Defend SIEM user guide (in progress)

Overview

The Defend SIEM is the alert-and-incident dashboard for your organization (it used to be documented as a separate Defend product). It pulls together alerts from every security source — endpoint telemetry, SIEM connectors, IOC matches, vulnerability scans, and compliance checks — and gives you one place to triage, investigate, and close them out.

Use it as the daily driver for your security analysts: a single alert queue, a single incident list, a single view of the risk posture across all your clients.

Key Features

• SOC dashboard — open alerts, critical alerts, active incidents, open findings, and a posture score at a glance.
• Alert queue — every detection from every source, filterable by severity, client, device, and MITRE technique.
• Incident management — group related alerts into incidents, assign, investigate, and resolve.
• Findings — durable records of issues discovered through scans, assessments, or analyst review.
• Detection rules — prebuilt Sigma and KQL rules plus behavioral rules you can enable, tune, or clone.
• IOCs — indicator-of-compromise feeds with live matching against your fleet.
• Fleet intel — per-IOC and per-MITRE-technique match counts across your client base.
• SIEM data connectors — pull M365, Google Workspace, and Azure events into a normalized event stream.
• Threat hunting — run natural-language or KQL queries over normalized events.
• Attack chain correlation — the engine groups related alerts into an attack storyline.
• Alert tuning — suggestions that reduce noise by proposing suppressions or threshold tweaks.
• Vulnerability management — CVEs detected on your fleet with triage, exceptions, and remediation tracking.
• Compliance view — cross-product compliance rollup (connects to the Compliance product).
• Security awareness training — not part of Defend. Phishing simulations and training live in Cypher.
• Email security (in progress) — SPF, DKIM, and DMARC posture with alerting. This used to be documented under a separate email product; it is now part of Defend and may not be available yet.
• DMARC reports — parsed aggregate reports with sender analysis.
• Real-time stream — live feed of new alerts as they land.

How To: Triage an Alert

1. In Defend, go to Alerts.
2. The queue sorts newest-first by default. Sort by severity to start with critical alerts.
3. Click an alert to open the detail.
4. Review the event data, the MITRE technique, the affected device, and any related alerts.
5. Decide:
   • False positive — click Mark as False Positive and add a note. Consider enabling an alert-tuning suggestion.
   • Benign activity — click Mark as Benign and note why.
   • True positive — click Convert to Incident to start an investigation workspace.
6. Your verdict is logged so future similar alerts can be suppressed or auto-handled.

How To: Open and Work an Incident

1. Go to Incidents and click the incident.
2. Review the timeline — every alert that has been linked to the incident in chronological order.
3. Assign the incident to yourself or a teammate.
4. Set severity, category, and status.
5. Use the Response panel to take action:
   • Isolate an affected device.
   • Kill a malicious process.
   • Collect a forensics snapshot.
   • Notify the client.
   • Escalate to PSA (creates a ticket).
6. Add notes as you work so the record tells the full story.
7. When it is closed out, set status to Resolved and record the resolution summary.

How To: Enable a Detection Rule

1. Go to Rules.
2. Filter by MITRE tactic, severity, or rule type (Sigma, KQL, behavioral).
3. Click a rule to see the definition, expected hit volume, and MITRE mapping.
4. Toggle Enabled.
5. Watch the Hit Count over the next few days. If it produces too many alerts, use Alert Tuning to refine it.

How To: Connect a SIEM Data Source

1. Go to Connectors.
2. Click Add Connector and pick the type (M365, Google Workspace, Azure).
3. Give it a name and paste the API credentials the wizard asks for.
4. Click Test. The connector makes a sample call and reports success or failure.
5. Click Save. The sync runs every fifteen minutes by default; use Sync Now to force a run.
6. Normalized events flow into the event store and can be searched in Threat Hunt.

How To: Run a Threat Hunt

1. Go to Threat Hunt.
2. Type a natural-language question (e.g. "show me PowerShell executions on servers in the last 24 hours") or paste a KQL query.
3. Click Run. Results come back with timestamps, devices, and drill-down links.
4. Save the query as a scheduled hunt if you want it to run on a regular cadence.

How To: Add an IOC

1. Go to IOCs.
2. Click New IOC.
3. Pick a type (IP, domain, hash, URL, email).
4. Enter the value, severity, and source.
5. Save. The nightly matcher cross-references it against your event store; matches appear under IOC Matches.

How To: Tune a Noisy Rule

1. Go to Alert Tuning. Rules producing high volume are listed with a Suggestion link.
2. Click Review. The system shows the proposed suppression or threshold.
3. Approve to apply it, or open the rule and edit it manually.

How To: View Email Security Posture (in progress)

1. Go to Email Security.
2. Each monitored domain shows SPF, DKIM, and DMARC status.
3. Click a domain to see the DMARC policy, pass-fail counts, and any identified impersonators.
4. Go to DMARC Reports for parsed aggregate reports and sender analysis.

Frequently Asked Questions

Where do alerts come from? From endpoint agents, SIEM connectors (M365, Google, Azure), IOC matches, vulnerability scans, email security, and behavioral analysis. Everything lands in the same queue.

What is the difference between an alert, a finding, and an incident? An alert is a single event the system flagged. A finding is a durable issue you want to track (often from a scan or review). An incident is a case that groups multiple alerts into an investigation.

How often are IOC feeds refreshed? Matching runs every fifteen minutes across all tenants.

Can I silence a rule for a single client? Yes. Open the rule and add a suppression scoped to that client or to a specific asset.

What is the posture score? A rolling composite score on the dashboard that factors open critical alerts, open incidents, rule coverage, and unresolved findings.

Can I get a real-time notification when a critical alert fires? Yes. Open Settings → Notifications and enable the channels you want (email, Teams, Slack via webhook).

Does the stream backfill older events? No. The stream shows new events as they arrive. For historical analysis, run a threat hunt.

Troubleshooting

Connector shows Failed after save. Click Test to see the exact error. The most common causes are bad credentials, missing API consent in the source tenant, or an expired secret. Fix and re-run Test.

Rule is not firing even though I know the event happened. Check that the rule is Enabled and that its data source is a connector you have active. If it is a Sigma rule, verify the fields it depends on exist in your normalized events.

Alert queue is flooded with the same alert. Go to Alert Tuning and accept the suggestion, or add a suppression on the rule. Make sure the underlying issue is actually addressed — do not silence a real problem.

Incident response action (isolate / kill process) did not complete. Confirm the device is online in RMM. Response actions queue commands that run on the next heartbeat; offline devices cannot be contained until they come back.

DMARC shows "no reports." Aggregate reports are polled every four hours from the shared reporting mailbox. If nothing has arrived, confirm the domain is publishing a rua= tag that points at the expected address.

Threat hunt query returns no results. Confirm connectors are syncing and the time window covers the period you care about. For KQL queries, double-check table names and field casing.