Skip to content

Filtering & Drill-Down

Pivot Menu

Clicking a value in a data table row, an expanded row's detail panel, or an aggregation table opens a pivot menu instead of immediately filtering or expanding the row:

  • Include - broaden the current filter to also match this value
  • Exclude - narrow the current filter to hide this value
  • Only - start a new filter scoped to just this value, clearing every other filter
  • Hunt - a full-text search for this value across every field, replacing the whole search and clearing any active filters
  • Correlate - shown on any row whose flow has a community ID (computed for every PCAP analysis); searches for every other log across the whole capture sharing that same flow, protocol events and alerts alike. Not offered when the value you clicked is the community ID itself, since Hunt above already does the same search in that case
  • Copy to Clipboard - copy the value as-is
  • Lookups - one-click lookups against Google, VirusTotal, Shodan, AbuseIPDB, urlscan.io, and CyberChef, plus any custom lookup sites you've added in Settings
  • Expand Row / Collapse Row - expand or collapse the row's detail panel (the row's timestamp cell also does this directly on click, without opening the menu)
  • Acknowledge this alert / Acknowledge all instances of this alert - on a Network Alert or Sigma Alert row, immediately removes it from view (or every row sharing the same signature/rule, for "all instances") and moves it into the Acknowledged Alerts tab. Reduced counts show up everywhere else the alert would have counted - its own tab, All Events, and the Sankey diagram
  • Un-acknowledge this alert - shown instead of the above when the row is already inside the Acknowledged Alerts tab; returns it to its original tab

The Acknowledged Alerts stat-card tab (PCAP analyses only) is the only place acknowledged alerts still show, for review or undo - acknowledging is per-analysis and does not affect any other analysis. It groups Network Alerts and Sigma Alerts under separate sub-sections only when both have acknowledged rows; with just one type present, it displays as a single sortable table identical to that type's own tab. Un-acknowledging the last row switches you back to Network Alerts automatically.

AI Summary

Expanding a Suricata alert, Sigma alert, or YARA file match shows an AI Summary field right at the top of Alert Details/Sigma Rule/Rule - a one-paragraph, plain-English explanation of what the rule actually detects. It only appears if a summary is actually available for that specific rule (there's no generic fallback, unlike Playbook below - a summary for the wrong rule would be misleading). A file with more than one YARA match shows one summary per match. Both AI summaries and the playbooks below are pre-generated by AI - nothing is sent to an AI service at analysis time. AI Summary data ships baked into the official Docker/Podman image - a manually-installed (non-container) deployment won't see this field unless the maintainer has set it up with its own summary data (see Development Setup).

Playbook

Expanding a Suricata or Sigma alert shows a Playbook section (after Alert Details/Sigma Rule) with plain-English investigation guidance for that specific detection - a name, description, and a list of questions to help guide your investigation, which you can collapse if it's in the way while you're also looking at the Rule/Payload sections. If no playbook exists for that specific detection, a generic engine-wide playbook is shown instead; the section is absent only when no playbook data is installed at all. Playbook data ships baked into the official Docker/Podman image - a manually-installed (non-container) deployment won't see this section unless the maintainer has set it up with its own playbook data (see Development Setup).

Notes

  • Analysis notes - the notes icon in the app header (next to the reanalyze icon) lets you attach freeform investigation context to the whole analysis ("suspected GuLoader, C2 at x.top"). Always available once an analysis is loaded
  • Row-level notes - expand a row's detail panel and use the Notes section's + Add Note link to attach a short annotation to that specific piece of evidence ("false positive, known scanner", "escalated to IR ticket #4521"), separate from the analysis-wide notes above. Once a row has a note, a small note icon appears directly on that row for quick access/editing without expanding it again. Row-level notes are lost if you reanalyze the file (which rebuilds the underlying database from scratch) - the reanalyze confirmation dialog warns you if the analysis has any before you confirm

Stream Analysis

Click a row's timestamp cell (or use the pivot menu's Expand Row entry) to expand it, then:

  • ASCII Transcript - view decoded TCP/UDP payload as readable text
  • Hexdump - view per-packet hex dumps with collapsible packet headers
  • Download PCAP - carve that specific stream into a standalone .pcap file