Work through these in order. Each step links to the page with the details.
- Create an organization. Settings › Organizations. Even a single-company deployment needs one. Organizations
- Enrol one endpoint. Download the installer bundle for the organization from Settings › Fleet and run it on a test machine. Watch it appear on the Hosts page. Install on Windows, Install on Linux
- Connect one non-agent source. Point a firewall or a Linux host at the syslog listener, or post a JSON event with an ingest key. Watch it land on the Logs page. Data sources
- Review the content pack. A new deployment installs it with the rules enabled. On Detections, disable the rules for sources you do not collect. Content pack
- Trigger a detection. On the Windows test machine, run
powershell -EncodedCommand dwBoAG8AYQBtAGkA(an encodedwhoami). The Encoded PowerShell command rule raises an alert within minutes. Content pack - Work the alert. Open it, read the advisory verdict if a model is configured, look at the event graph, and escalate it to a case. Alerts
- Close the case. Add a note, complete the tasks, close. Then write a report from a template and preview it. Cases, Reports
- Attach a playbook. Build a simple playbook (enrich, advisory verdict, triage note) in pre-stage mode and bind it to the rule you triggered. Trigger it again. Playbooks
- Set the SLA policy. Settings › Organizations: SLA targets per severity, and coverage in the organization's settings. SLA
- Invite a customer to the portal. Only if you are a provider: enable portal access for the organization and send an invite. Inviting customers
When all ten are done you have exercised every module once. The rest of the documentation goes deeper on each.