Monitoring & analytics
Data discovery
Before you can hunt, you need to know what the platform actually stores. Discovery answers three questions: which fields exist, how often they are populated, and what values dominate. Every mainstream SIEM exposes the same idea under a different name.
Indexed fields
248
across 6 source families
Common-schema coverage
93%
fields mapped to the shared model
Sparse fields
17
populated on under 20% of events
Searchable window
90 days
hot + warm tiers
Field explorer
Pick a field to see how complete it is and which values dominate the dataset.
Type
keyword
Populated on
100% of events
Distinct values
6
Top values
Reading tip: a field with low coverage is not necessarily broken. process.name only appears on process-creation events, so 41% is expected. A field that should be universal — like host.name — dropping below 100% is a pipeline defect worth raising.
Saved search library
Reusable starting points, each tied to the lab that teaches it.
Failed logon bursts
source.type = "windows" AND event.code = 4625
Starting point for spray and brute-force triage.
Encoded script execution
process.name = "powershell.exe" AND process.command_line contains "-enc"
Highest-signal execution query on Windows estates.
Credential store access
process.command_line contains "lsass"
Detects dumping attempts against the credential store.
Suspicious outbound resolution
source.type = "dns" AND message contains "cdn-update-sync"
Beacon candidate found during the DNS hunt.
Web upload directory writes
source.type = "web" AND message contains "uploads"
Pairs with integrity monitoring for web-shell discovery.
Privileged logon off-hours
event.code = 4672 AND user.name contains "admin"
Baseline first, then alert on the exceptions.
How discovery differs from searchingconcept›
Searching answers “does this specific thing exist?”. Discovery answers “what could I even ask?”. Analysts who skip discovery write queries against fields that were never parsed, then conclude the activity did not happen. Start every new investigation on an unfamiliar data source by listing its fields and their coverage — it takes two minutes and prevents false negatives.
Portable query patterns across SIEM platformstransferable›
| Pattern | Here | Elsewhere |
|---|---|---|
| Exact match | user.name = "a.pratama" | field:value / field = value / where field == value |
| Substring | process.command_line contains "-enc" | wildcards, LIKE, or contains operators |
| Boolean | clause AND clause OR clause | identical in every platform |
| Negation | user.name != "svc-backup" | NOT / != / -field:value |
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Entry · Guided Lab · 22 min
Telemetry: the data a SOC actually sees
You have the map; now learn the terrain. Four telemetry families feed this environment — endpoint, network, identity and cloud — and every investigation moves between them.
Foundation · Guided Lab · 25 min
Reading Windows authentication logs
Overnight the identity team reported 'weird logon noise'. Your job is to go into the raw Windows telemetry and determine whether failed logons on the estate look like normal user error or like an attack pattern.
Intermediate · Guided Lab · 30 min
Normalisation and field mapping
Parsed is not enough. Until the firewall's 'src' maps to source.ip, analysts cannot pivot across sources with one query.