Skip to main content

Getting started with Ciyora Detect

Ciyora Detect covers SIEM, endpoint detection, XDR correlation and response. Its pages are under Security operations in Ciyora Console.

  1. Send events. Deploy a collector near your log sources in gateway mode to receive syslog (UDP, TCP or TLS), or in agent mode to tail files. Collectors forward outbound over HTTPS and buffer to disk if the link drops. Deploy the endpoint agent where you need endpoint telemetry and live query.
  2. Check ingest under Security operations > SIEM overview: events per source and pipeline health.
  3. Enable rules under Security operations > Detection rules, then look at MITRE ATT&CK coverage to see which techniques you cover and which tactic is weakest.
  4. Turn on threat intelligence feeds under Security operations > Threat intelligence.
  5. Work the queue. Alerts and incidents appear under Alerts and Incidents. Assign an owner, follow the timeline and run response actions; each asks for confirmation.
  6. Automate carefully. Enable response rules and playbooks under Response and playbooks once you trust them.

Related concept: Detections, alerts and incidents.