Skip to main content

Initial Setup

N
Written by Nataliia Pukaliak

Authentication

The DetectFlow Admin Panel requires username/password authentication. You can access it at http://{network-service-ip}:4173

First User Account

The first user account has the following credentials:

  • username: admin@soc.local

  • password: admin

You can change the username and password after logging in.

Use the first user account to log in to the Admin Panel and create more accounts for your team (see User Management). Once a new user logs in to the Admin Panel, they are required to change their password provided as part of their credentials.

To reset the username and password of the first user account (admin@soc.local) without UI, use this script directly in the running pod:

# Generate a random temporary password
kubectl exec -n security deployment/admin-panel -- \
  python scripts/reset_password.py --email admin@soc.local

# Set a specific password (specify it in place of 'NewP@ssw0rd')
kubectl exec -n security deployment/admin-panel -- \
  python scripts/reset_password.py --email admin@soc.local --password 'NewP@ssw0rd'

The script will print the new password to stdout. If no `--password` flag is provided, a random temporary password is generated. The user will be required to change the password on the next login.

Getting Started

DetectFlow matches log events from Kafka topics with detection rules and tags each matched event with additional metadata related to the corresponding detection rule:

  • ID

  • Name

  • Severity

  • MITRE ATT&CK (sub-)techniques

For example:

"detectflow": {
    "processed_at": "2026-06-29T13:18:45.123Z",
    "matchnode_version": "1.0.0",
    "matches": [
      {
        "sigma_rule_uuid": "2f958f09-99cf-4af8-8d26-7de834541f07",
        "_rule_id": "r1",
        "rule_name": "Rule r1",
        "severity": "high",
        "mitre_techniques": ["T1003"]
      }
    ]
  }

To get started:

  1. Ensure your Kafka instance has:

    1. Topics with log source events you want to match with detection rules (Source Topics for DetectFlow). You can see the list of all Topics on the Topics page.

    2. Topics for tagged events that are consumed by a SIEM/EDR/Data Lake (Destination Topics for DetectFlow). You can see the list of all Topics on the Topics page.

  2. Create Repositories with detection rules (follow the instructions in the Repositories and Rules section):

    • Local Repositories

    • Cloud Repositories that are synchronized with the SOC Prime Platform

    • Cloud Repositories that are synchronized with third-party open-source repositories on GitHub (SigmaHQ, Microsoft, Splunk, and Elastic)

  3. Create Log Source configurations to parse events and map their fields to the fields of detection rules (follow the instructions in the Log Sources section).

  4. Optionally, create Filters to filter out some events before matching (follow the instructions in the Filters section).

  5. Create Pipelines using Source/Destination Topics, Repositories, Log Sources, and Filters from the previous steps (follow the instructions in the Pipelines section).

  6. Monitor Pipeline operation on the Dashboard page.

  7. Use tagged events for threat inference:

    • Correlate tagged events into Attack Chains using Active Threats from the SOC Prime Platform

    • Pass tagged events to a correlation ML model, such as MITRE TIE

    • Build aggregations directly in your SIEM based on the metadata added to the events

Related Articles
Did this answer your question?