Advanced

Topics beyond day-to-day usage.

Topics

• Custom detectors — extend or replace AnomalyDetectionService's pipeline
• Custom alert channels — add channels beyond the 8 shipped
• Custom SIEM exporters — for SIEMs that don't fit the bundled drivers
• Custom incident response actions — bespoke playbook steps
• Custom threat intel providers — internal / private feeds