Using HeptaSec — end to end

The platform has four moving parts you will interact with:

• Agent — installed on each endpoint (Windows / Linux / macOS); collects process, file, network, registry and authentication telemetry.
• Detection engine — runs MITRE ATT&CK-mapped detectors on incoming telemetry in near real-time.
• This console — dashboards, detections, alerts, hunting, response and case management.
• Response channel — signed commands the console sends back to agents (isolate, kill, quarantine, …).

A typical day flows top-to-bottom through the sections below.

Your capabilities depend on your role (set by an administrator):

• super_admin — full access across the tenant, including user & tenant management.
• admin — manage assets, response actions, cases and settings.
• analyst — triage detections/alerts, hunt, open cases, run response actions.
• viewer — read-only access to dashboards, detections and reports (ideal for monitoring / evaluation / reporting).

1. 1Open the console and enter your email and password on the login screen.
2. 2If multi-factor authentication is enabled on your account, enter the 6-digit code from your authenticator app when prompted.
3. 3On first sign-in the platform may take a few seconds to wake (managed hosting cold-start) — the button shows “Waiting for service…”. This is normal.
4. 4You land on the Dashboard. Use the left navigation to move between areas.

Telemetry only appears once an agent is installed and reporting. To onboard a host:

1. 1Go to Agent → Install in the navigation.
2. 2Enter the endpoint's hostname, pick the platform (Linux / macOS / Windows) and deployment type, then click Register & generate command. This registers the asset and binds a unique agent key to it.
3. 3Copy the generated one-line install command for that platform.
4. 4Run it on the target endpoint with administrator/root privileges:
   • Linux / macOS: curl -sSfL "…" -H "X-Tenant-ID: …" | sudo bash
   • Windows: run the provided PowerShell snippet in an Administrator PowerShell.
5. 5The installer downloads the agent, writes its config, installs it as a service/daemon, and starts it.

1. 1Stay on the install page after running the command — it polls connectivity and shows progress.
2. 2Within ~1 minute the asset should flip to connected and event/detection counts begin to climb.
3. 3Cross-check under Assets: the host appears with a recent last seen timestamp.

If nothing arrives after a few minutes, see Troubleshooting.

The Dashboard is your at-a-glance posture view. It shows:

• Detection volume and severity breakdown over time.
• Active vs. total assets / agents.
• Top MITRE ATT&CK techniques observed.
• Recent high-severity activity.

Use the time-range control to widen or narrow the window. Charts refresh automatically.

A detection is a single detector firing on an event. Triage them under Detections:

1. 1Filter by severity, MITRE technique, host, status or time range.
2. 2Open a detection to see the evidence, the mapped MITRE technique, the affected asset and the raw event.
3. 3Set a status — open → acknowledged → in progress → resolved (or false positive) — and add an analyst note.
4. 4Promote related detections into an alert or case when they warrant investigation.

An alert is a correlated, higher-confidence signal (often several detections). Under Alerts:

1. 1Review the alert title, severity, risk score and timeline.
2. 2Press Investigate to claim it (new → investigating), then work it: inspect the linked detections and affected user/host.
3. 3Pivot into Hunting to find related activity, or open a Case to track the investigation.
4. 4Finish with Resolve (real threat, handled) or False positive — a short note keeps the audit trail complete.

Use Hunting to proactively search telemetry and follow leads:

1. 1Search across endpoint events by process, user, host, hash, IP, etc.
2. 2View a timeline of what happened on a host around an event.
3. 3Expand a process tree to see parent/child lineage.
4. 4Pivot on any indicator (IP, hash, user) to find everywhere it appears.

From a detection, alert, asset or the Response page you can act on an endpoint. Available actions:

• Isolate host — cut network access except the management channel.
• Unisolate host — restore connectivity.
• Kill process — terminate a process by PID.
• Quarantine file — move a malicious file to secure storage.
• Block / unblock hash — deny a file from executing by SHA-256.
• Collect forensics — gather artifacts (process list, connections, etc.).

1. 1Choose the action and target (host, PID, path or hash) and a reason.
2. 2Submit — the action is recorded and cryptographically signed, then delivered to the agent, which executes it and reports back.
3. 3Track status on the Response page: pending → executing → completed / failed.

A Case groups detections, alerts, affected assets and notes for an investigation.

1. 1Create a case from an alert/detection, or under Cases directly.
2. 2Link the relevant detections and assets; set severity and priority.
3. 3Add timeline notes as the investigation progresses.
4. 4Close with a resolution summary (or mark false positive) when done.

Under Assets, every onboarded endpoint is listed with platform, criticality and a computed risk score.

1. 1Filter by platform, criticality or active status.
2. 2Open an asset to see its detections, recent activity and risk breakdown.
3. 3Set criticality so risk scoring reflects business importance.

The Analytics area is where monitoring / evaluation / reporting users live:

• Trends of detections, alerts and risk over time.
• MITRE ATT&CK coverage — which tactics/techniques are firing.
• Top techniques, hosts and users by activity.

Use the time range to produce weekly/monthly summaries for reporting.

1. 1Under Settings, update your profile and (where permitted) manage users and roles.
2. 2Generate an API key for programmatic/agent access; store it securely — it is shown only once.
3. 3Configure notification and integration preferences if available to your role.