Using Red Canary

Red Canary basics

• Red Canary Video Library
• Getting around quickly with jump-to / ⌘-K
• Setting up your user profile
• Completing your company profile

Users & Roles

• Inviting users
• Setting up single sign-on
• Understanding and assigning roles
• Setting up Single Sign-On With Microsoft Azure Active Directory
• Setting up Single Sign-On With OneLogin

See all 12 articles

Endpoints

• Understanding endpoints
• Reviewing daily and weekly email summaries
• What Does “Protected by Red Canary” Mean?
• Monitor endpoint statuses and connection to Red Canary
• Filtering endpoints

See all 8 articles

Identities

• Understanding identities

Alert Sources

• Understand external alert sources
• Add third-party security platforms to Red Canary
• Suggest a new security product to Red Canary
• Synchronize alert status and comments from Red Canary to alert platforms

External Alerts

• Alerts lifecycle
• Configure alert filters
• Supported alert sources for threat investigation
• Taking action on external alerts with automation
• Using notes to communicate with your team

Detection Analytics (Detectors)

• Quantifying Red Canary's detection coverage using ATT&CK
• Understanding how Red Canary detects threats
• Determining if Red Canary includes coverage for a specific technique
• Reporting a Red Canary detection miss (false negative)
• Filtering detection analytics

Potentially threatening events

• Understanding potentially threatening events
• Filtering events

Detections

• Getting help and guidance about a confirmed threat
• Recording how you responded to a detection
• Taking action on detections with automation
• Understanding confirmed threats (detections)
• Reporting detection quality issues

See all 8 articles

Automation

• Getting started with automation
• "Acknowledged by" email address Playbook attribute
• Automate Playbook attributes
• Automate Trigger Variables Reference Guide
• Automate: collecting a forensics package

See all 10 articles

Reporting

• Getting started with reporting
• Using the impact summary
• Printing and exporting report contents
• Favoriting frequently used reports

Intelligence Profiles

• Are the Intelligence Insights customizable for a specific environment?
• Intelligence Profiles - Overview
• Accessing Intelligence Profiles
• Red Canary Intelligence Team mission and approach
• How profiles are created

See all 7 articles

Mitre ATT&CK

• Learning about a technique
• How Red Canary uses Mitre ATT&CK

Activity Monitors

• Setting up file integrity monitoring

Status Checks

• Understanding status checks

Your Red Canary team

• Understanding your extended team at Red Canary
• Sharing files securely with Red Canary

Security & Auditing

• Configuring login timeouts and other general settings
• Reviewing audit logs from your EDR/EPP platform
• Reviewing audit logs

Licensing & Usage

• Understanding licensing and how endpoint usage is determined