom date chart aggregation
        • Flame graph
        • Flat world map by coordinates
        • Flat world map by country
        • Google animated heat map
        • Google area map
        • Google heat map
        • Graph diagram
          • Creating a graph diagram
          • Working in the graph diagram
          • Monitor intranet traffic to dangerous websites
        • Histogram
        • Pew Pew map
        • Pie chart
        • Pie layered chart
        • Punch card
        • Robust Random Cut Forest chart
        • Sankey diagram
        • Scatter plot
        • Time heatmap
        • Triple exponential chart
        • Voronoi treemap
      • Data enrichment
        • Upload a lookup table
        • Create a lookup table from a query
        • Add lookup values to your query
        • Manage and edit lookup tables
        • Threat lookups
      • Setting up a data table
        • Modifying the column layout
          • Arrange and resize columns
          • Hide and show columns
          • Change the position of column headers
          • Sort data
          • Setting a default table layout
        • Add a description to a data table
        • Autoparser
          • Autoparse a JSON object
      • Advanced data operations
        • Graphical correlation
          • Cross-Search Graph Diagram
          • Cross-Search Table Join
          • Cross-Search Sankey Diagram
          • Cross-Search Line Chart
        • Custom and union tables
          • Create a custom table
          • Create a union table
          • Manage custom and union tables
        • Create a new aggregation task
        • Inject data to a new table
        • Drill downs
        • Manipulate your data using CyberChef
        • Time series report
      • Use case: eCommerce behavior analysis
        • Step 1. Error analysis using status codes
          • Specific analysis for 404 codes
          • Custom alerts for 404 errors
        • Step 2. Operating system ranking
          • Get the usage share of operating systems
          • Visualize the usage share of operating systems
        • Step 3. Country distribution
          • Build a histogram displaying country distribution
          • Geolocate IP addresses
    • Managing your queries
      • Rename a search
      • Favorite searches
      • Search history
      • Check currently running queries
      • Add a description to your query
      • Block a search
      • Share a query
      • Download query data
      • Close a search
      • Load query data into Excel using the Devo Connector add-in
      • Query priority
    • Best practices for data search
    • Monitoring tables
      • Web application monitoring
      • Alerts monitoring
  • Activeboards
    • Create an Activeboard
    • Manage and filter Activeboards
    • View and edit modes in Activeboards
    • Share and download Activeboards
    • Activeboard JSON
    • LINQ syntax differences between Activeboards and the search window
    • Activeboard widgets
      • Area chart widgets
      • Column chart widgets
      • Donut chart widgets
      • Heatmap widgets
      • Line chart widgets
      • Pie chart widgets
      • Simple value widgets
      • Table widgets
      • Voronoi diagram widgets
      • Setting a time range in Widgets
    • Activeboard inputs
      • Using a select type input
      • Using a text box type input
      • Calling an input value from a widget
      • Show default data before entering values in an input
    • Setting a time range in Activeboards
      • Time range options for Activeboards and Widgets
      • Date language expressions for Activeboards and Widgets
      • Active Refresh
  • Dashboards
    • Working with dashboard widgets
      • Availability timeline widget
      • Chord diagram widget
      • Circle world map widget
      • Color key value widget
      • Color world map widget
      • Column chart widget
      • Comparative chart widget
      • Funnel widget
      • Gauge meter widget
      • Google heatmap widget
      • Heat calendar widget
      • Line chart widget
        • Customize your Line chart
      • Monitoring widget
      • Pie chart widget
      • Punch card widget
      • Sectored pie chart widget
      • Table widget
      • Time heatmap widget
      • Tree diagram widget
      • Voronoi tree widget
    • Configuring and sharing dashboards
  • Alerts and notifications
    • Creating new alerts
      • Alert trigger methods
        • Each alert type
        • Several alert type
        • Low alert type
          • Inactivity alert
        • Rolling alert type
        • Deviation alert type
        • Gradient alert type
      • Create an alert based on triggered alerts
    • Configuring alerts
      • Manage defined alerts
      • Manage sending policies
      • Manage delivery methods
        • Email delivery methods
        • HTTP-JSON delivery methods
        • Service Desk delivery methods
        • Jira delivery methods
        • Pushover delivery methods
        • PagerDuty delivery methods
        • Slack delivery methods
      • Manage anti-flooding policies
      • Make an alert available for panels
      • Pre-installed alert reference
    • Managing triggered alerts
      • Add a comment to a triggered alert
      • Apply a filter for post-processing
  • Panels
    • Create and customize a panel
    • Adding an alert to a panel
    • Adding a query to a panel
    • Using panels
  • Applications
    • Devo Security Operations
      • Overview Dashboard
      • Triage
        • Triaging alerts
        • Triaging investigations
      • Investigations
      • Threat Hunting
      • Use cases
        • Phishing attack
        • Command & Control
        • Alerting system status
    • Devo Stats
      • Working in the Devo Stats application
      • Application tabs and widgets
        • User tab
        • Volume tab
        • Query tab
          • User Query Info
          • CPU Query Info
          • CPU Query Info Multidomain
        • Status tab
    • Security Insights
      • Installing Security Insights
        • Security Insights lookups
      • Configuring Security Insights
      • Navigating Security Insights
        • Overview tab
        • Threats tab
        • Network tab
        • DNS tab
        • Firewall tab
        • Proxy tab
        • Access tab
        • Web tab
        • IDS tab
    • Service Operations
      • Basic concepts
      • Installation
      • Global models
      • Technologies configuration
      • Models configuration
      • Service overview
      • Incidents viewer
      • Monitors
      • User experience management
      • Use case for service operations
        • Initial analysis
        • Model configuration
        • Running the model
        • Incidents
    • Systems Monitoring
      • Basic monitoring
      • Advanced monitoring
  • Tools
    • Data Explorer
    • Query App
    • Time Series Analytics
  • Flow
    • Creating a Flow
    • Working with your Flow
      • Basic operations
      • Working with units
      • Working with links
      • Events window
      • Modify your Flow layout
    • Unit types
      • Control
        • Batch Detector
        • Delayer
        • Gate Delayer
      • Core
        • Filter
        • Join
        • Map
        • Reducer
        • Switch
      • Data
        • Lookup
        • Memory
      • DB
        • Neo4j Source
        • Neo4j Sink
        • OrientDB Sink
      • Devo
        • Devo Full Query
        • Devo Managed Query
        • Devo Sink
        • Devo Source
      • Event
        • Detacher
        • Generator
        • Repeater
        • Tick
      • HTTP
        • HTTP call
      • Log
        • Syslog Sender
      • MQ
        • Kafka Sender
        • Rabbit Ack
        • Rabbit Receiver
        • Rabbit Sender
      • Text
        • CSV Parser
        • JQ
        • JSON Parser
        • Regex
        • Text Formatter
        • XML Parser
        • XPath
      • Sink
        • Email Sink
        • Slack Sink
      • Window
        • Count Window Collector
        • Time Window Collector
    • Flow use cases
      • Alert with external web service
      • Simple Each alert
      • Simple ETL
  • Social Intelligence
  • API reference
    • REST API
      • Authorizing REST API requests
      • Running queries with the REST API
        • Forward response to Amazon S3
        • Forward response to email
        • Forward response to HDFS
        • Forward response to Kafka
        • Forward response to SNMP
        • Send requests with Postman
      • Job requests
    • Provisioning API
      • Authorizing Provisioning API requests
      • Common operations
        • User operations
        • Domain operations
        • Certificates
        • Role management
        • Domain resources management
      • Reseller operations
        • Plan retention and ingestion configuration
        • Price plans
      • Role specification and examples
    • Alerting API
      • Working with alert definitions
    • Using and managing OData feeds
      • Connecting with Excel
      • Connecting with Tableau
      • Connecting with Power BI
  • Release notes
    • Platform release notes
      • 6.0.0
      • 6.0.1
      • 6.1.0
      • 6.1.1
      • 6.1.2
      • 6.1.3
      • 6.1.4
      • 6.2.0
      • 6.3.0
      • 6.3.1
      • 6.3.2
      • 6.3.3-1
      • 6.4.0
      • 6.4.1
      • 6.4.3
      • 6.5.0
      • 6.5.1
      • 6.5.2
      • 6.6.0
      • 6.6.1
      • 6.6.2
      • 6.7.0
      • 6.7.1
      • 6.7.2
      • 6.7.3
      • 7.0.0
    • Flow release notes
      • 1.8
      • 1.8.2
PREVIOUS
Triage
NEXT
Triaging investigations

Applications / Devo Security Operations / Triage / Triaging alerts

Download as PDF

Triaging alerts

Alerts that match the criteria of the filters applied will appear at the top of the Triage area after clicking the Filter button. Filtered alerts are grouped by entities (IP addresses, users...) and ordered by priority and date.

After filtering alerts, users can perform the following actions:

Run an investigation from a filter

After applying a filter in the Triage area, you can create an investigation based on a group of suspicious alerts by clicking the Add to investigation button that appears at the top right corner of each group. All the alerts added to an investigation in this way will be stored in a bucket that you can access by clicking the paper clip icon at the top right of the application. 

Note that the investigation will not be created until you click the paper clip icon, select the required elements, and define the required investigation. Learn more about this in the Investigations section.

Check the details of a group of alerts

After filtering alerts in the Triage area, you can get both individual alerts or groups of alerts that share entities, and are grouped to make the analysis easier. In the case of groups, you can see the number of alerts in the group checking the number in the lightning icon next to each group.

To obtain more details about the alerts in each group, click the name of the group in the Description column. You will access a window that shows a description in the top area, and 2 different areas: Timeline (the view that appears by default) and Associations (which you can access clicking the button at the top right corner).

Alert states

When opening an alert in the Triage area clicking its Description name, we are actually opening a group of alerts (of course it could be only one alert in the group). These alerts are grouped by entities and by alert states. This state is UNREAD by default and it changes to WATCHED when we select one alert of the group.

It is important the difference between the state of the group and the state of each alert. If any of the alerts in a group are in UNREAD state, the group is also UNREAD. We can change the state of all the alerts of a group using the selector at the top right corner.

Description

The top part of this area shows the entities related to the group of alerts, the type of alert (in the example above is Detection), the name of the alert (in the example, Power shell exec bypass), the table where the alert is defined, the corresponding MITRE techniques and tactics, the message and the description.

Next to the list of related entities, you have the Add to investigation button that you can use to add this group of alerts to a new or existing investigation.

You can also open the LINQ code of the alert by clicking this icon 

Click Run query at the bottom of the window to access the Hunting area.

Timeline

This section contains three different areas:

  • The timeline itself, which shows the evolution of the alerts during the last 24 hours. You can indicate a different time period using the selector at the top right part of the area to show the alerts in that period. Click the refresh button next to it to update the timeline. Also, you can check the Related checkbox to see other alerts related to these entities.
  • The list of individual alerts that belong to this group. Click on the alert to see the alert description at the right part. Use the buttons at the bottom to choose the number of alerts to show and navigate through the different pages.
  • The individual description of the alert, which shows the name of the alert, its criticality, date when it was triggered, message and description, entities involved, and alert state (unread, false positive, new, etc).  You can also check the extra data the alert contains.

Associations

You can find the Associations section in both alerts and investigations. Associations are related to entities, which are a basic concept in the Security Operations application. There's a background process in charge of getting all the IP addresses, hostnames, URLs, and so forth from the available sources (those are the entities) and adding them to a multi-model database. When a new entity is found, it won't have any association with other ones. However, when it is found again in the same source or in a different one, the system will start defining the relationships in the database. These relationships between entities can be checked in this area.

The processes that take this information are called context flows, and they are constantly executing queries against the union tables and also against the base tables. The configuration of these flows is performed by  Devo security experts when first installing the Security Operation app on a new domain. Note that the initial entities loading process from the origin tables to the entities database will take some time, and this info will be updated as new data arrives at the tables.

Entities are divided into 2 different types, and each of them has 4 different types: System (hostname, IP, location and URL) and User (name, email, domain and account). Entities have a relatively short TTL (time to live): one week in case of User-type entities and 24 hours in case of System-type ones. After this period, entities are deleted from the database and won't be available in the application. However, if you access an entity, its TTL will be extended for another 24 hours or week, depending on the type.

When you click the Associations button in the alerts group description, you will find the associations that correspond to one of the entities with default values.

The graph in this area shows entities as nodes, and the relationships between them are represented with arrows. The nodes in the graph have different sizes depending on the impact. Hover over a node to see the following information: 

firstSeenDate when the entity was first identified.
ImpactMagnitude value of the entity (1-100)
degreeThe number of connections from nodes related to the entity, both incoming and outcoming.
ttlTime until the entity is invalid beginning from first seen, and aging by last seen (time to live)
lastSeenLast time the entity was detected.
TypeThe type of the entity (system or user)

There is a default query when you open the tab, and you can change the settings in the left section. These are the available visualization options of the graph, divided into two different tabs (Query filters and Graph visualization):

Query filters

Relationships

Choose to display Incoming or Outgoing associations or both.

Limit

Set the number of nodes you want to show.

Depth

Indicate the number of jumps.

Impact

Filter by impact, applying the operations to get the required results.

The impact is a value calculated for each entity at the moment it is stored in the entities database. It is based on an algorithm plus a combination with the number of connections an entity has. The values are from 1 to 100, when 100 is the highest impact and 1 the lowest. High impact is something to take into account and makes the entity behavior more critical. The nodes in the graph are bigger when the impact is higher.

Entities

Choose an entity type (system or user) and property (from the available ones), then enter a specific value in the text field to filter by and click the Add button. Keep adding the required values to apply all the specified filters by repeating this process.

Query to trigger

Check the query that will be triggered to represent the graph.

Graph visualization

Clustering

Organize the nodes in your graph according to their Impact or PCR (Producer-Consumer Ratio). Check the corresponding toggles to apply the required organization method.

Shortest Path

Enter a source and a target entity in the From and To fields and click the Search button to highlight the shortest path between those elements in the graph. You can also indicate the source and target nodes by clicking them in the graph. You will find additional info about the highlighted path in the Path Info area.

Nodes that show a + icon have incoming or outcoming relationships that are hidden by default. You can show the node relationships by right-clicking the + icon, then selecting Expand Incoming or Expand Outgoing. Note that user-type entities have only outgoing relationships.

Under the graph, you can see a timeline where you can check the history of one or several entities. Use the keys under the timeline to navigate through it and see the evolution in the graph.

Increase the sighting count of an entity

The sighting count of an entity indicates the number of times that a specific entity has appeared in an investigation. This count can be manually increased by a user after filtering alerts. To do it, click the ? symbol next to the required entity in the top part of an alerts group. You will see a window that displays the number of times that entity has appeared in an investigation, as well as the first and last time it appeared. Click Submit to sighting now to increase the count by 1. 

Note that this action cannot be undone.

Download as PDF

PREVIOUS
Triage
NEXT
Triaging investigations

Export

See what Devo can do for you. Request a demo!
Discover what's new (Release notes)
  • Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • +1 888 6830910 (USA)
  • +34 900 838 880 (Spain)
Copyright © 2019 Legal Terms Privacy Policy Cookies Policy

Powered by Confluence and Scroll Viewport