Learn. Share. Secure. Access product knowledge, get certified, and collaborate with the global Securonix user community.
Join the discussion, ask questions, get solutions.
Discover product guides and helpful how-tos.
Join groups and collaborate with peers.
Stay up to date with our product team.
Share your ideas and suggestions with our team.
Discover and join upcoming events.
Explore Securonix solutions, products, and company insights
Access product guides, release notes, and technical documentation
Get active findings and detection strategies from Securonix Threat Research
Discover the ThreatQ threat intelligence platform and solutions
Find step-by-step guides, release notes, and troubleshooting resources
Discover and deploy integrations, extensions, and apps for the ThreatQ platform
Coming soon but technically ready (we are waiting on final documentation), but the 6.21 version of ThreatQ’s MCP server is now working well with OpenAI Codex, Claude Code, and other LLM interfaces. Teasers care of Apeili and Codex.
Not fully baked yet, and by that I mean the instructions assume a certain level of competency and understanding of how AI systems talk to each other - but MCP access to ThreatQ is possible from 6.21 onwards. Here’s an example of me asking the commun
Audience: Securonix Administrators, Security Analysts, SOC Engineers, and Integration Developers Product Module: Securonix REST API / Activity Data Tags: REST API, Activity Data, API Troubleshooting, Integration, Authentication, AutomationOverview T
Target Audience: Securonix Customers and Partners Product Module: Securonix Unified Defense SIEM – Spotter API Tags: Spotter API, Spotter Search, API, Troubleshooting, Query Status, Search Results, Authentication, Query Execution Overview Spotter AP
Audience: Securonix Customers and Partners Product Module: Device Monitoring / Activity Monitor Tags: Device Monitoring, Collector Health, Ingestion Health, Silent Devices, Activity Monitor, Data Sources Overview A device that stops sending telemet
Audience: Securonix Administrators, Data Onboarding Teams, SOC Engineers, and MSSPs Product Module: Add Data → Activity / Activity Import Connectors Tags: Activity Import Connector, Data Collection, Missing Events, Collection Window, Connector Checkp
Target Audience: Securonix Customers and Partners Product Module: Securonix Spotter Tags: Securonix Spotter, Spotter Queries, Query Syntax, Search Terms, Streaming Operators, Transforming Operators, Data Processing Operators Overview A Spotter que
Audience: Security Analysts, Threat Hunters, Content Developers, Administrators, MSSPsProduct Module: Securonix SpotterLast Updated: October 15, 2026Tags: Spotter, Query Performance, Query Timeout, Search Optimization, Slow Search, Threat Hunting, Qu
Audience: Securonix Administrators, Security Analysts, MSSPsProduct Module: Activity Import, Job Monitor, Activity Monitor, Ingester and Datasource Monitor, SpotterLast Updated: October 15, 2026Article Type: Troubleshooting GuideTags: Collection Fail
Autonomous Is Not AutonomyPart 3: Worms, the self-terminating attack, and the only scenario that worksSeries: Part 1 · Part 2 · Part 3This is the last of three parts. Part 1 made the dependence argument and the botnet arithmetic; Part 2 measured capa
Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this
Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf
We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i
Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone
I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d
Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to
During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?
When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being
Where security professionals share intelligence and strengthen defense together
Learn More →
Bring your questions. Learn live with the Securonix Training team.
Join open Office Hours for guidance on course content, product functionality, training logistics, and questions from the Securonix Connect community.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
