DOCSEARCHbyAlgolia
Submit Docs

DNIF Documentation

website·Indexed 31 days ago

https://dnif-documentation.github.io/DNIF

Documentation for DNIF Hyperscale connect-extract-enrich connectors, providing prerequisites and configuration guides for integrating various log sources and platforms including Okta, Salesforce, AWS Kinesis, Google Cloud Platform Pub/Sub, Office 365, and Snowflake.

Tokens
243.2K
Snippets
666
Records
1.9K
Agent score
73%

What's inside DNIF

  1. Overview of AWS S3 Optimized Cross Account connector

    The AWS S3 Optimized Cross Account connector is a variant of the S3 Optimized Connector. It reads logs from a configured S3 Bucket by leveraging S3 event notifications pushed to an AWS SQS Queue. It uses an external role to gain limited access to the AWS account without requiring the user to provide credentials.

  2. Overview of DNIF UI Modules

    The DNIF user interface provides several key modules for security operations:

    • Dashboard: A customizable visual summary of system health, active threats, and event volume using widgets.
    • Event Stream: A live view of log ingestion that supports filtering by device, tags, anomaly score, and detection context for rapid pivoting.
    • Investigations: A timeline-based tool featuring linked entities and evidence graphs for documenting SOC findings.
    • Queries & Pipelines: A workspace to execute UDM queries, schedule reports, and build automated logic flows via drag-and-drop pipelines.
    • Configuration: A management area for system settings, alerting rules, data sources, and Role-Based Access Control (RBAC) for users.

  3. Overview of DNIF HYPERCLOUD Device Integration and Data Pipeline

    DNIF HYPERCLOUD provides a cybersecurity operations platform designed for enterprise-wide visibility and threat detection. Its core data pipeline consists of four main stages:

    1. Device Integration: Seamlessly connects with over 100 enterprise event sources to ensure comprehensive visibility across the security ecosystem.
    2. Connectors: Specialized components that ingest events from diverse sources, simplifying data collection at scale.
    3. Data Ingestion: A hyperscale architecture capable of processing petabyte-scale, high-velocity data streams with minimal latency.
    4. Enrichment: The process of adding contextual information and threat intelligence to raw log data, transforming it into actionable intelligence for faster incident response.

  5. Introduction to DNIF Query Language (DQL)

    DNIF Query Language (DQL), introduced in v9.2.0, is a declarative query language used to analyze and retrieve specific information from complex data sets in DNIF. It uses a pipe-based syntax (|) where data flows from left to right through a sequence of commands. DQL focuses on 'what' data is needed rather than 'how' to calculate it.

    DQL is used for the following tasks:

    • Searching and processing data via workbooks
    • Powering dashboard widgets
    • Creating customized reports
    • Raising signals (alerts) and tracking
    • Unstructured threat hunting

  6. Overview of Signal Tagging in DNIF HYPERCLOUD

    Signal Tagging allows DNIF HYPERCLOUD users to categorize and organize signals based on specific criteria or attributes (such as nature, severity, source, or threat actor/campaign). This feature simplifies alert analysis by enabling users to group, filter, and search for relevant alerts, creating a standardized framework for classification and collaboration among analysts.

  7. Overview of DNIF Query Language (DQL)

    DNIF Query Language (DQL) is a modular analytic markup used within the DNIF SIEM to query, process, investigate, and respond to threats. It is designed to handle high-volume, high-velocity, and varied data structures. DQL is used across several SIEM functions, including:

    • Searching and processing data via workbooks
    • Powering dashboard widgets
    • Generating customized reports
    • Raising and tracking signals (alerts)
    • Performing unstructured threat hunting

    Queries can be executed manually through workbooks, scheduled at periodic intervals, or triggered in real-time via streaming when a match occurs.

  8. Overview of DNIF Query Language (DQL)

    DNIF Query Language (DQL) is a modular analytic markup used within the DNIF SIEM to query, process, investigate, and respond to threats. It is designed to handle high-volume, high-velocity, and varied (unstructured) data by transforming and enriching information as it is received from multiple devices.

    DQL is used for the following tasks:

    • Searching and processing data via workbooks
    • Powering dashboard widgets
    • Creating customized reports
    • Raising and tracking signals (alerts)
    • Performing unstructured threat hunting

    Queries can be executed manually through workbooks, scheduled at periodic intervals, or triggered in real-time via streaming when a match occurs.

  9. Overview of Network Traffic Analysis (NTA) Connector

    The NTA Connector monitors network availability and activity by listening on a specific network interface (NIC) of the host system. It is used to identify security and operational anomalies, troubleshoot slow networks, and eliminate internal visibility blind spots. It captures data including HTTP sessions (URIs, headers, MIME types, server responses), DNS requests/replies, SSL certificates, and SMTP session content. To reduce noise, Syslog and Connection traffic on the host system are filtered out by default.

  10. Introduction to DNIF Query Language (DQL)

    DNIF Query Language (DQL), introduced in v9.2.0, is a declarative query language used to analyze complex data sets in DNIF. It uses a pipe-based syntax (|) where data flows from left to right through a series of commands. DQL focuses on 'what' data to retrieve rather than 'how' to calculate it, making it suitable for matching events, analyzing stack data, and building aggregations.

  11. Overview of Signal Tagging in DNIF HYPERCLOUD

    Signal Tagging allows DNIF HYPERCLOUD users to categorize and organize signals based on specific criteria such as nature, severity, source, or threat actor/campaigns. This feature streamlines alert analysis by enabling users to group, filter, and search for relevant alerts using customized tagging conventions and standardized frameworks for team collaboration.