Sessions

Create and watch detection sessions from Detections → Sessions.

Detections → Sessions is where you stand up a monitoring session (hostname, hash, IP, account, domain, command line, path, or IOC) and watch matches.

Open Sessions

  1. Go to Detections → Sessions.

Create a session

  1. Click the create action.
  2. Pick a match type and value (for example hostname prod-web-01 or an IP).
  3. Set duration (1 hour through 30 days).
  4. Save. The table shows status (Active, Expired, Cancelled), created, and expires.

If Sessions is locked, your plan may require Breach and Attack Simulation.