Detections, alerts and incidents
| Term | Meaning |
|---|---|
| Event | A log line or telemetry record, from a collector, the endpoint agent, a connector or Ciyora itself. |
| Detection rule | A Sigma condition, threshold or multi-stage correlation that matches events. Rules carry MITRE ATT&CK tactics and techniques. |
| Alert | A rule match, or an identity threat or anomaly, with a severity and an owner. |
| Incident | A group of related alerts and signals, with a timeline, affected entities and response actions. |
From events to incidents
- Collect. Collectors on your network receive syslog or tail files and forward events outbound. The endpoint agent sends endpoint telemetry. Ciyora VPN and Ciyora Fortress send their own events.
- Detect. Enabled rules run against incoming events. The MITRE ATT&CK coverage page shows which techniques your enabled rules cover.
- Correlate. Signals from email, endpoints, the network and identity that belong together are linked into an incident, shown as a chain from first signal to last.
- Respond. Analysts assign and update incidents, and run response actions and playbooks. Each action asks for confirmation.
Investigation tools
Log search, IOC search against threat intelligence, read-only live queries across endpoints, and process trees with command lines and hashes.