SOC Prime

Sergey Bayrachny

Nataliia Pukaliak

Eugene

Platform Guides

Introduction

Getting Started

Prime Core Overview

Active Threats

Overview

Search Types | Applying Search Profiles | Sorting and filtering | Understanding rule details

Search

Detection Rule Page

Hunt

Repositories

Picking content for automated streaming | Setting up and managing Content Lists

Lists

Additional content types available under Enterprise

Enterprise-Only Content Types

Lucene Syntax

How to export content from a SIEM

Content Import and Bulk Translation

GitLab CI/CD

How to Publish and Share Content

Supported Platforms

Prime Core

Dashboards Deployment for Security Monitoring Based on the Elastic Stack

Office 365 Rule Pack

How to install the Elastic Common Schema (ECS) index template from SOC Prime Platform

Elastic Stack ECS Template

This guide describes detecting abnormal spikes of attacks identified by WAF from a single IP to a single web application

Detecting Network Spikes Identified by WAF for the Elastic Stack Platform

How to use SOC Prime Platform content for detection of obfuscated Windows command-line invocations on endpoints

Obfuscated Command-Line Detection Using Splunk Search

How to deploy the SSL Framework Content Pack from the SOC Prime Platform into your Splunk instance

Deploying SOC Prime's SSL Framework for Splunk

Sysmon is a free tool designed to extend the current logging in Windows to aid in understanding and detecting attackers by behavior.

Sysmon Rules Guide

Andrew Vdovin

How To Deploy Content

Automation: Getting Started

Managing content in Inventory | Updating content

Inventory

Viewing logs in Automation | Checking deployment results

History

Deploying content via Automation with Jobs | Setting up and managing Jobs

Jobs

Automation

Leaderboards

Insights on Platform utilization | Downloading Raw Data

Dashboard

Understanding your content coverage based on log sources

Log Source Coverage

Understanding your ATT&CK coverage based on utilized content

MITRE ATT&CK® Coverage

Analytics

Prime Architect Overview

Scope of Platform Support

Prime Architect

Agentic Threat Research Overview

Projects

Agentic Skills

Generate Deep Threat Research with AI

Generate Attack Flow with AI

Generate Behavior Rule with AI

Search Active Threats with AI

Search Detection Rules with AI

Search in MISP with AI

Generate Short Summary of a Rule/Query/Report with AI

Generate Full Summary of a Rule/Query/Report with AI

Generate Decision Tree of a query/rule with AI

Use AIDEFEND MCP

Agentic Threat Research

Translation Overview

How to Generate Behavior Rules and Queries with AI

How to Generate IOC Queries

How to Generate a Summary of a Rule/Query/Report with AI

How to Generate the Decision Tree of a Query/Rule with AI

How to Generate Attack Flow with AI

How to Add ATT&CK Tags to a Sigma Rule with AI

How to Use a Custom Prompt to Perform Custom AI Tasks

How to Translate Detection Content

How to Validate Query Syntax and Structure with AI

How to Optimize a Query with AI

How to Aggregate Query Results with AI

How to Explore Prime Core Content

Write Sigma rules | IDE for detection engineering | Green Warden | Save Rules

How to Write Sigma Rules

How to Avoid Frequent Sigma Mistakes

How to Create Use Case Documentation in Confluence

How to Use OpenTide Integration

Translation

Prime Hunt Overview

Event Analysis (LogTotal)

Attack Chains

Setup Requirements and Recommendations

Configure and Run Data Audit

View Data Audit Results

Configure and Run Scan

View Scan Results

Configure and Run Content Audit

View Content Audit Results

Track and Manage Audits and Scans

Prime Hunt

Prime Detect Requirements and Deployment Guide

Prime Detect Deployment Guide Minikube

Prime Detect

Initial Setup

Account Information

Pipelines

Repositories and Rules

Topics

Log Sources

Integrations

Filters

User Management

Audit Logs

System Status

Pipeline Runtime

Roles and Permissions

Prime Detect User Guide

Account

Manage your subscriptions to the SOC Prime Platform products

Subscriptions

Changing password | 2-factor authentication | Recovery codes

Account Security

Setting up notifications about new and updated content

Email Notifications

Setting up professional role and security platform

Role and Platform

Invite Your Team

Account Settings

Tenants

Team Management and Roles

Setting up and managing integrations with your Data Planes

Data Planes

Creating and managing profiles to customize rules' code for your data schema

Custom Field Mapping

Adding extra conditions to code before deployment with Filters | Setting up and managing Filters

Customizing content settings before deployment with Presets | Setting up and managing Presets

Presets

Setting up and managing profiles to simplify search

Search Profiles

Single Sign-On | SSO | SAML 2.0 | Okta | Microsoft Entra ID

SSO Configuration

Platform Settings

LogTotal (Public)

Threat Detection Marketplace

No tickets or conversations found

Try selecting a different creation date range.

Tickets and conversations you've started through the messenger will appear here.

No tickets or conversations created by you

Try using different keywords or checking for typos.

Try selecting a different update date range.

Find answers and get help from Intercom Support and Community Experts

Conversations you've started through the messenger will appear here.

No conversations created by you

No conversations found

AI title

Title

This site employs cookies and other technologies that we and our third party vendors use to monitor and record personal information about you and your interactions with the site (including content viewed, cursor movements, screen recordings, and chat contents) for the purposes described in our Cookie Policy. By continuing to visit our site, you agree to our {websiteTermsLink}, {privacyPolicyLink} and {cookiePolicyLink}.

This site uses cookies and similar technologies ("cookies") as strictly necessary for site operation. We and our partners also would like to set additional cookies to enable site performance analytics, functionality, advertising and social media features. See our {cookiePolicyLink} for details. You can change your cookie preferences in our Cookie Settings.

We use cookies to make our site work and also for analytics and advertising purposes. You can enable or disable optional cookies as desired. See our {cookiePolicyLink} for more details.

Advertising cookies are set by our advertising partners to collect information about your use of the site, our communications, and other online services over time and with different browsers and devices. They use this information to show you ads online that they think will interest you and measure the ads' performance. Social media cookies are set by social media platforms to enable you to share content on those platforms, and are capable of tracking information about your activity across other online services for use as described in their privacy policies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

These cookies are necessary for the website to function and cannot be switched off in our systems.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.

You have the right to opt out of the sale of your personal information. See our {cookiePolicyLink} for more details about how we use your data.

Your Privacy Choices

We use cookies to enhance your experience. You can customize your cookie preferences below. See our {cookiePolicyLink} for more details.

Cookie Settings

Empty Help Center

Uh oh. That page doesn’t exist.

Home

Search results

Disappointed

Neutral

Smiley

Thinking...

Searching through sources...

Analyzing...

Tickets submitted through the messenger or by a support agent in your conversation will appear here.

No tickets created by you

No tickets found

Conversations and tickets in {topic}

Conversations and tickets in {topic} // {subtopic}

Volume, creators and topics for your company.

Insights

Top creators

AI topics

Track the progress of all tickets and conversations related to your company.

Customer Portal.

Track the progress of all tickets related to your company.

Tickets portal.

{assigneeName} needs more information from you

Tickets

No access to tickets portal

You're not signed in on this browser. Sign in through this site's Messenger, then reload this page.

Sign in to view your company's tickets

Skip the search. Describe what you’re trying to do and get a grounded answer.

Browse articles and guides in this topic.

Create your workspace and invite the people you work with.

Set up your account

Build your first workflow and watch it run end to end.

Ship something

Connect the tools your team already uses to bring data in.

Connect your stack

A quick lap of the product so you know where everything lives.

{appName} in 60 seconds

This prototype demo is aware that you are reading “{title}”. It can point you back to the current article, but a production article-aware Fin contract is still follow-up work.

Prototype article-aware answer

Because you already asked about invitations, this prototype demo can add the follow-up: use the role selector before sending each invite to limit access to the teammate responsibilities.

Prototype role-limiting follow-up

This prototype demo suggests starting with your workspace profile, inviting the team members who need access, and then connecting the integrations you use.

Prototype getting-started answer

In this prototype demo, integrations are configured from workspace settings. Choose the integration, connect the account, and review the enabled permissions.

Prototype integrations answer

In this prototype demo, invite teammates from workspace settings, then choose the access each teammate needs before sending the invitation.

Prototype invite-team answer

This prototype demo does not have a scripted answer for that question yet. Try asking how to invite your team or open a source article. No production Fin API was called.

Prototype answer unavailable

I’ve got this page open. Ask me anything about it and I’ll answer from the docs.

Reading along with you

Create your account and invite the first people to your workspace.

Pick the right role for each person you add.

Update your plan, payment method, and invoices.