Start here
Make your first API call, understand the evidence, and connect observations to your workflow.
Quickstart
Your first API call in five minutes.
Guides
Step-by-step workflows for security teams and researchers.
API reference
Endpoints, response fields, authentication and limits.
Console guide
Find your tools, permissions and workspace settings.
FAQ
Resolve common errors and understand plans and licensing.
Task guides
Triage an alert IP
Corroborate a local alert with observed activity and confidence.
Block attacker passwords
Review dictionary terms for Entra ID and on-premises AD policy.
Connect a firewall EDL
Configure a short-lived feed with expiry and allowlists.
Enrich SIEM alerts
Use the v1 Splunk, Sentinel, Elastic and Sigma starter pack.
Collect events
Page through observations, consume streams and download results.
Cite observations in research
Use aggregates and the public sample with appropriate attribution.