Understand the signal.
Follow it all the way.
From your first EVE record to a working deployment and an analyst's investigation. Learn what each component does, how the data moves, and what the evidence can actually tell you.
Start with a record.
Learn the difference between an observation, an alert, and a finding.
Read the field guide →I WANT TO INSTALLConnect the pipeline.
Work through the central host, sensor configuration, shipper, and SIEM.
Start the installation →I WANT TO EVALUATEInspect the evidence.
Compare actual records, including false leads and missing context.
Open the case studies →Learn to read the evidence
Understand the vocabulary, inspect the records, and build a defensible investigation.
Packets, flows, alerts, findings, revisions, scores, and the fields that connect them.
Separate observations from interpretations and test competing explanations.
The source-available analyst workspace: queue, dashboard, pivots — deploy and configure it.
Follow one observation from a mirrored packet to a stored SIEM finding.
Manifest-derived detector catalog, status, and the boundaries of coverage in your deployment.
The shipped capability overview: fleet, the evidence plane, retroactive PCAP, explainable anomaly, Vantage, and trust.
What the baseline compares against: per-entity fingerprint novelty, capped risk families, visibility-weighted confidence, gap-tolerant beaconing, and replay-safe aggregates.
The central sensor registry, sensor-health heartbeats, the read-only fleet API, and clock-skew flagging.
The managed indicator lifecycle: STIX/TAXII, MISP and HTTP feeds, TLP and source-trust, live matching, and retrospective hunting.
Install and connect your sensor
Each step identifies the machine, configuration, and checkpoint you need.
Start central Cernity, configure the sensor, verify the pipeline, and connect a SIEM.
How Fluent Bit reads EVE files and sends authenticated telemetry to Redpanda.
Set file mounts, credentials, CA trust, sensor identity, and the shipper service.
Configure EVE event types, fingerprints, statistics, and file metadata.
Map every capability to its sensor input, central service, and delivery prerequisites.
Understand service boundaries, in-memory state, and the requirements for scaling.
Add context and verify delivery
Understand where optional fields originate and verify what reaches your SOC.
JSON versus CEF, receiving-side parsing, finding revisions, and exact document retrieval.
Reverse DNS, registration age, GeoIP, ASN, fingerprint naming, and reputation.
The native explainable anomaly: dual baselines, deterministic cohorts, and per-finding provenance.
Overlapping protocol visibility and the optional Zeek evidence delivery boundary.
The canonical evidence plane, capability flags, the evidence query API, and retroactive rolling-buffer PCAP.
Operate and extend
Maintain the pipeline and work with the implementation.