---
title: "Devo DeepTrace"
canonical: "https://docs.devo.com/space/latest/248840304/Devo%20DeepTrace"
format: markdown
---
> Macro (excerpt-include)
Watch video
> Macro (widget)
> Macro (toc)
## Overview
**Devo DeepTrace **is an autonomous alert investigation and threat-hunting capability of the Devo Platform. It allows you to perform full investigations on alerts or suspicious events. DeepTrace attack-tracing AI pieces together the activity of malicious users or external actors enabling you to quickly analyze and report results in the form of traces - artifacts that fully and chronologically document each attack chain.
> ℹ️ **Requirements**
> ℹ️
> ℹ️ This is not an out-of the box feature. If you want to start using **DeepTrace**, please visit [Devo support site](https://devo.my.site.com/support/s/).
## How can DeepTrace help you?
Devo **DeepTrace **helps security teams autonomously investigate alerts and suspicious events and perform threat hunting via:
- **Fully documented attack chains that speed investigations: **Utilising attack tracing. Building traces, which fully and chronologically document each attack chain.
- **An AI engine that augments analysts: **Providing analysts with context and points of reference detailing the attacker’s path through an organisation’s infrastructure by asking potentially hundreds of thousands of questions. It emulates how **SOC **(Security Operations System)** **analysts investigate alerts, incidents, and suspicious behaviours.
- **Autonomous investigations that accelerate context-based decision-making:** Autonomously traverses historical data to document an adversary’s behaviour from start to finish of an attack, providing the facts analysts need to take effective action.
- **Autonomous threat hunting to up-skill analysts:** Helps threat hunters quickly construct and configure new hunts that map to **MITRE ATT&CK **framework tactics and techniques. Once refined and validated, these can be converted to new cadence-based threat detections.
## What permissions do you need to use DeepTrace?
To access DeepTrace and use its features in Devo, you need a specific permission, as well as other satellite permissions to access the areas where these features are used:
- Feature enabler: the *DeepTrace features* permission is required to enable all the options and menus throughout the platform.
- Auto-investigate in DeepTrace: the *Finders* permissions is required to open a search and the *Alert configuration* permission is required to define a new alert, which is where auto-investigations are configured.
- Trace status: the *Triggered alerts* permission is required to access the alerts history area, which is where traces are displayed and monitored.
## What will you find in DeepTrace?
**DeepTrace** opens showing you a dashboard with the following sections:
Click here to see the details
| **Section** | **Icon** | **Detail** |
| --- | --- | --- |
| **Dashboard** |  | Main dashboard provides a general overview of:
- Traces
- Devices
- Triggers
- Leads |
| **Traces** |  | Traces page shows all the traces generated by Devo that depict suspicious activities, attacks and campaigns prioritized in order. |
| ** Devices** |  | Risky devices page shows a list of devices that were implicated in traces with additional details. |
| **Search** |  | Smart search page allows you to search for processes exhibiting suspicious behaviour to trigger investigations. |
| **Hunt** |  | Hunt page allows you to manage hunt for suspicious behaviour, processes, network, actions, etc. to trigger investigations. |
| **Triggers** |  | Trigger page provides all triggers for hunting whether it was triggered from Hunt configuration or by configured external alerts. |
| **Settings** |  | Settings menu allows you to access various system, administration and monitoring settings. |
| **Log out** |  | Logs out the current user. |
> ℹ️ **More information**
> ℹ️
> ℹ️ If you want to know more about the possibilities with **Devo DeepTrace,** visit [Devo support site](https://devo.my.site.com/support/s/).
## DeepTrace in Devo Platform
**Devo DeepTrace** allows **EDR (Endpoint Detection and Response)** and other data to be brought into DeepTrace instance. The combined deployment will be configured to enable alerts and EDR data investigations using** DeepTrace**.* *Devo customers that have activated it in their domain, will have an additional tab in their navigation pane named **DeepTrace**.
There are two different ways to start sending events and alerts with **Devo DeepTrace**:
> Macro (rw-ui-tabs-macro)
>
> > Macro (rw-tab)
>
> You can activate Auto-investigation in DeepTrace when creating a new alert definition from the** Data Search** tab. Click the **alert** icon to create a new alert definition and select **Auto-investigation in DeepTrace**.
>
> > ℹ️ **Auto-investigate in DeepTrace**
> > ℹ️
> > ℹ️ DeepTrace does not allow grouping tables, when clicking on the Auto-investigate in DeepTrace the **Auto-investigation query** opens with your query without grouping, you can also modify here the query that is going to be investigated by **DeepTrace**.
> > ℹ️
> > ℹ️ ***rawMessage***** field required**
> > ℹ️
> > ℹ️ The *rawMessage* field must be included in the Auto-Investigation query definition (`select rawMessage`), even if it's not in the alert definition query. Otherwise, DeepTrace will not trigger an investigation even though the alert itself was triggered.
>
> 
>
>
> > Macro (rw-tab)
>
> It is possible to activate **DeepTrace** when opening a table in Data Search by clicking on the **engine tool button** **→ New → DeepTrace Investigation**.
>
> 
>
> You can also send a **single event** to be investigated in DeepTrace. To do that select the event and do right-click to open the options and start investigating in **DeepTrace**.
>
> > ⚠️ **Why can’t I see that option?**
> > ⚠️
> > ⚠️ Be aware this option will be available when there is **no grouping** and at least **one event **is selected in the table.
Once the alert definition is created you can see the status of the alert by clicking on the **Alert **tab or **DeepTrace** tab in the navigation pane.
> Macro (rw-ui-tabs-macro)
>
> > Macro (rw-tab)
>
> Go to **Alerts** in the navigation pane. Check the **Trace status** column to see the status of your alert. You can also click on the **DeepTrace** icon that appears in the **Actions** column to open **DeepTrace**.
>
> 
>
> There are different **trace statuses**:
>
> | **Status** | **Details** |
> | --- | --- |
> | **No trace** | There have been some suspicious behaviours on the trace but no threats. |
> | **Waiting** | The investigation is being done. |
> | **Trace found** | There are some traces that need your attention. |
> | **Error** | An error occurred which prevented the investigation from proceeding. |
>
> > Macro (rw-tab)
>
> Go to **DeepTrace** in the navigation pane. DeepTrace opens showing you a Dashboard with the following sections:
>
> - **Traces**: The traces generated by Devo that depict suspicious activities, attacks and campaigns prioritised in order.
> - **Devices**: Devices that are implicated in the trace.
> - **Triggers**: All the trigger information of the trace.
> - **Leads: **Investigations of the trace.
>
> 
> ℹ️ **Devo Connect**
> ℹ️
> ℹ️ Learn more about **DeepTrace** in the the related articles:
> ℹ️
> ℹ️ - [Anatomy of a Trace: An all encompassing guides to “traces”, the key foundational element of Devo DeepTrace.](https://community.devo.com/guides-and-troubleshooting-82/devo-deeptrace-anatomy-of-a-trace-494)
> ℹ️ - [AI Assisted Hunting: Everything you need to know about hunting in DeepTrace.](https://community.devo.com/guides-and-troubleshooting-82/deeptrace-ai-assisted-hunting-495)
> ℹ️ - [How to Reduce Manual Investigative Processes with DeepTrace](https://community.devo.com/guides-and-troubleshooting-82/how-to-reduce-manual-investigative-processes-with-deeptrace-630).
> ℹ️ - [How to Trace Every Attack from Start to Finish with DeepTrace](https://community.devo.com/guides-and-troubleshooting-82/how-to-trace-every-attack-from-start-to-finish-with-deeptrace-644).