{"version":1,"pages":[{"id":"0A7G1Mn6kEc7oPh01Wz4","title":"What is Scanner","pathname":"/scanner","siteSpaceId":"sitesp_wxEYA","description":"Index your security data where it lives. Full visibility, hyper-fast search, and continuous detections, without SIEM-scale costs.","breadcrumbs":[{"label":"What & Why"}]},{"id":"KniBJ9k5TtAufznebyOl","title":"How it Works","pathname":"/scanner/what-and-why/how-it-works","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"}]},{"id":"1IZvZvBqbVlS2qpFVJss","title":"How Scanner Achieves Fast Queries","pathname":"/scanner/what-and-why/how-it-works/how-scanner-achieves-fast-queries","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"uw61Tdx6SVi9wBMSfKsY","title":"Detection Rule Engine","pathname":"/scanner/what-and-why/how-it-works/detection-rule-engine","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"g1TaRZYw7Hpr4ExoAa6V","title":"Bring Your Own Cloud (BYOC) / Self-Hosted","pathname":"/scanner/what-and-why/how-it-works/bring-your-own-cloud-byoc-self-hosted","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"What & Why"},{"label":"How it Works"}]},{"id":"sQORXCuObEqeMzaDNpph","title":"Quick Setup Overview","pathname":"/scanner/getting-started/quick-setup-overview","siteSpaceId":"sitesp_wxEYA","description":"This guide walks you through connecting Scanner to your AWS environment and ingesting your first logs. The entire process typically takes 30-45 minutes.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"04vRapGnxzfmPulul6nn","title":"Step 1: AWS Infrastructure Setup","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup","siteSpaceId":"sitesp_wxEYA","description":"Before Scanner can analyze logs, you must establish a secure connection to your AWS account. This creates the IAM roles, S3 buckets, and EventBridge resources Scanner requires.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"t7Z7fVCGNpVxjBYGnZJU","title":"AWS CloudFormation","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/aws-cloudformation","siteSpaceId":"sitesp_wxEYA","description":"Getting started with CloudFormation","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"Xu7juj6M7DG4RcrAk6hD","title":"Terraform","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/terraform","siteSpaceId":"sitesp_wxEYA","description":"Getting started with Terraform","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"8CYhiIOiWPzo65VX7JCI","title":"Manual Setup - AWS CloudShell","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/manual-setup-aws-cloudshell","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"nNqK4Ch0SATkCc4mzaKd","title":"Troubleshooting AWS Errors","pathname":"/scanner/getting-started/step-1-aws-infrastructure-setup/troubleshooting-aws-errors","siteSpaceId":"sitesp_wxEYA","description":"A guide to understanding and resolving AWS configuration and permission errors that appear in the Scanner UI.","breadcrumbs":[{"label":"Getting Started"},{"label":"Step 1: AWS Infrastructure Setup"}]},{"id":"3WBGxNChkZJYBtT503Ql","title":"Step 2: Connect Your First Data Source using Scanner Collect","pathname":"/scanner/getting-started/step-2-connect-your-first-data-source-using-scanner-collect","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Getting Started"}]},{"id":"vHgDOnfl17MofzpERIDS","title":"Step 3: Validate & Test","pathname":"/scanner/getting-started/step-3-validate-and-test","siteSpaceId":"sitesp_wxEYA","description":"Once you have set up a new source you can expect to see data flowing into Scanner within a few minutes. Follow the steps below to get started exploring your data.","breadcrumbs":[{"label":"Getting Started"}]},{"id":"mhI9dh3o2t2ZmbyQmdFt","title":"Scanner Collect: Data Ingestion","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion","siteSpaceId":"sitesp_wxEYA","description":"Learn what Scanner Collect is, how it delivers your SaaS and cloud logs into S3 storage you control, and how it simplifies ingestion, indexing, and detection.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"xOuN1ixYH9sOVcC1Ru1i","title":"Sources","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"TPqkHtaqd1PNl8CuucmA","title":"1Password","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/1password","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"MRhsLmMPjwEYKhBry80t","title":"Atlassian","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/atlassian","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"pW9jeYBj4RtpM3IctSO6","title":"Auth0","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/auth0","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"feUSwscTRTYIvfgHnJxh","title":"AWS Aurora","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-aurora","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"3QhBo1NB2JOX0Tbdfqsa","title":"AWS CloudTrail","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudtrail","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"ypbTTj2wiMn6PEQZnAzZ","title":"AWS CloudWatch","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-cloudwatch","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"HHhixMSXUvUr6L1vGan0","title":"AWS ECS","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-ecs","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"xdXa86jeSpkwiOnk19EB","title":"AWS EKS","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-eks","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"x0E9Ebp7jcnoKVKAfK0v","title":"AWS GuardDuty","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-guardduty","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8M1nzFyNR4SR0Jf4NF1q","title":"AWS Lambda","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-lambda","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"yj7pb6EzC4RJiB8iLRgR","title":"AWS Route53 Resolver","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-route53-resolver","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"wB8iYjhTsAs5iqkXbkqC","title":"AWS VPC Flow","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-flow","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"9zEJpEXgRMxfNMoYGB6U","title":"AWS VPC Transit Gateway Flow","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-vpc-transit-gateway-flow","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"tn8JcaLLds2kd5uk8Q4z","title":"AWS WAF","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/aws-waf","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"d0XNkIUqOgNv4gnRPGlM","title":"Azure Activity","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/azure-activity","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"GWZJ1yjOi9JIuZkIExkA","title":"Azure Blob Storage","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/azure-blob-storage","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"Ni3ChsQVehapgrP3ryh2","title":"Cloudflare","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/cloudflare","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"cR2BqxJvlPpxTJY5PmsP","title":"Crowdstrike","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/crowdstrike","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8Td8dMhEQY1MgX4e6WOk","title":"Custom Logs - AWS S3","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-aws-s3","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"WZkFQUckWoR3bkY9QwAj","title":"Custom Logs - HTTP","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-logs-http","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"0fDn23dvudJIzTHQMroZ","title":"Custom via Fluentd","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/custom-via-fluentd","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"vMGojBBKM9LVBC5e1R5l","title":"Fastly","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/fastly","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"JQzMFDfJc7f2zGAaTVqz","title":"Github","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/github","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"gxXbE7abLSEf1VZT7Cq4","title":"Google Cloud Platform (GCP) Audit","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-cloud-platform-gcp-audit","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"EM3HGcEhnpCSw0N8imtz","title":"Google Cloud Storage (GCS)","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-cloud-storage-gcs","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"k6qVPm5TsSK2sxAI1hdl","title":"Google Workspace","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"qkafGHyvqZQd8McKSJiW","title":"Google Workspace Activity","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-activity","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Google Workspace"}]},{"id":"PqijvZunavSU85zJxgxE","title":"Google Workspace Alerts","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/google-workspace/google-workspace-alerts","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Google Workspace"}]},{"id":"WPf3gALz0lJ7oGa080nN","title":"Jamf","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/jamf","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"5ga0lMj2ur2H8FaiPphE","title":"Lacework","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/lacework","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8iXZhddUkO6M2SIkLFaU","title":"Okta","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/okta","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"iS0JPMaxUxBBVD3UgYxZ","title":"Osquery","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/osquery","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"69j8o2KxhA5Agk1VYyly","title":"OSSEC","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/ossec","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"H3Ocw8BZqeDXWjvrDmre","title":"SentinelOne","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sentinelone","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"lh5aN5L00Xfc8n0ZmvkK","title":"Slack","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/slack","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"lNFgYsq8GyhKrdr2ZE4m","title":"Snowflake","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/snowflake","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"VRHmRpr5vsSeYAr4ATWC","title":"Sophos","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sophos","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8ybjCWhH8hcVV4hCVXpI","title":"Streams (Kafka, Kinesis, and More)","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"ZIl2X94clmOfx6AXcz1o","title":"Apache Kafka","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/kafka","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"vARFzaXUtaYu0fHcB0t8","title":"AWS Kinesis","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/aws-kinesis","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"G3JetFn6Svh8GvOBboNv","title":"AWS MSK","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/aws-msk","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"WnmIXxzjn7sPVslqvQRI","title":"Confluent Cloud","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/confluent-cloud","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"2i4Dp34f7p9Erso3vFyX","title":"Cribl Stream","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/cribl","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"6CFTQ3EbU0fw2I9ipfAi","title":"Redpanda","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/streams/redpanda","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"},{"label":"Streams (Kafka, Kinesis, and More)"}]},{"id":"2FRoKeWglpjKB1YgXrvW","title":"Syslog","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/syslog","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"HvX7Vu14wmsGH4r6DV0x","title":"Sublime Security","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/sublime-security","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"OCvlGhgB9maFf5sMZpMM","title":"Suricata","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/suricata","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"3BfFeq8Ptc2oTFNUzX9x","title":"Teleport","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/teleport","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"q3szcsslflHHN27jlcmf","title":"Windows Defender","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-defender","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"8TzIPWeJo40EbACy8DRV","title":"Windows Sysmon","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/windows-sysmon","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"iUR8xsNVkuGqCHHZfMNf","title":"Wiz","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/wiz","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"AmbCziZyHdDiISCOECiZ","title":"Zeek","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/zeek","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"},{"label":"Sources"}]},{"id":"3FuWgbiOPL6smUGGKpFs","title":"Log Event Structure","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/log-event-structure","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"wIs5JcAtpGemMv7QZe8d","title":"Index Organization","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/index-organization","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"Gem9jwD4aqayN3OiChpN","title":"Create an Index Rule","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"tm4XJLzK6hr0MBeCbX36","title":"Regular Expressions in Index Rules","pathname":"/scanner/using-scanner-complete-feature-reference/data-ingestion/regular-expressions-in-index-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Scanner Collect: Data Ingestion"}]},{"id":"bc26wjfKrA33KhhU7XDH","title":"Data Transformation & Enrichment","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"UvoUg0uaPfTgRdd5dGzK","title":"Data Transformations","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/data-transformations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"5kpOto1aEoLFIUHL7spZ","title":"Custom VRL","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/custom-vrl","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"dyQZ7nRnGsjv2hsyWPVA","title":"Lookup Table Enrichment","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"}]},{"id":"IhR5IXjFEgR7M7MpgGF9","title":"Custom Lookup Tables","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/custom-lookup-tables","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"},{"label":"Lookup Table Enrichment"}]},{"id":"yP8h5vvElIkOJJKZ6pe7","title":"Threat Intelligence","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/threat-intelligence","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"},{"label":"Lookup Table Enrichment"}]},{"id":"1HrmB9FYq09OvZS9HH1S","title":"GeoIP","pathname":"/scanner/using-scanner-complete-feature-reference/data-transformation-and-enrichment/lookup-table-enrichment/geoip","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Data Transformation & Enrichment"},{"label":"Lookup Table Enrichment"}]},{"id":"f49oU0WKsNqrlGkjs2eZ","title":"Querying & Analysis","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"FdqJumWVtgNIE5FQAuVH","title":"Query Syntax","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/query-syntax","siteSpaceId":"sitesp_wxEYA","description":"Here is how you search through your log events","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"xYzfYD5qMVKsLRkFaxtB","title":"Understanding Tokens and Query Performance","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/tokens-and-query-performance","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"P7EsPLbXm24rgQmrvqLr","title":"Data Exploration","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/data-exploration","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"mLU4XOXzOdgKA39PjL5G","title":"Aggregation Functions","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"}]},{"id":"cmhB41akVayM1TooXY5o","title":"avg()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/avg","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"pvq1HoeASIzlVsNj3uou","title":"count()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/count","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"bGNWZYus5i2U4W69Y5WG","title":"countdistinct()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/countdistinct","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"JRX9kdonBbF1NsAeCkL6","title":"eval()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/eval","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"uWx1Jgz1g4I06g1bVbuS","title":"groupbycount()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/groupbycount","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"nFnwk3V8ieuIlpq2LvQL","title":"head()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/head","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"XBLHQwcRKbNKFYWyi0bg","title":"max()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/max","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"IDznwYIV8B5pH0v2RfbK","title":"min()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/min","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"N0aXsnN7sShgK4ZjNnAC","title":"percentile()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/percentile","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"OQKHNye5IuVNfrxS8Le8","title":"rename()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/rename","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"gveg4UyOW483nzrBiWC6","title":"stats()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/stats","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"BRDoj8k4W0qa57f1wCQw","title":"sum()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/sum","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"onBYlK2KMO201X0d4qx7","title":"table()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/table","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"8CB4UfmyrI84nQlj8z9E","title":"tail()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/tail","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"jUCRnfHsGc6G4GSufUM8","title":"var()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/var","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"dGOTTSUnxazcuyyxbSHq","title":"where()","pathname":"/scanner/using-scanner-complete-feature-reference/querying-and-analysis/aggregation-functions/where","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Querying & Analysis"},{"label":"Aggregation Functions"}]},{"id":"SsYOR25tj2dQxofkb5C1","title":"Built-in Indexes","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"zITwCKlwNPyPthKW1fqg","title":"_audit","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes/_audit","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Built-in Indexes"}]},{"id":"3UDLBOqeembNfP57B6I9","title":"_usage","pathname":"/scanner/using-scanner-complete-feature-reference/built-in-indexes/_usage","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Built-in Indexes"}]},{"id":"mzDlQUs9KkudUcgqDb9k","title":"Detections & Alerting","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"mhTNtEpllwPWFrXdSJH9","title":"Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules","siteSpaceId":"sitesp_wxEYA","description":"Scanner provides built-in threat detection rules - or you can write your own. These rules run continuously and send you notifications when the rule criteria are met.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"}]},{"id":"uZszUFMfcd7hliVhVsRY","title":"Out-of-the-Box Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/out-of-the-box-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"loDaFGThGFMcxDUvI0Yk","title":"Detection Rules as Code","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code","siteSpaceId":"sitesp_wxEYA","description":"Collaborate on, review, and continuously test detection rules.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"jTTouUAzg7YJIv71YotF","title":"Getting Started","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/getting-started","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"HUfUwCUpxjmgsnyp9E7r","title":"Writing Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/writing-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"E4oL48easrpNqBrbCMbT","title":"CLI","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/cli","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"pPi5XVyudzFLp6rAyTib","title":"Managing Synced Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/managing-synced-detection-rules","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Rules as Code"}]},{"id":"5QVALS6dLjE3fedeQe5V","title":"Detection Alert Formatting","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting","siteSpaceId":"sitesp_wxEYA","description":"Custom formatting for detection alerts","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"vN0eeXmndgwDpBebzV78","title":"Customizing PagerDuty Alerts","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting/customizing-pagerduty-alerts","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"},{"label":"Detection Alert Formatting"}]},{"id":"GFF5XfmxpQ3JMGbtLZN3","title":"MITRE Tags","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/mitre-tags","siteSpaceId":"sitesp_wxEYA","description":"Below are the default MITRE tags in Scanner. These are populated in the list of tags on the detection rule create and edit pages.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"},{"label":"Detection Rules"}]},{"id":"abWrjsgDfg677yMHvsql","title":"Event Sinks","pathname":"/scanner/using-scanner-complete-feature-reference/detections-and-alerting/event-sinks","siteSpaceId":"sitesp_wxEYA","description":"Event sinks are alert destinations.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Detections & Alerting"}]},{"id":"XMXvfAPvUwFUj1DGl2AY","title":"Administration","pathname":"/scanner/using-scanner-complete-feature-reference/administration","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"saSykJDLYTkvkAc60LOC","title":"Authentication & SSO","pathname":"/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso","siteSpaceId":"sitesp_wxEYA","description":"Use Single Sign On to connect your enterprise's identity provider to Scanner.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"}]},{"id":"YSAR6gbraS8asZ56rDah","title":"SCIM","pathname":"/scanner/using-scanner-complete-feature-reference/administration/authentication-and-sso/scim","siteSpaceId":"sitesp_wxEYA","description":"Use SCIM to automate user provisioning, deprovisioning, and role synchronization from your enterprise's identity provider to Scanner.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"},{"label":"Authentication & SSO"}]},{"id":"GYWhX2gqiNnJMzqhP7YQ","title":"Role-Based Access Control (RBAC)","pathname":"/scanner/using-scanner-complete-feature-reference/administration/role-based-access-control-rbac","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Administration"}]},{"id":"xTj9AbE0suLHRz7CLzHp","title":"MCP & AI SecOps","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops","siteSpaceId":"sitesp_wxEYA","description":"Connect AI SecOps agents to your security data via Model Context Protocol.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"lrMpDJbsKFtZLeOzZAgS","title":"Getting Started","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/getting-started","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"nt75vkyGDlpOOib5Ga6S","title":"Scanner MCP Tools Reference","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/mcp-tools-reference","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"3QBAAOXs1FiMqc6MIWIf","title":"Using MCP for Security Operations","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"uBHrE5AslWKl2GuZKXlP","title":"Interactive Investigations","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/interactive-investigations","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"aHBFFvzMqTzjvy0QWbdK","title":"Detection Engineering","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/detection-engineering","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"uv4xv18eB8n73EWJZD2w","title":"Autonomous Workflows","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/using-mcp-for-security-operations/autonomous-workflows","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Using MCP for Security Operations"}]},{"id":"YXjhZUQP2zUsTLKibuEH","title":"Deploying Agents","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents","siteSpaceId":"sitesp_wxEYA","description":"Deploy autonomous SOC agents to your infrastructure using pre-built, production-ready examples from the scanner-inc/agents repository.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"FHKnpWB1zVp6r55ANA8U","title":"Deploy via n8n","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/n8n","siteSpaceId":"sitesp_wxEYA","description":"Deploy Scanner SOC agents as n8n workflows. Import, configure credentials, activate.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Deploying Agents"}]},{"id":"tUSH3QA0XVSAYTwG4dXG","title":"Deploy via AWS","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/deploying-agents/aws","siteSpaceId":"sitesp_wxEYA","description":"Deploy Scanner SOC agents to AWS using the Claude Agent SDK and Terraform.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"},{"label":"Deploying Agents"}]},{"id":"Zex2gFZYQNivh0LVoX2m","title":"Other AI Features","pathname":"/scanner/using-scanner-complete-feature-reference/mcp-and-ai-secops/other-ai-features","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"MCP & AI SecOps"}]},{"id":"Nh7ivAhSG693BTcgsKVD","title":"Developer Tools","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"KaCJ1FvAIPrigNglGnQG","title":"API","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api","siteSpaceId":"sitesp_wxEYA","description":"Scanner lets you turn your logs in S3 into an API, giving you the ability to execute ad hoc queries, create detection rules, and more.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"}]},{"id":"FaU9J2v8EIytYILx7xby","title":"Ad hoc queries","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/ad-hoc-queries","siteSpaceId":"sitesp_wxEYA","description":"You can execute ad hoc queries with the Scanner API, which allows you to run an arbitrary query over a specified time range.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"jGhTgW4L8kk9lhkHS7x7","title":"Detection Rules","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/detection-rules","siteSpaceId":"sitesp_wxEYA","description":"A detection rule is a query that runs continuously on new logs as they arrive in Scanner. You can create create, read, update, and delete detection rules with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"SbERPx75O0L0nWAg9Vk2","title":"Event Sinks","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/event-sinks","siteSpaceId":"sitesp_wxEYA","description":"Event sinks are event alert destinations. You can create, read, update, and delete event sinks with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"uB16ZJsfyuyVeJSTMdSl","title":"Git Sync","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/git-sync","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"sgFdN4P5EHPzFKyBM8Lk","title":"Indexes","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/indexes","siteSpaceId":"sitesp_wxEYA","description":"Indexes are the containers your ingested log events live in, referenced by @index / @index_id in queries. You can list and read indexes with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"hcxAaf39eUiwK7SB9Fuw","title":"Lookup Tables","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/lookup-tables","siteSpaceId":"sitesp_wxEYA","description":"Manage lookup table files via the Scanner API. Upload CSV or MMDB files, preview their contents, edit metadata, and delete them.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"jYBMg3BM1N0aKmKY89B4","title":"Info Queries","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/info","siteSpaceId":"sitesp_wxEYA","description":"Info API endpoints are endpoints that yield information about Scanner such as metrics or configuration values. You can read Info with the Scanner API.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"e7wXtYtDWWnUSgq57zm0","title":"Validating YAML files","pathname":"/scanner/using-scanner-complete-feature-reference/developer-tools/api/validating-yaml-files","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Developer Tools"},{"label":"API"}]},{"id":"eFzuoGapi9qD4B549k4e","title":"Beta Features","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"}]},{"id":"obwpKMTrxRvMiEfpKjzC","title":"Jupyter Notebooks","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks","siteSpaceId":"sitesp_wxEYA","description":"Powerful threat hunting and investigation with Jupyter notebooks.","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"}]},{"id":"LyF52UFp8yaZd0OEm2SB","title":"Getting Started with Jupyter Notebooks","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/getting-started-with-jupyter-notebooks","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Jupyter Notebooks"}]},{"id":"dVOULufvvuQMFl5H6rwf","title":"Scanner Notebooks on Github","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/jupyter-notebooks/scanner-notebooks-on-github","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Jupyter Notebooks"}]},{"id":"d73tNu10Iehhj8FYBv1t","title":"Scalar Functions and Operators","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"}]},{"id":"8VZYkCr1D0YsIPGPFj9d","title":"coalesce()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/coalesce","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"GZypaJYbUtCza121JCNu","title":"if()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/if","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"koNt8lmBEQwM5y3LR2Td","title":"arr.join()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/arr.join","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"YIOuHVDV9fxQjyoYjV6c","title":"math.abs()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.abs","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"NcbK8o3AzWx2mKC2Gi9j","title":"math.round()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/math.round","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"3Nlb8cGSNyxBO7VJQC7i","title":"num.parse()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.parse","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"FMvB4ifIVCunBNmAnK7D","title":"num.to_str()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/num.to_str","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"fVxBDTOTbvZe7OUzig8P","title":"regex.extract()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.extract","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"vLrKtS08gTv6QFHen8Pj","title":"regex.is_match()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.is_match","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"T1cMAbP45EKrWzHaxGnp","title":"regex.replace()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"zYx5wyXSdNbitq6AGM5M","title":"regex.replace_all()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/regex.replace_all","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]},{"id":"gGON0JpgefZgb4OmzJOC","title":"str.uriencode()","pathname":"/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators/str.uriencode","siteSpaceId":"sitesp_wxEYA","description":"","breadcrumbs":[{"label":"Using Scanner (Complete Feature Reference)"},{"label":"Beta Features"},{"label":"Scalar Functions and Operators"}]}]}