Skip to content

Usage

Once you've connected to SO-CRATES in your browser, here are some of the things you can do. Start with the tour below, then dig into the details:

  • The Sample Story - one phishing incident, followed through the four built-in samples
  • Analyzing Files - uploading, loading from a URL, ZIPs, and reanalyzing
  • Exploring Results - what each tab shows for PCAP, log, email, and binary analyses, including Findings and DNS Heuristics
  • Filtering & Drill-Down - the pivot menu, AI summaries, playbooks, notes, and stream analysis
  • Keyboard & Menus - keyboard navigation, the command palette, and the gear menu

Screenshot Tour

When you first connect to SO-CRATES, a welcome window will appear with an overview of SO-CRATES:

Welcome window

When you dismiss the welcome window, the main screen allows you to upload a file or load a previous analysis:

Main screen

After analysis, you can view network alerts, file alerts, network metadata, and extracted streams:

Analysis screen

The cards come in three sections - Triage, Protocol records and Connections. tshark adds the protocols Suricata doesn't parse (the cards marked with a dot - here S7comm, Telnet and TLS failures from an ICS lab's capture), and Findings gathers what the protocol records show is worth a look, one row per finding on each server:

Stat-card sections, tshark's protocols, and Findings

Clicking a value in the data table opens a pivot menu for Include/Exclude/Only filtering, Hunt, and Correlate - which searches for every other log across the capture sharing that row's community ID (the cross-tool flow-correlation hash, computed by Suricata - force-enabled in 4.1.0):

Pivot menu

Drilling into a Suricata, Sigma, or YARA alert shows an AI-generated summary of what the rule detects, when one is available for that rule. Suricata and Sigma alerts also show a Playbook with plain-English investigation guidance for that specific detection:

Playbook

You can optionally collapse the Playbook questions. You can also scroll to the bottom to see the ASCII transcript:

ASCII transcript view

You can also select the hexdump view:

Hexdump view

To slice and dice your data, expand the Aggregation Tables section and click on values that you want to filter for:

Aggregation table filtering