{"version":1,"pages":[{"id":"0A7G1Mn6kEc7oPh01Wz4","title":"What is Scanner","pathname":"/scanner","siteSpaceId":"sitesp_wxEYA","description":"Scanner is the world’s fastest, easiest, and most scalable Security Data Lake. It lets you keep unlimited logs in your own Amazon S3 buckets and adds hyper fast search, detection, alerts, APIs & more.","breadcrumbs":[{"label":"What & Why"}]},{"id":"KniBJ9k5TtAufznebyOl","title":"How it Works","pathname":"/scanner/what-and-why/how-it-works","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"}]},{"id":"1IZvZvBqbVlS2qpFVJss","title":"How Scanner Achieves Fast Queries","pathname":"/scanner/what-and-why/how-it-works/how-scanner-achieves-fast-queries","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"uw61Tdx6SVi9wBMSfKsY","title":"Detection Rule Engine","pathname":"/scanner/what-and-why/how-it-works/detection-rule-engine","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"g1TaRZYw7Hpr4ExoAa6V","title":"Bring Your Own Cloud (BYOC) / Self-Hosted","pathname":"/scanner/what-and-why/how-it-works/bring-your-own-cloud-byoc-self-hosted","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"sQORXCuObEqeMzaDNpph","title":"Quick Setup Overview","pathname":"/scanner/getting-started/quick-setup-overview","siteSpaceId":"sitesp_wxEYA","description":"This guide walks you through connecting Scanner to your AWS environment and ingesting your first logs. The entire process typically takes 30-45 minutes.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"04vRapGnxzfmPulul6nn","title":"Step 1: AWS Infrastructure Setup","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup","siteSpaceId":"sitesp_wxEYA","description":"Before Scanner can analyze logs, you must establish a secure connection to your AWS account. This creates the IAM roles, S3 buckets, and EventBridge resources Scanner requires.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"t7Z7fVCGNpVxjBYGnZJU","title":"AWS CloudFormation","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/aws-cloudformation","siteSpaceId":"sitesp_wxEYA","description":"Getting started with CloudFormation","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"Xu7juj6M7DG4RcrAk6hD","title":"Terraform","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/terraform","siteSpaceId":"sitesp_wxEYA","description":"Getting started with Terraform","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"8CYhiIOiWPzo65VX7JCI","title":"Manual Setup - AWS CloudShell","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/manual-setup-aws-cloudshell","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"nNqK4Ch0SATkCc4mzaKd","title":"Troubleshooting AWS Errors","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/troubleshooting-aws-errors","siteSpaceId":"sitesp_wxEYA","description":"A guide to understanding and resolving AWS configuration and permission errors that appear in the Scanner UI.","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"3WBGxNChkZJYBtT503Ql","title":"Step 2: Connect Your First Data Source using Scanner Collect","pathname":"/scanner/getting-started/step-2-connect-your-first-data-source-using-scanner-collect","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Getting Started"}]},{"id":"vHgDOnfl17MofzpERIDS","title":"Step 3: Validate & Test","pathname":"/scanner/getting-started/step-3-validate-and-test","siteSpaceId":"sitesp_wxEYA","description":"Once you have set up a new source you can expect to see data flowing into Scanner within a few minutes. Follow the steps below to get started exploring your data.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"mhI9dh3o2t2ZmbyQmdFt","title":"Scanner Collect: Data Ingestion","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion","siteSpaceId":"sitesp_wxEYA","description":"Learn what Scanner Collect is, why it helps you build a scalable S3-based log data lake, and how it simplifies ingestion, indexing, and detection across your SaaS and cloud logs.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"xOuN1ixYH9sOVcC1Ru1i","title":"Sources","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"TPqkHtaqd1PNl8CuucmA","title":"1Password","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/1password","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"pW9jeYBj4RtpM3IctSO6","title":"Auth0","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/auth0","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"d0XNkIUqOgNv4gnRPGlM","title":"Azure Activity","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/azure-activity","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"feUSwscTRTYIvfgHnJxh","title":"AWS Aurora","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-aurora","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"3QhBo1NB2JOX0Tbdfqsa","title":"AWS CloudTrail","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudtrail","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"ypbTTj2wiMn6PEQZnAzZ","title":"AWS CloudWatch","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudwatch","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"HHhixMSXUvUr6L1vGan0","title":"AWS ECS","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-ecs","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"xdXa86jeSpkwiOnk19EB","title":"AWS EKS","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-eks","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"x0E9Ebp7jcnoKVKAfK0v","title":"AWS GuardDuty","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-guardduty","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8M1nzFyNR4SR0Jf4NF1q","title":"AWS Lambda","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-lambda","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"yj7pb6EzC4RJiB8iLRgR","title":"AWS Route53 Resolver","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-route53-resolver","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"wB8iYjhTsAs5iqkXbkqC","title":"AWS VPC Flow","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-flow","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"9zEJpEXgRMxfNMoYGB6U","title":"AWS VPC Transit Gateway Flow","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-transit-gateway-flow","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"tn8JcaLLds2kd5uk8Q4z","title":"AWS WAF","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-waf","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"Ni3ChsQVehapgrP3ryh2","title":"Cloudflare","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/cloudflare","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"cR2BqxJvlPpxTJY5PmsP","title":"Crowdstrike","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/crowdstrike","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8Td8dMhEQY1MgX4e6WOk","title":"Custom Logs - AWS S3","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-aws-s3","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"WZkFQUckWoR3bkY9QwAj","title":"Custom Logs - HTTP","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-http","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"0fDn23dvudJIzTHQMroZ","title":"Custom via Fluentd","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-via-fluentd","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"vMGojBBKM9LVBC5e1R5l","title":"Fastly","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/fastly","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"JQzMFDfJc7f2zGAaTVqz","title":"Github","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/github","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"gxXbE7abLSEf1VZT7Cq4","title":"Google Cloud Platform (GCP) Audit","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-cloud-platform-gcp-audit","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"k6qVPm5TsSK2sxAI1hdl","title":"Google Workspace","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"qkafGHyvqZQd8McKSJiW","title":"Google Workspace Activity","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-activity","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Google Workspace"}]},{"id":"PqijvZunavSU85zJxgxE","title":"Google Workspace Alerts","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-alerts","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Google Workspace"}]},{"id":"WPf3gALz0lJ7oGa080nN","title":"Jamf","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/jamf","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"5ga0lMj2ur2H8FaiPphE","title":"Lacework","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/lacework","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8iXZhddUkO6M2SIkLFaU","title":"Okta","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/okta","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"iS0JPMaxUxBBVD3UgYxZ","title":"Osquery","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/osquery","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"69j8o2KxhA5Agk1VYyly","title":"OSSEC","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/ossec","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"H3Ocw8BZqeDXWjvrDmre","title":"SentinelOne","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sentinelone","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"lh5aN5L00Xfc8n0ZmvkK","title":"Slack","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/slack","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"lNFgYsq8GyhKrdr2ZE4m","title":"Snowflake","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/snowflake","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"VRHmRpr5vsSeYAr4ATWC","title":"Sophos","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sophos","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"2FRoKeWglpjKB1YgXrvW","title":"Syslog","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/syslog","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"HvX7Vu14wmsGH4r6DV0x","title":"Sublime Security","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sublime-security","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"OCvlGhgB9maFf5sMZpMM","title":"Suricata","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/suricata","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"3BfFeq8Ptc2oTFNUzX9x","title":"Teleport","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/teleport","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"q3szcsslflHHN27jlcmf","title":"Windows Defender","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-defender","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8TzIPWeJo40EbACy8DRV","title":"Windows Sysmon","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-sysmon","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"iUR8xsNVkuGqCHHZfMNf","title":"Wiz","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/wiz","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"AmbCziZyHdDiISCOECiZ","title":"Zeek","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/zeek","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"wIs5JcAtpGemMv7QZe8d","title":"Index Organization","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/index-organization","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"tm4XJLzK6hr0MBeCbX36","title":"Regular Expressions in Index Rules","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/regular-expressions-in-index-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"bc26wjfKrA33KhhU7XDH","title":"Data Transformation & Enrichment","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"UvoUg0uaPfTgRdd5dGzK","title":"Data Transformations","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/data-transformations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"5kpOto1aEoLFIUHL7spZ","title":"Custom VRL","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/custom-vrl","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"dyQZ7nRnGsjv2hsyWPVA","title":"Lookup Table Enrichment","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"IhR5IXjFEgR7M7MpgGF9","title":"Custom Lookup Tables","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/custom-lookup-tables","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"},{"label":"Lookup Table Enrichment"}]},{"id":"yP8h5vvElIkOJJKZ6pe7","title":"Threat Intelligence","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/threat-intelligence","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"},{"label":"Lookup Table Enrichment"}]},{"id":"f49oU0WKsNqrlGkjs2eZ","title":"Querying & Analysis","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"FdqJumWVtgNIE5FQAuVH","title":"Query Syntax","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/query-syntax","siteSpaceId":"sitesp_wxEYA","description":"Here is how you search through your log events","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"xYzfYD5qMVKsLRkFaxtB","title":"Understanding Tokens and Query Performance","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/tokens-and-query-performance","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"P7EsPLbXm24rgQmrvqLr","title":"Data Exploration","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/data-exploration","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"mLU4XOXzOdgKA39PjL5G","title":"Aggregation Functions","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"cmhB41akVayM1TooXY5o","title":"avg()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/avg","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"pvq1HoeASIzlVsNj3uou","title":"count()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/count","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"bGNWZYus5i2U4W69Y5WG","title":"countdistinct()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/countdistinct","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"JRX9kdonBbF1NsAeCkL6","title":"eval()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/eval","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"uWx1Jgz1g4I06g1bVbuS","title":"groupbycount()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/groupbycount","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"nFnwk3V8ieuIlpq2LvQL","title":"head()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/head","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"XBLHQwcRKbNKFYWyi0bg","title":"max()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/max","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"IDznwYIV8B5pH0v2RfbK","title":"min()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/min","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"N0aXsnN7sShgK4ZjNnAC","title":"percentile()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/percentile","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"OQKHNye5IuVNfrxS8Le8","title":"rename()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/rename","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"gveg4UyOW483nzrBiWC6","title":"stats()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/stats","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"BRDoj8k4W0qa57f1wCQw","title":"sum()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/sum","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"onBYlK2KMO201X0d4qx7","title":"table()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/table","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"8CB4UfmyrI84nQlj8z9E","title":"tail()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/tail","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"jUCRnfHsGc6G4GSufUM8","title":"var()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/var","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"dGOTTSUnxazcuyyxbSHq","title":"where()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/where","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"SsYOR25tj2dQxofkb5C1","title":"Built-in Indexes","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"zITwCKlwNPyPthKW1fqg","title":"_audit","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes/_audit","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Built-in Indexes"}]},{"id":"3UDLBOqeembNfP57B6I9","title":"_usage","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes/_usage","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Built-in Indexes"}]},{"id":"mzDlQUs9KkudUcgqDb9k","title":"Detections & Alerting","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"mhTNtEpllwPWFrXdSJH9","title":"Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules","siteSpaceId":"sitesp_wxEYA","description":"Scanner provides built-in threat detection rules - or you can write your own. These rules run continuously and send you notifications when the rule criteria are met.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"}]},{"id":"uZszUFMfcd7hliVhVsRY","title":"Out-of-the-Box Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/out-of-the-box-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"loDaFGThGFMcxDUvI0Yk","title":"Detection Rules as Code","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code","siteSpaceId":"sitesp_wxEYA","description":"Collaborate on, review, and continuously test detection rules.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"jTTouUAzg7YJIv71YotF","title":"Getting Started","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/getting-started","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"HUfUwCUpxjmgsnyp9E7r","title":"Writing Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/writing-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"E4oL48easrpNqBrbCMbT","title":"CLI","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/cli","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"pPi5XVyudzFLp6rAyTib","title":"Managing Synced Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/managing-synced-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"5QVALS6dLjE3fedeQe5V","title":"Detection Alert Formatting","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting","siteSpaceId":"sitesp_wxEYA","description":"Custom formatting for detection alerts","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"vN0eeXmndgwDpBebzV78","title":"Customizing PagerDuty Alerts","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting/customizing-pagerduty-alerts","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Alert Formatting"}]},{"id":"GFF5XfmxpQ3JMGbtLZN3","title":"MITRE Tags","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/mitre-tags","siteSpaceId":"sitesp_wxEYA","description":"Below are the default MITRE tags in Scanner. These are populated in the list of tags on the detection rule create and edit pages.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"abWrjsgDfg677yMHvsql","title":"Event Sinks","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/event-sinks","siteSpaceId":"sitesp_wxEYA","description":"Event sinks are alert destinations.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"}]},{"id":"XMXvfAPvUwFUj1DGl2AY","title":"Administration","pathname":"/scanner/using-scanner-complete-feature-reference/administration","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"saSykJDLYTkvkAc60LOC","title":"Authentication & SSO","pathname":"/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso","siteSpaceId":"sitesp_wxEYA","description":"Use Single Sign On to connect your enterprise's identity provider to Scanner.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"}]},{"id":"YSAR6gbraS8asZ56rDah","title":"SCIM","pathname":"/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso/scim","siteSpaceId":"sitesp_wxEYA","description":"Use SCIM to automate user provisioning, deprovisioning, and role synchronization from your enterprise's identity provider to Scanner.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"},{"label":"Authentication & SSO"}]},{"id":"GYWhX2gqiNnJMzqhP7YQ","title":"Role-Based Access Control (RBAC)","pathname":"/scanner/using-scanner-complete-feature-reference/administration/role-based-access-control-rbac","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"}]},{"id":"xTj9AbE0suLHRz7CLzHp","title":"MCP & AI SecOps","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops","siteSpaceId":"sitesp_wxEYA","description":"Connect AI SecOps agents to your security data via Model Context Protocol.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"lrMpDJbsKFtZLeOzZAgS","title":"Getting Started","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/getting-started","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"nt75vkyGDlpOOib5Ga6S","title":"Scanner MCP Tools Reference","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/mcp-tools-reference","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"3QBAAOXs1FiMqc6MIWIf","title":"Using MCP for Security Operations","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"uBHrE5AslWKl2GuZKXlP","title":"Interactive Investigations","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/interactive-investigations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"aHBFFvzMqTzjvy0QWbdK","title":"Detection Engineering","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/detection-engineering","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"uv4xv18eB8n73EWJZD2w","title":"Autonomous Workflows","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/autonomous-workflows","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"YXjhZUQP2zUsTLKibuEH","title":"Deploying Agents","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents","siteSpaceId":"sitesp_wxEYA","description":"Deploy autonomous SOC agents to your infrastructure using pre-built, production-ready examples from the scanner-inc/agents repository.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"FHKnpWB1zVp6r55ANA8U","title":"Deploy via n8n","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/n8n","siteSpaceId":"sitesp_wxEYA","description":"Deploy Scanner SOC agents as n8n workflows. Import, configure credentials, activate.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Deploying Agents"}]},{"id":"tUSH3QA0XVSAYTwG4dXG","title":"Deploy via AWS","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/aws","siteSpaceId":"sitesp_wxEYA","description":"Deploy Scanner SOC agents to AWS using the Claude Agent SDK and Terraform.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Deploying Agents"}]},{"id":"Zex2gFZYQNivh0LVoX2m","title":"Other AI Features","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/other-ai-features","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"Nh7ivAhSG693BTcgsKVD","title":"Developer Tools","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"KaCJ1FvAIPrigNglGnQG","title":"API","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api","siteSpaceId":"sitesp_wxEYA","description":"Scanner lets you turn your logs in S3 into an API, giving you the ability to execute ad hoc queries, create detection rules, and more.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"}]},{"id":"FaU9J2v8EIytYILx7xby","title":"Ad hoc queries","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries","siteSpaceId":"sitesp_wxEYA","description":"You can execute ad hoc queries with the Scanner API, which allows you to run an arbitrary query over a specified time range.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"jGhTgW4L8kk9lhkHS7x7","title":"Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules","siteSpaceId":"sitesp_wxEYA","description":"A detection rule is a query that runs continuously on new logs as they arrive in Scanner. You can create create, read, update, and delete detection rules with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"SbERPx75O0L0nWAg9Vk2","title":"Event Sinks","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks","siteSpaceId":"sitesp_wxEYA","description":"Event sinks are event alert destinations. You can create, read, update, and delete event sinks with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"j5OikQsqB1QHHr5n4oOj","title":"GitHub Sync","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/github-sync","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"e7wXtYtDWWnUSgq57zm0","title":"Validating YAML files","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"eFzuoGapi9qD4B549k4e","title":"Beta Features","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"obwpKMTrxRvMiEfpKjzC","title":"Jupyter Notebooks","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks","siteSpaceId":"sitesp_wxEYA","description":"Powerful threat hunting and investigation with Jupyter notebooks.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"}]},{"id":"LyF52UFp8yaZd0OEm2SB","title":"Getting Started with Jupyter Notebooks","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/getting-started-with-jupyter-notebooks","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Jupyter Notebooks"}]},{"id":"dVOULufvvuQMFl5H6rwf","title":"Scanner Notebooks on Github","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/scanner-notebooks-on-github","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Jupyter Notebooks"}]},{"id":"d73tNu10Iehhj8FYBv1t","title":"Scalar Functions and Operators","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"}]},{"id":"8VZYkCr1D0YsIPGPFj9d","title":"coalesce()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/coalesce","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"GZypaJYbUtCza121JCNu","title":"if()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/if","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"koNt8lmBEQwM5y3LR2Td","title":"arr.join()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/arr.join","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"YIOuHVDV9fxQjyoYjV6c","title":"math.abs()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.abs","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"NcbK8o3AzWx2mKC2Gi9j","title":"math.round()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.round","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"3Nlb8cGSNyxBO7VJQC7i","title":"num.parse()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.parse","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"FMvB4ifIVCunBNmAnK7D","title":"num.to_str()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.to_str","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"fVxBDTOTbvZe7OUzig8P","title":"regex.extract()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.extract","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"vLrKtS08gTv6QFHen8Pj","title":"regex.is_match()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.is_match","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"T1cMAbP45EKrWzHaxGnp","title":"regex.replace()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"zYx5wyXSdNbitq6AGM5M","title":"regex.replace_all()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace_all","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"gGON0JpgefZgb4OmzJOC","title":"str.uriencode()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/str.uriencode","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]}]}