Learn. Share. Secure. Access product knowledge, get certified, and collaborate with the global Securonix user community.
Join the discussion, ask questions, get solutions.
Discover product guides and helpful how-tos.
Join groups and collaborate with peers.
Stay up to date with our product team.
Share your ideas and suggestions with our team.
Discover and join upcoming events.
Explore Securonix solutions, products, and company insights
Access product guides, release notes, and technical documentation
Get active findings and detection strategies from Securonix Threat Research
Discover the ThreatQ threat intelligence platform and solutions
Find step-by-step guides, release notes, and troubleshooting resources
Discover and deploy integrations, extensions, and apps for the ThreatQ platform
What happenedPHP2Shell is the name given to two critical flaws in PHP itself, each rated 9.2 (CVSS v4.0). A single crafted web request can let an unauthenticated attacker run code on the server, in some setups, such as Apache mod_php, before the webs
Executive Assessment:CVE-2026-111497, also referred to as Node2Shell, HTTP2Shell, or Broccoli2Shell, is an out-of-bounds write vulnerability affecting the Brotli decoder bundled with Node.js and used in other software. The flaw originates in the deco
Audience: Securonix Administrators, Security Engineers, MSSPsProduct Module: Securonix Hub, Activity Import, Job Monitor, SpotterArticle Type: Troubleshooting GuideLast Updated: October 21, 2026Tags: Securonix Hub, Missing Logs, Collection, Datasourc
Coming soon but technically ready (we are waiting on final documentation), but the 6.21 version of ThreatQ’s MCP server is now working well with OpenAI Codex, Claude Code, and other LLM interfaces. Teasers care of Apeili and Codex.
Not fully baked yet, and by that I mean the instructions assume a certain level of competency and understanding of how AI systems talk to each other - but MCP access to ThreatQ is possible from 6.21 onwards. Here’s an example of me asking the commun
Audience: Securonix Administrators, Security Analysts, SOC Engineers, and Integration Developers Product Module: Securonix REST API / Activity Data Tags: REST API, Activity Data, API Troubleshooting, Integration, Authentication, AutomationOverview T
Target Audience: Securonix Customers and Partners Product Module: Securonix Unified Defense SIEM – Spotter API Tags: Spotter API, Spotter Search, API, Troubleshooting, Query Status, Search Results, Authentication, Query Execution Overview Spotter AP
Audience: Securonix Customers and Partners Product Module: Device Monitoring / Activity Monitor Tags: Device Monitoring, Collector Health, Ingestion Health, Silent Devices, Activity Monitor, Data Sources Overview A device that stops sending telemet
Audience: Securonix Administrators, Data Onboarding Teams, SOC Engineers, and MSSPs Product Module: Add Data → Activity / Activity Import Connectors Tags: Activity Import Connector, Data Collection, Missing Events, Collection Window, Connector Checkp
Audience: Security Analysts, Threat Hunters, Content Developers, Administrators, MSSPsProduct Module: Securonix SpotterLast Updated: October 15, 2026Tags: Spotter, Query Performance, Query Timeout, Search Optimization, Slow Search, Threat Hunting, Qu
Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this
Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf
We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i
Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone
I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d
Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to
During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?
When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being
Where security professionals share intelligence and strengthen defense together
Learn More →
Bring your questions. Learn live with the Securonix Training team.
Join open Office Hours for guidance on course content, product functionality, training logistics, and questions from the Securonix Connect community.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
