# Work with logs and indicators

> Analyse Windows, Zeek, Suricata and PCAP evidence in SOC Copilot, extract indicators of compromise, match Sigma and YARA rules and map activity to MITRE ATT&CK.

Source: https://documentation.redorca.ai/guides/blue-team/logs-and-indicators/
Last updated: 2026-11-01

1. **Open a case** in [SOC Copilot](https://documentation.redorca.ai/guides/blue-team/soc-copilot/) and attach real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON or a packet capture (PCAP).
2. **Extract indicators.** The **IOCs** tab lists the IP addresses, domains, URLs, email addresses and file hashes (MD5, SHA-1, SHA-256) found in the evidence, without duplicates.
3. **Match detections.** The **Detections** tab runs Sigma and YARA matching over the evidence.
4. **Build the timeline.** The **Timeline** tab puts events in order across sources; **Correlation** links related events and entities.
5. **Map to ATT&CK.** The **MITRE** tab maps observed behaviour to techniques, and **Coverage** shows what your detections cover and where telemetry is missing.

## Tips

- Structured data gives real results; plain text gives empty analyses, honestly.
- Private IP addresses are tagged as such, so internal hosts are easy to tell apart from external ones.
- Ask the case's **AI Assistant**, or chat, to explain a technique or an indicator in context.
- Record what each item turned out to be in **Dispositions**, so the case tells its own story.