diff --git a/_shared_content/automate/build-playbooks.md b/_shared_content/automate/build-playbooks.md index c597ad82be..438f04e070 100644 --- a/_shared_content/automate/build-playbooks.md +++ b/_shared_content/automate/build-playbooks.md @@ -60,4 +60,4 @@ To create a playbook from scratch, you will need to create an empty playbook, go Please refer to the documentation for each of these types to learn how to use them efficiently. -You can refer to our [playbook templates](https://github.com/SEKOIA-IO/Community/tree/main/playbooks/templates) and [use cases](../../../usecases/playbook/synchronize_alerts) for inspiration. +You can refer to our [playbook templates](https://github.com/SEKOIA-IO/Community/tree/main/playbooks/templates) and [use cases](/xdr/usecases/playbook/synchronize_alerts/) for inspiration. diff --git a/_shared_content/intelligence_center/integrations/api.md b/_shared_content/intelligence_center/integrations/api.md index 310dc9605d..15cbc8858a 100644 --- a/_shared_content/intelligence_center/integrations/api.md +++ b/_shared_content/intelligence_center/integrations/api.md @@ -37,7 +37,7 @@ The easiest way to create feed configurations is to use the Intelligence Center ![Sekoia.io Intelligence Center Feeds](/assets/intelligence_center/feeds.png){: style="width: 100%; max-width: 100%"} -If you would prefer creating the feed with the API, you can use the [feeds](../../../develop/rest_api/intelligence/#operation/post_feeds_resource) endpoint. +If you would prefer creating the feed with the API, you can use the [feeds](/cti/develop/rest_api/intelligence/#operation/post_feeds_resource) endpoint. The result should contain the feed `id` that may be used to consume the feed. diff --git a/_shared_content/intelligence_center/integrations/thehive.md b/_shared_content/intelligence_center/integrations/thehive.md index 7688344946..10484b00d5 100644 --- a/_shared_content/intelligence_center/integrations/thehive.md +++ b/_shared_content/intelligence_center/integrations/thehive.md @@ -10,7 +10,7 @@ Collect Sekoia.io CTI feed in an existing Cortex instance self-managed, for any - An operational Cortex instance with administrator privileges - An active Sekoia.io licence with access to the CTI -- An access to Sekoia.io User Center with the permissions to create an API key with [CTI permissions](https://docs.sekoia.io/getting_started/Permissions/#cti-permissions) +- An API key with the permission "View intelligence" ## 1. Connect to Cortex diff --git a/_shared_content/ioccollections.md b/_shared_content/ioccollections.md index 5385f0aa83..e8d853c12b 100644 --- a/_shared_content/ioccollections.md +++ b/_shared_content/ioccollections.md @@ -6,7 +6,7 @@ While IOCs produced by Sekoia’s own Threat & Detection Research team are direc You can then easily see telemetry on these collections and use them inside detection rules. -Inside the Intelligence Center, you can access IOC Collections directly from the menu. The CTI permissions required for access are detailed [here.](/getting_started/Permissions) +Inside the Intelligence Center, you can access IOC Collections directly from the menu. Be sure you have a role with the permission `View IOC Collections`, `View IOC collections telemetry` and `Manage IOC collections`. ![collection_menu](/assets/operation_center/IOCscollections/collections_menu.png){: style="max-width:100%"} diff --git a/docs/getting_started/community-edit.md b/docs/getting_started/community-edit.md index 919b00b50e..f88454d1c5 100644 --- a/docs/getting_started/community-edit.md +++ b/docs/getting_started/community-edit.md @@ -4,7 +4,7 @@ Community information and image can be edited ## Edit a community -To edit a community's name and description, you need to have the [right permissions](https://docs.sekoia.io/getting_started/roles_permissions). +To edit a community's name and description, as an Administrator of the community: 1. Go to the managed community’s main page 2. Click on the `Edit` button next to the community’s name diff --git a/docs/getting_started/invite_users.md b/docs/getting_started/invite_users.md index 934ee00604..91b56d3c9f 100644 --- a/docs/getting_started/invite_users.md +++ b/docs/getting_started/invite_users.md @@ -1,6 +1,6 @@ # Invite users to join your community -To invite users to your community, you need to send them invitations through the User Center. You can invite as many users as needed if you have [the role](/manage_users/#needed-role-and-permissions) `manage_member`. +To invite users to your community, you need to send them invitations through the User Center. You can invite as many users as needed as soon as you are an Administrator of the community. However, depending on the [type of community](/getting_started/create_community.md) you are in, the invitation process can differ. diff --git a/docs/xdr/develop/quickstart.md b/docs/xdr/develop/quickstart.md index 5c03cb725a..15a8b95764 100644 --- a/docs/xdr/develop/quickstart.md +++ b/docs/xdr/develop/quickstart.md @@ -50,7 +50,6 @@ Our API documentation is divided according to the different functionalities the * [Authentication and Community](/xdr/develop/rest_api/community/) * [Dashboard](/xdr/develop/rest_api/dashboard/) -* [Notification](/xdr/develop/rest_api/notification/) * [Configuration](/xdr/develop/rest_api/configuration/) * [Parser](/xdr/develop/rest_api/parser/) * [Alert](/xdr/develop/rest_api/alert/) diff --git a/docs/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder.md b/docs/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder.md index 1e2c2068ab..498cf49546 100644 --- a/docs/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder.md +++ b/docs/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder.md @@ -510,7 +510,7 @@ Connect to the remote server where you would like to install the Sekoia.io Forwa 3. Start the docker - Follow the process you can find on the section [Start the concentrator](https://docs.sekoia.io/xdr/features/collect/ingestion_methods/sekoiaio_forwarder.md/#start-the-concentrator) of this page. + Follow the process you can find on the section [Start the concentrator](https://docs.sekoia.io/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder/sekoiaio_forwarder.md/#start-the-concentrator) of this page. ```bash sudo docker compose up -d sudo docker compose ps diff --git a/docs/xdr/features/collect/intakes.md b/docs/xdr/features/collect/intakes.md index be3c642449..de456d3184 100644 --- a/docs/xdr/features/collect/intakes.md +++ b/docs/xdr/features/collect/intakes.md @@ -47,7 +47,7 @@ To set up your notification, you will have to: 1. Go to the Intakes listing page and click on: ![Notification logo](/assets/operation_center/intakes/Monitor_intake_logo.png){: style="max-width:10%"} on the right side of the table 2. Specify how long the intake should be inactive before sending a notification. The duration can go from 15 min to 24 hours. -3. Select how you want to be notified. Triggered actions that are available are mentioned in the page [Turn on notifications](/getting_started/notifications/#triggered-actions.md). +3. Select how you want to be notified. Triggered actions that are available are mentioned in the page [Turn on notifications](/getting_started/notifications-Listing_Creation). !!! note You can also set up this notification from the User Center > Notifications by selecting the trigger `No events are received`. diff --git a/docs/xdr/features/collect/integrations/application/manageengine_adauditplus.md b/docs/xdr/features/collect/integrations/application/manageengine_adauditplus.md index 31356dd5cd..606b56d0a2 100644 --- a/docs/xdr/features/collect/integrations/application/manageengine_adauditplus.md +++ b/docs/xdr/features/collect/integrations/application/manageengine_adauditplus.md @@ -46,7 +46,7 @@ Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a n ## Forward logs to Sekoia.io -Please consult the [Syslog Forwarding](../../../../ingestion_methods/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io. +Please consult the [Syslog Forwarding](/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io. {!_shared_content/operations_center/detection/generated/suggested_rules_890207d2-4878-440d-9079-3dd25d472e0a_do_not_edit_manually.md!} diff --git a/docs/xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md b/docs/xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md index cec86bf387..6585243512 100644 --- a/docs/xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md +++ b/docs/xdr/features/collect/integrations/cloud_and_saas/azure/azure_linux.md @@ -9,16 +9,16 @@ Azure Virtual Machines service is developed and managed by Microsoft Corp. !!! warning This format is deprecated. We highly recommend you to use one of these alternative formats: - - [Sekoia.io endpoint agent](sekoiaio.md) - - [auditbeat](auditbeat_linux.md) + - [Sekoia.io endpoint agent](/xdr/features/collect/integrations/endpoint/sekoiaio) + - [auditbeat](/xdr/features/collect/integrations/endpoint/auditbeat_linux) or one of these numerous EDR formats supported by Sekoia.io: - - [CrowdStrike Falcon](crowdstrike_falcon.md) - - [Cybereason](cybereason_malop.md) - - [Harfanglab](harfanglab.md) - - [Sentinel One](sentinelone.md) - - [Sophos EDR](sophos_edr.md) - - [Tehtris](tehtris_edr.md) - - [Trend Micro Deep Security](trend_micro_deep_security.md) + - [CrowdStrike Falcon](/xdr/features/collect/integrations/endpoint/crowdstrike_falcon) + - [Cybereason](/xdr/features/collect/integrations/endpoint/cybereason_malop) + - [Harfanglab](/xdr/features/collect/integrations/endpoint/harfanglab) + - [Sentinel One](/xdr/features/collect/integrations/endpoint/sentinelone) + - [Sophos EDR](/xdr/features/collect/integrations/endpoint/sophos_edr) + - [Tehtris](/xdr/features/collect/integrations/endpoint/tehtris_edr) + - [Trend Micro Deep Security](/xdr/features/collect/integrations/endpoint/trend_micro_deep_security) diff --git a/docs/xdr/features/collect/integrations/cloud_and_saas/office365/message_trace.md b/docs/xdr/features/collect/integrations/cloud_and_saas/office365/message_trace.md index 2a7bc033f6..31708d6b0e 100644 --- a/docs/xdr/features/collect/integrations/cloud_and_saas/office365/message_trace.md +++ b/docs/xdr/features/collect/integrations/cloud_and_saas/office365/message_trace.md @@ -18,7 +18,7 @@ According to [docs.microsoft.com](https://docs.microsoft.com/en-us/microsoft-365 - Microsoft Defender for Office 365 plan 1 and plan 2 - Microsoft 365 Defender -In Sekoia.io XDR, [create a new intake key](xdr/features/collect/intakes/#create-an-intake-from-our-integrations-catalog) using the "Message Trace" format. +In Sekoia.io XDR, [create a new intake key](/xdr/features/collect/intakes/#create-an-intake-from-our-integrations-catalog) using the "Message Trace" format. ## Configure OAuth diff --git a/docs/xdr/features/collect/integrations/endpoint/trend_micro/trend_micro_apex_one.md b/docs/xdr/features/collect/integrations/endpoint/trend_micro/trend_micro_apex_one.md index 93965d61aa..59a9b83cfc 100644 --- a/docs/xdr/features/collect/integrations/endpoint/trend_micro/trend_micro_apex_one.md +++ b/docs/xdr/features/collect/integrations/endpoint/trend_micro/trend_micro_apex_one.md @@ -77,7 +77,7 @@ Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a n ## Forward logs to Sekoia.io -Please consult the [Syslog Forwarding](../../../ingestion_methods/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io. +Please consult the [Syslog Forwarding](/xdr/features/collect/ingestion_methods/syslog/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io. ## Further Readings diff --git a/docs/xdr/features/collect/integrations/network/squid.md b/docs/xdr/features/collect/integrations/network/squid.md index 50c46df04c..17f1beec35 100644 --- a/docs/xdr/features/collect/integrations/network/squid.md +++ b/docs/xdr/features/collect/integrations/network/squid.md @@ -36,5 +36,5 @@ access_log syslog:local5.info sekoiaio ## Further Readings -- [Integration Source Code](https://github.com/Sekoia.io/intake-formats/tree/master/Squid) +- [Integration Source Code](https://github.com/Sekoia-io/intake-formats/tree/master/Squid) - [Squid Wiki - Log configuration](https://wiki.squid-cache.org/SquidFaq/SquidLogs) diff --git a/docs/xdr/features/investigate/alerts.md b/docs/xdr/features/investigate/alerts.md index 2ae00ae3f5..fe445111a9 100644 --- a/docs/xdr/features/investigate/alerts.md +++ b/docs/xdr/features/investigate/alerts.md @@ -386,7 +386,7 @@ The Graph Tab is presenting the analyst with a graphical visualization of the Al The following items appear on the graph: - `Observables`: these are automatically extracted from events (IP addresses, Domain Names, URLs, User Account, etc.) -- `Observable Relationships`: relationships between observables are represented by arrows linking them on the graph. Relationships are extracted from events using the [Smart Description](https://github.com/Sekoia.io/Community/tree/main/events) definitions +- `Observable Relationships`: relationships between observables are represented by arrows linking them on the graph. Relationships are extracted from events using the [Smart Description](https://github.com/Sekoia-io/Community/tree/main/events) definitions - `CTI Objects`: STIX objects from the Intelligence Center that provide additional context - `STIX relationships` between Threat Objects diff --git a/docs/xdr/features/investigate/events.md b/docs/xdr/features/investigate/events.md index b12fdd1537..0e39a04986 100644 --- a/docs/xdr/features/investigate/events.md +++ b/docs/xdr/features/investigate/events.md @@ -8,7 +8,7 @@ In this documentation, we will dive into the different parts that constitute the - The [Search bar](#search-bar) and its filtering and sharing options - The [list of events](#log-listing) and the detailed view of your parsed events - The mechanism behind [events enrichment](#events-enrichment) or how events are contextualized in Sekoia.io -- The [aggregation](#aggregation) feature and how to create an [anomaly detection rule](Create-Anomaly-Detection-rule-from-the-aggregation-view) from your query +- The [aggregation](#aggregation) feature and how to create an [anomaly detection rule](#Create-Anomaly-Detection-rule-from-the-aggregation-view) from your query !!! note To send your logs to Sekoia.io, please refer to this [section](https://docs.sekoia.io/xdr/features/collect/ingestion_methods/). diff --git a/docs/xdr/usecases/playbook/ExtractIP_from_Url_country.md b/docs/xdr/usecases/playbook/ExtractIP_from_Url_country.md index 6e0a134dc5..4d079cb11e 100644 --- a/docs/xdr/usecases/playbook/ExtractIP_from_Url_country.md +++ b/docs/xdr/usecases/playbook/ExtractIP_from_Url_country.md @@ -6,10 +6,9 @@ This use case describes how to extract an IP address from a URL and a country. ## Prerequisites - A Sekoia.io XDR licence -- The user that configures the Playbook should have a role that contains: - * The [SYMPHONY permissions](https://docs.sekoia.io/getting_started/roles_permissions/#playbooks) -- An API Key with a role that contains at least the following permission: - * `SIC_READ_ALERTS` +- The user that configures the Playbook should have: + * Be an Administrator or an Analyst of the community. + * Have an API Key with a role that contains at least the permission "View alerts" > To create your API Key, follow this [documentation](../../../getting_started/generate_api_keys.md). diff --git a/theme/overrides/develop/cti.html b/theme/overrides/develop/cti.html index e036ba91d0..e6c2057ae6 100644 --- a/theme/overrides/develop/cti.html +++ b/theme/overrides/develop/cti.html @@ -54,7 +54,6 @@