Skip to main content
Detections

Sessions

Create and watch detection sessions from Detections → Sessions.

Detections → Sessions lists Validation Sessions. A session needs a name and at least one ATT&CK technique. Target filters are optional.

Open Sessions

  1. Go to Detections → Sessions.

Create a Session

Create Validation Session dialog with name, expiration, and target filters (dark mode)

  1. Click Create Session. The dialog title is Create Validation Session.
  2. Enter a Session Name.
  3. Pick an Expiration: 1 hour, 4 hours, 24 hours, 7 days, or 30 days.
  4. Optionally add Target Filters. Types are Hostname, File Hash, IP, Account, Domain, Command Line, Path, and IOC (catch-all).
  5. Select at least one technique under MITRE ATT&CK Techniques.
  6. Click Create Session.

The table columns are Name, Status, Created, and Expires. Status is Active, Expired, or Cancelled.

Locked

If the tab is locked, the title is Validation Sessions Locked. Breach & Attack Validation sessions are available for Praetorian operators.

Was this helpful?

Still need help? Ask the team