Work with logs and indicators

1. Open a case in SOC Copilot and attach real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON or a packet capture (PCAP).
2. Extract indicators. The IOCs tab lists the IP addresses, domains, URLs, email addresses and file hashes (MD5, SHA-1, SHA-256) found in the evidence, without duplicates.
3. Match detections. The Detections tab runs Sigma and YARA matching over the evidence.
4. Build the timeline. The Timeline tab puts events in order across sources; Correlation links related events and entities.
5. Map to ATT&CK. The MITRE tab maps observed behaviour to techniques, and Coverage shows what your detections cover and where telemetry is missing.

Tips

• Structured data gives real results; plain text gives empty analyses, honestly.
• Private IP addresses are tagged as such, so internal hosts are easy to tell apart from external ones.
• Ask the case’s AI Assistant, or chat, to explain a technique or an indicator in context.
• Record what each item turned out to be in Dispositions, so the case tells its own story.