mkdocs.yml

copyright: Copyright 2022 SEKOIA. All rights reserved.
extra:
  social:
  - icon: fontawesome/brands/twitter
    link: https://twitter.com/sekoia_io
extra_css:
- stylesheets/sekoiaio.css
extra_javascript:
- javascript/sekoiaio.js
markdown_extensions:
- admonition
- attr_list
- codehilite
- pymdownx.details
- pymdownx.highlight:
    linenums: true
    linenums_style: pymdownx-inline
- pymdownx.superfences
- pymdownx.tabbed:
    alternate_style: true
- markdown_include.include:
    base_path: docs
nav:
- Getting Started:
  - Overview: getting_started/index.md
  - First steps: getting_started/first_steps.md
  - Inviting users to join your community: getting_started/inviting_users_to_join_your_community.md
  - Search:
    - Dork Language: searching/dork.md
    - Querying Operations Center Events: searching/search_events.md
- Operations Center:
  - Overview: operation_center/index.md
  - Dashboards: operation_center/threat_exposition.md
  - Integration Catalog:
    - Overview: operation_center/integration_catalog/index.md
    - Application:
      - Alsid: operation_center/integration_catalog/application/alsid.md
      - Apache: operation_center/integration_catalog/application/apache.md
      - BIND: operation_center/integration_catalog/application/bind.md
      - ISC DHCP: operation_center/integration_catalog/application/dhcpd.md
      - HAProxy: operation_center/integration_catalog/application/haproxy.md
      - Nginx: operation_center/integration_catalog/application/nginx.md
      - OpenSSH: operation_center/integration_catalog/application/openssh.md
      - SEKOIA.IO: operation_center/integration_catalog/application/sekoiaio_activity_logs.md
      - Unbound: operation_center/integration_catalog/application/unbound.md
      - The Hive: operation_center/integration_catalog/application/thehive.md
    - Cloud and SaaS:
      - AWS:
        - CloudTrail: operation_center/integration_catalog/cloud_and_saas/aws/aws_cloudtrail.md
        - VPC Flow Logs: operation_center/integration_catalog/cloud_and_saas/aws/aws_flow_logs.md
      - Cisco Umbrella:
        - Proxy: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_proxy.md
        - IP: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_ip.md
        - DNS: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_dns.md
      - Digital Shadows: operation_center/integration_catalog/cloud_and_saas/digital_shadows.md
      - Microsoft Azure:
        - Azure Active Directory: operation_center/integration_catalog/cloud_and_saas/azure/azure_ad.md
        - Azure MySQL: operation_center/integration_catalog/cloud_and_saas/azure/azure_mysql.md
        - Azure Linux machines: operation_center/integration_catalog/cloud_and_saas/azure/azure_linux.md
        - Azure Network Watcher: operation_center/integration_catalog/cloud_and_saas/azure/azure_network_watcher.md
        - Azure Windows machines: operation_center/integration_catalog/cloud_and_saas/azure/azure_windows.md
      - Microsoft Office 365: operation_center/integration_catalog/cloud_and_saas/o365.md
      - Imperva Web Application Firewall: operation_center/integration_catalog/cloud_and_saas/imperva_waf.md
    - Email:
      - FortiMail: operation_center/integration_catalog/email/fortimail.md
      - Postfix: operation_center/integration_catalog/email/postfix.md
      - Retarus Email Security: operation_center/integration_catalog/email/retarus_email_security.md
      - SpamAssassin: operation_center/integration_catalog/email/spamassassin.md
      - Vade for M365: operation_center/integration_catalog/email/vade.md
    - Endpoint:
      - Auditbeat Linux: operation_center/integration_catalog/endpoint/auditbeat_linux.md
      - HarfangLab: operation_center/integration_catalog/endpoint/harfanglab.md
      - Linux: operation_center/integration_catalog/endpoint/linux.md
      - Panda Security Aether: operation_center/integration_catalog/endpoint/panda_security_aether.md
      - SentinelOne: operation_center/integration_catalog/endpoint/sentinelone.md
      - SentinelOne Deep Visibility: operation_center/integration_catalog/endpoint/sentinelone_deepvisibility.md
      - Tanium: operation_center/integration_catalog/endpoint/tanium.md
      - Windows: operation_center/integration_catalog/endpoint/windows.md
      - Windows (Log Insight): operation_center/integration_catalog/endpoint/log_insight_windows.md
    - Network:
      - Checkpoint: operation_center/integration_catalog/network/checkpoint.md
      - Cisco: operation_center/integration_catalog/network/cisco_asa.md
      - F5 BigIP: operation_center/integration_catalog/network/f5-big-ip.md
      - FortiGate: operation_center/integration_catalog/network/fortigate.md
      - FortiProxy: operation_center/integration_catalog/network/fortiproxy.md
      - FortiWeb: operation_center/integration_catalog/network/fortiweb.md
      - McAfee Web Gateway: operation_center/integration_catalog/network/mcafee_web_gateway.md
      - NetFilter: operation_center/integration_catalog/network/netfilter.md
      - PaloAlto: operation_center/integration_catalog/network/paloalto.md
      - Pulse Connect Secure: operation_center/integration_catalog/network/pulse.md
      - Sophos Firewall: operation_center/integration_catalog/network/sophos.md
      - Squid: operation_center/integration_catalog/network/squid.md
      - Stormshield: operation_center/integration_catalog/network/stormshield_network_security.md
      - Suricata: operation_center/integration_catalog/network/suricata.md
      - Vectra: operation_center/integration_catalog/network/vectra.md
      - Wallix: operation_center/integration_catalog/network/wallix.md
      - Zeek: operation_center/integration_catalog/network/zeek.md
    - Generic:
      - Common Event Format: operation_center/integration_catalog/generic/cef.md
  - Data Collection:
    - Overview: operation_center/data_collection/index.md
    - Ingestion methods:
      - Overview: operation_center/data_collection/ingestion_methods/index.md
      - Rsyslog: operation_center/data_collection/ingestion_methods/rsyslog.md
      - Logstash: operation_center/data_collection/ingestion_methods/logstash.md
      - syslog-ng: operation_center/data_collection/ingestion_methods/syslog-ng.md
      - Graylog: operation_center/data_collection/ingestion_methods/graylog.md
      - HTTPS: operation_center/data_collection/ingestion_methods/https.md
  - Configure:
    - Entities: operation_center/entities.md
    - Intakes: operation_center/intakes.md
    - Assets: operation_center/assets.md
  - Detect:
    - Rules Catalog: operation_center/rules_catalog.md
  - Investigate:
    - Alerts: operation_center/alerts.md
    - Events: operation_center/events.md
    - Cases: operation_center/cases.md
  - FAQ: operation_center/faq.md
- Intelligence Center:
  - Overview: intelligence_center/index.md
  - Data Model: intelligence_center/data_model.md
  - API: intelligence_center/api.md
  - External Integrations:
    - Overview: intelligence_center/integrations/index.md
    - Cortex Analyzer: intelligence_center/integrations/thehive.md
    - MISP Feed: intelligence_center/integrations/misp.md
    - Microsoft Sentinel: intelligence_center/integrations/microsoft-sentinel.md
    - OpenCTI: intelligence_center/integrations/opencti.md
    - Splunk: intelligence_center/integrations/splunk.md
  - Web Application:
    - Dashboards: intelligence_center/dashboard.md
    - Intelligence: intelligence_center/intelligence.md
    - Graph Explorations: intelligence_center/graph_explorations.md
    - Observables: intelligence_center/observables.md
    - Data Export: intelligence_center/data_export.md
- User Center:
  - Overview: user_center/index.md
  - Account Settings: user_center/account_settings.md
  - Multi-factor authentication: user_center/multi_factor_authentication.md
  - Notifications: user_center/notifications.md
  - API Key creation: user_center/apikeys.md
- Playbooks:
  - Overview: playbooks/overview.md
  - Triggers: playbooks/triggers.md
  - Operators: playbooks/operators.md
  - Actions: playbooks/actions.md
  - Library:
    - AWS: playbooks/library/aws.md
    - Binaryedge's api: playbooks/library/binaryedge-s-api.md
    - Censys: playbooks/library/censys.md
    - Certificate_transparency: playbooks/library/certificate-transparency.md
    - Detection-rules: playbooks/library/detection-rules.md
    - Digital Shadows: playbooks/library/digital-shadows.md
    - Fileutils: playbooks/library/fileutils.md
    - Fortigate_fw: playbooks/library/fortigate-fw.md
    - Glimps: playbooks/library/glimps.md
    - Google: playbooks/library/google.md
    - Git: playbooks/library/git.md
    - Http: playbooks/library/http.md
    - Harfanglab: playbooks/library/harfanglab.md
    - Iknowwhatyoudownload: playbooks/library/iknowwhatyoudownload.md
    - Imperva: playbooks/library/imperva.md
    - Iptoasn: playbooks/library/iptoasn.md
    - Misp: playbooks/library/misp.md
    - Mwdb: playbooks/library/mwdb.md
    - Mandrill: playbooks/library/mandrill.md
    - Mattermost: playbooks/library/mattermost.md
    - Osint: playbooks/library/osint.md
    - Onyphe: playbooks/library/onyphe.md
    - Pagerduty: playbooks/library/pagerduty.md
    - Panda Security: playbooks/library/panda-security.md
    - Public_suffix: playbooks/library/public-suffix.md
    - Rss: playbooks/library/rss.md
    - Riskiq: playbooks/library/riskiq.md
    - SEKOIA.IO: playbooks/library/sekoia-io.md
    - STIX: playbooks/library/stix.md
    - Servicenow: playbooks/library/servicenow.md
    - Shodan: playbooks/library/shodan.md
    - TheHive: playbooks/library/the-hive.md
    - Tranco: playbooks/library/tranco.md
    - Triage: playbooks/library/triage.md
    - Vade secure: playbooks/library/vade-secure.md
    - Virustotal: playbooks/library/virustotal.md
    - Whois: playbooks/library/whois.md
- Develop:
  - Overview: develop/index.md
  - Guides:
    - Get Started: develop/guides/get_started.md
    - Authentication Overview: develop/guides/authentication_overview.md
    - Filtering: develop/guides/filtering.md
  - REST API:
    - Authentication: develop/rest_api/identity_and_authentication.md
    - Community: develop/rest_api/community.md
    - Dashboard: develop/rest_api/dashboard.md
    - Notification: develop/rest_api/notification.md
    - Operation Center:
      - Configuration: develop/rest_api/operation_center/configuration.md
      - Parser: develop/rest_api/operation_center/parser.md
      - Alert: develop/rest_api/operation_center/alert.md
      - Assets: develop/rest_api/operation_center/assets.md
    - Intelligence Center:
      - Intelligence: develop/rest_api/intelligence_center/intelligence.md
      - Enrichments: develop/rest_api/intelligence_center/enrichments.md
    - Playbooks: develop/rest_api/playbooks.md
plugins:
- search: null
- redirects:
    redirect_maps:
      'api/automation: symphony orchestrator': develop/rest_api/playbooks.md
      api/dashboards: develop/rest_api/dashboard.md
      api/identity & authentication: develop/rest_api/identity_and_authentication.md
      'api/ingest: manage and test event parsers': develop/rest_api/operation_center/parser.md
      'api/intelligence center: cyber threat intelligence database': develop/rest_api/intelligence_center/intelligence.md
      'api/intelligence center: enrichment': develop/rest_api/intelligence_center/enrichments.md
      api/notifications: develop/rest_api/notification.md
      'api/operation center: alerts & case management': develop/rest_api/operation_center/alert.md
      'api/operation center: asset management': develop/rest_api/operation_center/assets.md
      'api/operation center: rules, entities, intakes, events.md': develop/rest_api/operation_center/configuration.md
      api/profile & permissions: develop/rest_api/community.md
      apis.md: develop/index.md
      getting_started/2fa.md: user_center/multi_factor_authentication.md
      getting_started/apikey_creation.md: user_center/apikeys.md
      integrations/alsid.md: operation_center/integration_catalog/application/alsid.md
      integrations/apache.md: operation_center/integration_catalog/application/apache.md
      integrations/auditbeat.md: operation_center/integration_catalog/endpoint/auditbeat_linux.md
      integrations/auditbeat_linux.md: operation_center/integration_catalog/endpoint/auditbeat_linux.md
      integrations/aws-cloudtrail.md: operation_center/integration_catalog/cloud_and_saas/aws/aws_cloudtrail.md
      integrations/aws-flow-logs.md: operation_center/integration_catalog/cloud_and_saas/aws/aws_flow_logs.md
      integrations/aws_cloudtrail.md: operation_center/integration_catalog/cloud_and_saas/aws/aws_cloudtrail.md
      integrations/aws_flow_logs.md: operation_center/integration_catalog/cloud_and_saas/aws/aws_flow_logs.md
      integrations/azure-ad.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_ad.md
      integrations/azure-linux.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_linux.md
      integrations/azure-mysql.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_mysql.md
      integrations/azure-network-watcher.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_network_watcher.md
      integrations/azure-windows.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_windows.md
      integrations/azure_ad.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_ad.md
      integrations/azure_linux.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_linux.md
      integrations/azure_mysql.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_mysql.md
      integrations/azure_network_watcher.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_network_watcher.md
      integrations/azure_windows.md: operation_center/integration_catalog/cloud_and_saas/azure/azure_windows.md
      integrations/bind.md: operation_center/integration_catalog/application/bind.md
      integrations/cef.md: operation_center/integration_catalog/generic/cef.md
      integrations/checkpoint.md: operation_center/integration_catalog/network/checkpoint.md
      integrations/cisco-asa.md: operation_center/integration_catalog/network/cisco_asa.md
      integrations/cisco_asa.md: operation_center/integration_catalog/network/cisco_asa.md
      integrations/dhcpd.md: operation_center/integration_catalog/application/dhcpd.md
      integrations/f5-big-ip.md: operation_center/integration_catalog/network/f5-big-ip.md
      integrations/fortigate.md: operation_center/integration_catalog/network/fortigate.md
      integrations/fortimail.md: operation_center/integration_catalog/email/fortimail.md
      integrations/fortiproxy.md: operation_center/integration_catalog/network/fortiproxy.md
      integrations/fortiweb.md: operation_center/integration_catalog/network/fortiweb.md
      integrations/freeradius.md: operation_center/index.md
      integrations/fsecure.md: operation_center/index.md
      integrations/haproxy.md: operation_center/integration_catalog/application/haproxy.md
      integrations/harfanglab.md: operation_center/integration_catalog/endpoint/harfanglab.md
      integrations/linux.md: operation_center/integration_catalog/endpoint/linux.md
      integrations/log-insight-windows.md: operation_center/integration_catalog/endpoint/log_insight_windows.md
      integrations/log_insight_windows.md: operation_center/integration_catalog/endpoint/log_insight_windows.md
      integrations/netfilter.md: operation_center/integration_catalog/network/netfilter.md
      integrations/nginx.md: operation_center/integration_catalog/application/nginx.md
      integrations/o365.md: operation_center/integration_catalog/cloud_and_saas/o365.md
      integrations/openssh.md: operation_center/integration_catalog/application/openssh.md
      integrations/paloalto.md: operation_center/integration_catalog/network/paloalto.md
      integrations/panda-security-aether.md: operation_center/integration_catalog/endpoint/panda_security_aether.md
      integrations/postfix.md: operation_center/integration_catalog/email/postfix.md
      integrations/prove-it.md: operation_center/index.md
      integrations/pulse-connect-secure.md: operation_center/integration_catalog/network/pulse.md
      integrations/pulse.md: operation_center/integration_catalog/network/pulse.md
      integrations/raw.md: operation_center/index.md
      integrations/retarus-email-security.md: operation_center/integration_catalog/email/retarus_email_security.md
      integrations/sekoiaio-activity-logs.md: operation_center/integration_catalog/application/sekoiaio_activity_logs.md
      integrations/sentinelone-deepvisibility.md: operation_center/integration_catalog/endpoint/sentinelone_deepvisibility.md
      integrations/sentinelone.md: operation_center/integration_catalog/endpoint/sentinelone.md
      integrations/sentinelone_deepvisibility.md: operation_center/integration_catalog/endpoint/sentinelone_deepvisibility.md
      integrations/sophos.md: operation_center/integration_catalog/network/sophos.md
      integrations/spamassassin.md: operation_center/integration_catalog/email/spamassassin.md
      integrations/squid.md: operation_center/integration_catalog/network/squid.md
      integrations/suricata.md: operation_center/integration_catalog/network/suricata.md
      integrations/tanium.md: operation_center/integration_catalog/endpoint/tanium.md
      integrations/umbrella-dns.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_dns.md
      integrations/umbrella-ip.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_ip.md
      integrations/umbrella-proxy.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_proxy.md
      integrations/umbrella_dns.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_dns.md
      integrations/umbrella_ip.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_ip.md
      integrations/umbrella_proxy.md: operation_center/integration_catalog/cloud_and_saas/cisco_umbrella/umbrella_proxy.md
      integrations/unbound.md: operation_center/integration_catalog/application/unbound.md
      integrations/vectra-cognito-detect.md: operation_center/integration_catalog/network/vectra.md
      integrations/wallix-bastion.md: operation_center/integration_catalog/network/wallix.md
      integrations/wazuh.md: operation_center/index.md
      integrations/windows.md: operation_center/integration_catalog/endpoint/windows.md
      integrations/zeek.md: operation_center/integration_catalog/network/zeek.md
      integrations/transport/graylog.md: operation_center/data_collection/ingestion_methods/graylog.md
      integrations/transport/https.md: operation_center/data_collection/ingestion_methods/https.md
      integrations/transport.md: operation_center/data_collection/ingestion_methods/index.md
      integrations/transport/logstash.md: operation_center/data_collection/ingestion_methods/logstash.md
      integrations/transport/rsyslog.md: operation_center/data_collection/ingestion_methods/rsyslog.md
      integrations/transport/syslog-ng.md: operation_center/data_collection/ingestion_methods/syslog-ng.md
      integrations/sekoiaio_activity_logs.md: operation_center/integration_catalog/application/sekoiaio_activity_logs.md
      integrations/thehive.md: operation_center/integration_catalog/application/thehive.md
      integrations/imperva_waf.md: operation_center/integration_catalog/cloud_and_saas/imperva_waf.md
      operation_center/operators.md: playbooks/operators.md
      operation_center/playbook_overview.md: playbooks/overview.md
      operation_center/actions.md: playbooks/actions.md
      operation_center/triggers.md: playbooks/triggers.md
      integrations/index.md: operation_center/integration_catalog/index.md
- redoc
- intakes_by_uuid
repo_url: https://github.com/SEKOIA-IO/documentation
site_name: SEKOIA.IO Documentation
site_url: https://docs.sekoia.io
theme:
  custom_dir: theme
  favicon: assets/favicon.ico
  features:
  - navigation.tabs
  - navigation.top
  - content.code.annotate
  font:
    text: Open Sans
  include_search_page: true
  logo: assets/sekoiaio.svg
  name: material
  search_index_only: false