Learn. Share. Secure. Access product knowledge, get certified, and collaborate with the global Securonix user community.
Join the discussion, ask questions, get solutions.
Discover product guides and helpful how-tos.
Join groups and collaborate with peers.
Stay up to date with our product team.
Share your ideas and suggestions with our team.
Discover and join upcoming events.
Explore Securonix solutions, products, and company insights
Access product guides, release notes, and technical documentation
Get active findings and detection strategies from Securonix Threat Research
Discover the ThreatQ threat intelligence platform and solutions
Find step-by-step guides, release notes, and troubleshooting resources
Discover and deploy integrations, extensions, and apps for the ThreatQ platform
Audience: Securonix Administrators, Data Onboarding Teams, SOC Engineers, and MSSPs Product Module: Add Data → Activity / Activity Import Connectors Tags: Activity Import Connector, Data Collection, Missing Events, Collection Window, Connector Checkp
Target Audience: Securonix Customers and Partners Product Module: Securonix Spotter Tags: Securonix Spotter, Spotter Queries, Query Syntax, Search Terms, Streaming Operators, Transforming Operators, Data Processing Operators Overview A Spotter que
Audience: Security Analysts, Threat Hunters, Content Developers, Administrators, MSSPsProduct Module: Securonix SpotterLast Updated: October 15, 2026Tags: Spotter, Query Performance, Query Timeout, Search Optimization, Slow Search, Threat Hunting, Qu
Audience: Securonix Administrators, Security Analysts, MSSPsProduct Module: Activity Import, Job Monitor, Activity Monitor, Ingester and Datasource Monitor, SpotterLast Updated: October 15, 2026Article Type: Troubleshooting GuideTags: Collection Fail
Autonomous Is Not AutonomyPart 3: Worms, the self-terminating attack, and the only scenario that worksSeries: Part 1 · Part 2 · Part 3This is the last of three parts. Part 1 made the dependence argument and the botnet arithmetic; Part 2 measured capa
Autonomous Is Not AutonomyPart 2: How capable these things are, and what the Hugging Face incident wasSeries: Part 1 · Part 2 · Part 3This is the second of three parts. Part 1 set out the thesis, that autonomous execution is demonstrated and autonomy
Autonomous Is Not AutonomyPart 1: The thesis, the machine, and the botnet arithmeticSeries: Part 1 · Part 2 · Part 3FindingsThis article is long because the argument depends on numbers rather than intuitions. If you read nothing else, read these ten
name: Suspicious WSUS Spawning Command Shell for Reconnaissance Analyticsignatureid: EDR-SYM858-RUNcategory: "Execution"threatname: "Command & Scripting Interpreter: Windows Command Shell"functionality: "Endpoint Management Systems"description: |
name: Windows IIS Worker or PHP CGI Process Spawning Suspicious Command Process Analyticsignatureid: EDR-SYM974-RUNcategory: 'Execution'threatname: 'Command & Scripting Interpreter: Windows Command Shell'functionality: 'Endpoint Management System
name: Web Server or PHP Worker Spawning Suspicious Command Process Analyticsignatureid: EDR-NIX5-RUNcategory: 'Execution'threatname: 'Command & Scripting Interpreter: Unix Shell'functionality: 'Endpoint Management Systems'lifecycle: experimentalv
Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this
Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf
We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i
Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone
I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d
Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to
During an undetermined number of executions of my playbook, it crashes. Is there a way to validate how many executions have been performed and whether they are causing instability in my service?
When a feed fails—or while developing a new feed—users often download Feed Run files to troubleshoot and understand what went wrong.Currently, these files are automatically zipped and password protected. This design helps prevent the files from being
Where security professionals share intelligence and strengthen defense together
Learn More →
Bring your questions. Learn live with the Securonix Training team.
Join open Office Hours for guidance on course content, product functionality, training logistics, and questions from the Securonix Connect community.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
