Start here

• New analysts get a guided tour on first sign-in. Replay it anytime with Take the tour below.
• Set up your profile in Settings — SIEM, EDR, and experience level.
• For a live alert, open Investigation and describe the alert or pick a suggested prompt.
• To practice safely, use Training scenarios.

Navigation

Dashboard

Shift home — IOC Lookup, investigations preview, threat intel, and KEV feeds.

Investigation

Chat with Theron through active alert triage and case work.

Training

Preset or custom practice scenarios with investigation debriefs.

Query Library

Organization-wide saved SIEM/EDR queries — view and copy anyone's; edit or delete your own.

MITRE ATT&CK

Search techniques while you investigate.

Shift Handoff

Notes and replies for the next shift.

Escalation Reports

Browse reports saved from escalated investigations.

False Positive Library

Organization-wide benign alert knowledge — search the team's entries; edit or delete your own.

SOP Library

Organization-wide investigation playbooks — search and reuse team SOPs; edit or delete your own. Generate drafts from closed investigations.

First-time setup

New analysts complete a short profile wizard after verifying email; the onboarding tour runs automatically on the dashboard afterward.

Analyst Metrics

Your activity and mentoring trends.

Settings

Profile, timezone, escalation style, and org redaction patterns (managers).

Investigations

• Click New Investigation or a suggested prompt to begin.
• Sensitive details (internal IPs, usernames, hostnames) are automatically redacted when you send — click flagged chips to redact more before sending.
• Theron mentors one step at a time; answer questions and share non-sensitive artifacts.
• Close as False Positive, Escalated, or simple close when done — history stays in the sidebar.

IOC lookup

• On the Dashboard, enter an IP, domain, URL, hash, or email and click Go.
• Results open in a full-screen view with VirusTotal, AbuseIPDB, URLScan, and related OSINT.
• Recent lookups appear below the search box for quick recall.

Training scenarios

• Choose a preset scenario and difficulty, or paste a detection rule for a custom alert.
• Investigate like a real case — Training Mode badge shows it is practice.
• Click I Am Ready To Escalate for investigation and IR debriefs.

Floating Theron assistant

• The T button at the bottom-right opens chat from any tab.
• Ask quick questions without leaving your current page — same mentoring style, separate from Investigation sessions.