Gravwell Academy

SOC: Orienting An Analyst

Part 0: Introduction - Video 1

The purpose of this content is to step through basic, common queries that a Security Operations Center analyst...
View More
All Lessons
Skillset Training
Detection Engineering
Detection Engineering: Overview
DE Part 1: Pivoting
DE Part 2: Automating Detections & Notifications
SOC: Orienting An Analyst
Part 0: Introduction - Video 1
Part 1: Understanding A Query - Video 2
Part 2: Operating on Enumerated Fields - Video 3
Part 3: Interacting with Enumerated Fields - Video 4
Part 4: A High Level View - Video 5
Part 5: Advanced Operating on Enumerated Fields - Video 6
Part 6: Finding The Victims - Video 7
Part 7: Hunting For A Phish - Video 8
Triage
Triage: Introduction
Triage: A Lead
Triage: Honing In
Triage: Who's Who
Triage: Risky Click
Triage: Execute!
Transitioning: Triage to Investigation
Transitioning: Triage to Investigation - Introduction
Transitioning: Triage to Investigation - Back In Action
Transitioning: Triage to Investigation - Well That’s New
Transitioning: Triage to Investigation - Campaigns
Transitioning: Triage to Investigation - Sweep
Platform basics
FLOWs - How Payloads Move Through Nodes
Flows - SOAR for Log Management
How To: Auto Extractors (AX)
How To: Macros
How To: Actionables
How To: Systems Overview (new features)
How To: Rapid Deployment - Installation to alerts in 3 mins
How-To: Compound Queries & Non-Temporal Joins
Bootcamp course
Bootcamp - Lesson 01

Skillset Training

Detection Engineering: Overview
While we are building on findings from our previous videos in this series, our objectives have shifted...
Part 0: Introduction - Video 1
The purpose of this content is to step through basic, common queries that a Security Operations Center analyst...
Triage: Introduction
We will build on previous videos, such as the SOC: Orienting An Analyst series, and discuss our analytical conclusions
Transitioning: Triage to Investigation - Introduction
This video is a follow up to our Triage series, with that covering our initial Alert and follow on triage.

Platform basics

FLOWs - How Payloads Move Through Nodes
Video: How payloads move through your FLOWs automations. From simple to complex setups, follow this introduction to investigating and debugging your FLOWs.
Flows - SOAR for Log Management
By using Gravwell Flows, you can quickly and easily interact with the Gravwell system, execute queries, and build automations for complicated actions. Such as generating a PDF reports and sending it as an email to your boss so it looks like you're still working!
How To: Auto Extractors (AX)
Syntax sugar for defining structure in raw data
How To: Macros
Create and modify multiple queries and dashboards with easy to remember shortcuts
How To: Actionables
Pivot between data sources for fast correlation
How To: Systems Overview (new features)
This interface will help your team gain insights from a "20k ft view". Additionally, it will show you how much data you are ingesting, where it is, the health of your cluster, a basic overview of your ingesters' performance, and more!
How To: Rapid Deployment - Installation to alerts in 3 mins
In this video, Kris will take you from installation of Gravwell to installing Zeek kit, then finally to automating a port scan alert using Gravwell Flows (new automation interface).
How-To: Compound Queries & Non-Temporal Joins
Discover where to build automations

Bootcamp course

Bootcamp - Lesson 01
Setting up your first Credential
Gravwell Community Edition
Gravwell is an enterprise data fusion platform that enables security teams to investigate, collaborate, and analyze data from any source, on demand, all with unlimited data collection and retention. Ingest everything. Investigate anything.
TOP