Sentinel User Guide

This comprehensive guide covers how to use the Sentinel Cybersecurity Triage System web interface and natural language querying capabilities.

Getting Started
Dashboard Overview
Article Review Workflow
Natural Language Queries
Report Generation
User Management
Advanced Features
Troubleshooting

Getting Started

Accessing Sentinel

Navigate to the Sentinel URL provided by your administrator
Sign in using your organizational credentials
Complete MFA if enabled (recommended for production)
Review your dashboard to see the latest cybersecurity intelligence

User Roles

Sentinel supports different user roles with varying levels of access:

Security Analyst

Permissions: Review articles, add comments, make decisions on relevancy
Access: Dashboard, article review, basic reporting
Workflow: Primary users who triage and analyze security content

Security Manager

Permissions: All analyst permissions plus user management and advanced reporting
Access: Full dashboard, advanced reports, user administration
Workflow: Oversight of triage process and team management

Administrator

Permissions: Full system access including configuration management
Access: All features plus system configuration and maintenance
Workflow: System administration and configuration updates

First Login Setup

Update Your Profile
- Set notification preferences
- Configure dashboard layout
- Set default filters and views
Review System Status
- Check feed processing status
- Review recent system alerts
- Verify data freshness
Familiarize with Interface
- Explore the main dashboard
- Review sample articles
- Test search and filtering

Dashboard Overview

The Sentinel dashboard provides a comprehensive view of cybersecurity intelligence and system status.

Main Dashboard Components

1. Summary Statistics

┌─────────────────────────────────────────────────────────────┐
│ Today's Intelligence Summary                                │
├─────────────────────────────────────────────────────────────┤
│ 📊 Articles Processed: 127        🔍 Pending Review: 23    │
│ 🎯 High Priority: 8              ⚠️  Critical Alerts: 2    │
│ 📈 Relevancy Rate: 78%           🔄 Dedup Rate: 92%        │
└─────────────────────────────────────────────────────────────┘

2. Priority Queue

Critical: Immediate attention required (CVEs, active exploits)
High: Important security updates and advisories
Medium: General security information and updates
Low: Informational content and background intelligence

3. Recent Activity Feed

Latest processed articles
Recent analyst decisions
System notifications and alerts
Feed processing status updates

4. Trend Analysis

7-Day Trends: Article volume, relevancy rates, source distribution
Keyword Hits: Most frequently matched keywords
Source Analysis: Feed performance and reliability metrics

Customizing Your Dashboard

Layout Options

Compact View: Condensed information for quick overview
Detailed View: Expanded cards with more information
Analytics View: Focus on charts and trend analysis

Filter Preferences

# Example default filters
default_filters:
  time_range: "24h"
  priority: ["critical", "high"]
  sources: ["CISA", "NCSC", "Microsoft"]
  status: "pending_review"

Notification Settings

Real-time Alerts: Browser notifications for critical items
Email Digest: Daily/weekly summary emails
Slack Integration: Team channel notifications
Mobile Push: Mobile app notifications (if available)

Article Review Workflow

The article review process is the core workflow for security analysts using Sentinel.

Review Queue

Accessing the Queue

Navigate to "Review Queue" from the main menu
Articles are automatically prioritized by:
- Relevancy Score: AI-assessed relevance to your organization
- Keyword Matches: Number and importance of matched keywords
- Source Credibility: Reliability and authority of the source
- Recency: How recently the article was published

Queue Interface

┌─────────────────────────────────────────────────────────────┐
│ Review Queue (23 items)                    [Filters] [Sort] │
├─────────────────────────────────────────────────────────────┤
│ 🔴 CRITICAL | CVE-2024-1234: Azure AD Authentication Bypass │
│    Source: CISA | Relevancy: 95% | Keywords: Azure, CVE    │
│    Published: 2 hours ago | [Review] [Skip] [Escalate]     │
├─────────────────────────────────────────────────────────────┤
│ 🟠 HIGH | Microsoft Exchange Server Security Update        │
│    Source: Microsoft | Relevancy: 87% | Keywords: Exchange │
│    Published: 4 hours ago | [Review] [Skip] [Escalate]     │
└─────────────────────────────────────────────────────────────┘

Article Review Process

1. Article Analysis

When reviewing an article, analysts see:

Article Header

Title and source information
Publication date and discovery time
Relevancy score and confidence level
Matched keywords with context

Content Analysis

Full article text with keyword highlighting
Extracted entities (CVEs, vendors, products)
Similar articles (duplicates and related content)
AI-generated summary and key points

Metadata

Original URL and source feed
Processing timestamps
Previous analyst decisions (if any)
Related articles and references

2. Decision Making

Analysts can make the following decisions:

Relevant ✅

Article is relevant to organizational security
Should be included in reports and alerts
May trigger notifications to stakeholders

Not Relevant ❌

Article is not applicable to organization
Will be filtered out of reports
Helps train the AI for future assessments

Needs Escalation ⚠️

Requires senior analyst or manager review
Uncertain relevancy or high impact potential
Complex technical content requiring expertise

Duplicate 🔄

Article is a duplicate of previously processed content
Links to original article for reference
Improves deduplication algorithm accuracy

3. Adding Context

Analysts can enhance articles with:

Comments and Notes

## Analyst Notes
- Affects our Azure AD tenant configuration
- Similar to incident from Q2 2023
- Recommend immediate patching of production systems
- Coordinate with IT team for implementation timeline

## Impact Assessment
- **Severity**: High
- **Affected Systems**: All Azure AD integrated applications
- **Mitigation**: Available patch, testing required
- **Timeline**: 48-72 hours for full deployment

Tags and Categories

Custom organizational tags
Impact categories (infrastructure, applications, data)
Response priority levels
Stakeholder notifications

Bulk Operations

For efficiency, analysts can perform bulk operations:

Bulk Review

Select multiple similar articles
Apply same decision to all selected items
Add bulk comments and tags
Mass escalation for complex topics

Smart Filtering

-- Example filter queries
priority:critical AND source:CISA
keywords:(Azure OR "Microsoft 365") AND published:today
status:pending AND relevancy:>80%

Natural Language Queries

Sentinel's natural language query interface allows users to ask questions in plain English and receive relevant cybersecurity intelligence.

Query Interface

Accessing Natural Language Search

Navigate to "Intelligence Search" or use the search bar
Type your question in natural language
Review results with relevancy scoring
Refine queries for better results

Example Queries

Vulnerability Queries

"What Azure vulnerabilities were discovered this week?"
"Show me critical CVEs affecting Microsoft products"
"Are there any new exploits for our network infrastructure?"

Threat Intelligence Queries

"What ransomware campaigns are targeting healthcare?"
"Show me recent phishing attacks against financial institutions"
"What are the latest APT group activities?"

Product-Specific Queries

"Any security updates for Fortinet FortiGate?"
"Show me Mimecast security advisories from last month"
"What Cisco vulnerabilities need immediate patching?"

Trend Analysis Queries

"What are the trending cybersecurity threats this quarter?"
"Show me the most common attack vectors this month"
"Which vendors had the most security updates recently?"

Query Processing

Understanding Your Query

Sentinel processes natural language queries through:

Intent Recognition: Identifies what type of information you're seeking
Entity Extraction: Finds specific products, vendors, timeframes
Keyword Mapping: Maps natural language to configured keywords
Context Analysis: Understands the security context and urgency

Query Enhancement

The system automatically enhances queries by:

Adding relevant synonyms and variations
Expanding abbreviations (CVE, APT, etc.)
Including related terms and concepts
Applying organizational context and priorities

Advanced Query Syntax

Structured Queries

For power users, Sentinel supports structured query syntax:

# Time-based queries
published:today
created:last-week
updated:>2024-01-01

# Source filtering
source:CISA OR source:NCSC
feed:"Microsoft Security"

# Content matching
title:"zero day"
content:ransomware
keywords:Azure

# Relevancy and scoring
relevancy:>80%
priority:critical
status:reviewed

# Combination queries
(source:CISA OR source:Microsoft) AND keywords:Azure AND published:today

Query Operators

Operator	Description	Example
`AND`	Both conditions must be true	`Azure AND vulnerability`
`OR`	Either condition can be true	`CISA OR NCSC`
`NOT`	Exclude matching items	`security NOT marketing`
`"phrase"`	Exact phrase matching	`"zero day exploit"`
`field:value`	Field-specific search	`source:Microsoft`
`>`, `<`, `>=`, `<=`	Numeric comparisons	`relevancy:>80%`

Query Results

Result Display

Query results are displayed with:

Relevancy Score: How well the article matches your query
Matched Keywords: Highlighted terms that triggered the match
Context Snippets: Relevant excerpts with query terms highlighted
Source Information: Feed source and publication details
Related Articles: Similar or related content

Result Actions

From query results, users can:

View Full Article: Read complete content with analysis
Add to Report: Include in custom reports
Share: Send to colleagues or teams
Export: Download results in various formats
Save Query: Save frequently used queries for quick access

Query History and Favorites

Saved Queries

# Example saved queries
saved_queries:
  - name: "Daily Critical Alerts"
    query: "priority:critical AND published:today"
    schedule: "daily_8am"
    
  - name: "Azure Security Updates"
    query: "keywords:Azure AND (source:Microsoft OR source:CISA)"
    schedule: "weekly_monday"
    
  - name: "Ransomware Intelligence"
    query: "ransomware OR crypto-locker OR encryption malware"
    schedule: "real_time"

Query Analytics

Track your query patterns:

Most frequently used queries
Query performance and result quality
Trending search terms
Query refinement suggestions

Report Generation

Sentinel provides comprehensive reporting capabilities for security teams and management.

Report Types

1. Executive Summary Reports

Purpose: High-level overview for management Content:

Key security trends and metrics
Critical vulnerabilities and threats
Organizational risk assessment
Recommended actions and priorities

Format: PDF with executive summary, charts, and key findings

2. Technical Intelligence Reports

Purpose: Detailed analysis for security teams Content:

Complete vulnerability assessments
Threat actor analysis and TTPs
Technical indicators and IOCs
Detailed mitigation strategies

Format: Comprehensive PDF or interactive web report

3. Operational Reports

Purpose: Day-to-day operational intelligence Content:

Daily/weekly security updates
Feed processing statistics
Analyst productivity metrics
System health and performance

Format: XLSX spreadsheet with multiple tabs and data

Creating Custom Reports

Report Builder Interface

Select Report Type: Choose from predefined templates or create custom
Define Scope: Set date ranges, sources, and content filters
Choose Format: PDF, XLSX, or interactive web report
Configure Sections: Select which information to include
Set Distribution: Email recipients and delivery schedule

Report Configuration

# Example report configuration
report_config:
  name: "Weekly Security Intelligence"
  type: "technical"
  schedule: "weekly_friday_5pm"
  
  filters:
    date_range: "7d"
    priority: ["critical", "high"]
    sources: ["CISA", "NCSC", "Microsoft", "Fortinet"]
    relevancy_threshold: 0.7
    
  sections:
    - executive_summary
    - vulnerability_analysis
    - threat_intelligence
    - keyword_analysis
    - source_statistics
    - appendix_full_articles
    
  format: "pdf"
  distribution:
    - security-team@company.com
    - management@company.com

Report Sections

Executive Summary

Key Metrics: Article counts, relevancy rates, critical alerts
Trend Analysis: Week-over-week changes and patterns
Risk Assessment: Overall security posture and concerns
Action Items: Recommended immediate actions

Vulnerability Analysis

Critical CVEs: Newly discovered critical vulnerabilities
Affected Products: Impact on organizational technology stack
Exploitation Status: Known exploits and proof-of-concepts
Mitigation Timeline: Patching priorities and schedules

Threat Intelligence

Active Campaigns: Ongoing threat actor activities
Attack Trends: Common attack vectors and techniques
Industry Targeting: Threats specific to your industry
Geographic Threats: Region-specific threat landscape

Keyword Analysis

Top Keywords: Most frequently matched organizational keywords
Trending Terms: Emerging threats and technologies
Coverage Analysis: Keyword effectiveness and gaps
Recommendation: Suggested keyword updates

Automated Reporting

Scheduled Reports

Set up automated report generation and distribution:

# Automated report schedules
schedules:
  daily_brief:
    time: "08:00"
    recipients: ["analysts@company.com"]
    format: "email_summary"
    
  weekly_intelligence:
    day: "friday"
    time: "17:00"
    recipients: ["security-team@company.com", "management@company.com"]
    format: "pdf_detailed"
    
  monthly_executive:
    day: "first_monday"
    time: "09:00"
    recipients: ["executives@company.com"]
    format: "executive_summary"

Report Delivery Options

Email: Direct delivery to specified recipients
Slack: Automated posting to security channels
SharePoint: Upload to organizational document libraries
S3: Secure storage with access controls
API: Integration with other security tools

XLSX Export Features

Detailed Spreadsheet Reports

Sentinel generates comprehensive XLSX reports with multiple worksheets:

Summary Sheet

Report metadata and generation details
Key statistics and metrics
Executive summary and highlights

Articles Sheet

Complete article listing with all metadata
Relevancy scores and keyword matches
Analyst decisions and comments
Source information and timestamps

Keywords Sheet

Keyword match analysis
Hit counts and frequency statistics
Context examples and relevance assessment
Keyword performance metrics

Sources Sheet

Feed source analysis and statistics
Processing success rates and errors
Content quality and relevancy metrics
Source reliability assessment

Trends Sheet

Time-series data for trend analysis
Daily/weekly/monthly aggregations
Comparative analysis across time periods
Forecast and projection data

Advanced Excel Features

Pivot Tables: Pre-configured for common analysis
Charts and Graphs: Visual representation of key metrics
Conditional Formatting: Highlighting of critical information
Data Validation: Dropdown lists and input validation
Formulas: Calculated fields for custom analysis

User Management

Profile Management

Personal Settings

Users can configure their personal preferences:

Dashboard Preferences

Default view and layout options
Preferred time zones and date formats
Color themes and accessibility options
Widget selection and arrangement

Notification Settings

notifications:
  email:
    daily_digest: true
    critical_alerts: true
    weekly_summary: false
    
  browser:
    real_time_alerts: true
    sound_notifications: false
    
  mobile:
    push_notifications: true
    quiet_hours: "22:00-06:00"

Search Preferences

Default search filters and sorting
Saved query shortcuts
Result display preferences
Export format defaults

Security Settings

Password Management: Change password and security questions
Multi-Factor Authentication: Enable/disable MFA options
Session Management: Active session monitoring and control
API Keys: Generate and manage API access tokens

Team Management (Managers/Admins)

User Administration

Security managers and administrators can:

User Account Management

Create and deactivate user accounts
Assign roles and permissions
Reset passwords and unlock accounts
Monitor user activity and access logs

Role-Based Access Control

# Example role definitions
roles:
  security_analyst:
    permissions:
      - read_articles
      - review_articles
      - add_comments
      - generate_basic_reports
      
  security_manager:
    permissions:
      - all_analyst_permissions
      - manage_team_users
      - generate_advanced_reports
      - configure_notifications
      
  administrator:
    permissions:
      - all_manager_permissions
      - system_configuration
      - user_management
      - audit_access

Team Analytics

User productivity metrics
Review completion rates
Decision accuracy tracking
Training and performance insights

Access Control

Permission Levels

Sentinel implements granular permission controls:

Article Access

Read: View article content and metadata
Review: Make relevancy decisions and add comments
Escalate: Send articles for senior review
Bulk Operations: Perform batch actions on multiple articles

Reporting Access

Basic Reports: Standard operational reports
Advanced Reports: Custom and detailed analysis reports
Executive Reports: High-level summary reports
Export Data: Download raw data and detailed exports

Administrative Access

User Management: Create and manage user accounts
System Configuration: Modify system settings and parameters
Audit Access: View system logs and user activity
Integration Management: Configure external integrations

Data Classification

Articles and reports are classified by sensitivity:

Public: General cybersecurity information Internal: Organizational security intelligence Confidential: Sensitive threat intelligence Restricted: Highly classified security information

Advanced Features

Integration Capabilities

SIEM Integration

Connect Sentinel with your Security Information and Event Management (SIEM) system:

Supported Integrations

Splunk: Forward high-priority alerts and intelligence
QRadar: Send threat indicators and vulnerability data
ArcSight: Export security events and incident data
Elastic Security: Share threat intelligence and IOCs

Integration Configuration

# Example SIEM integration
siem_integration:
  type: "splunk"
  endpoint: "https://splunk.company.com:8088"
  token: "your-hec-token"
  
  forwarding_rules:
    - condition: "priority:critical"
      action: "immediate_forward"
    - condition: "keywords:ransomware"
      action: "alert_forward"
    - condition: "relevancy:>90%"
      action: "intelligence_forward"

Ticketing System Integration

Automatically create tickets for high-priority security items:

Supported Systems

ServiceNow: Create security incidents and change requests
Jira: Generate security tasks and vulnerability tickets
Remedy: Create incident and problem records
Custom APIs: Integration with proprietary ticketing systems

Communication Platform Integration

Share intelligence through team communication platforms:

Slack Integration

Automated channel notifications for critical alerts
Interactive buttons for quick article review
Threaded discussions on security topics
Bot commands for querying intelligence

Microsoft Teams Integration

Security channel notifications and updates
Adaptive cards for rich content display
Integration with Microsoft 365 security tools
Calendar integration for security briefings

API Access

RESTful API

Sentinel provides a comprehensive REST API for programmatic access:

Authentication

# API key authentication
curl -H "Authorization: Bearer your-api-key" \
     https://sentinel.company.com/api/v1/articles

Common Endpoints

# Get recent articles
GET /api/v1/articles?limit=50&priority=critical

# Search articles
POST /api/v1/articles/search
{
  "query": "Azure vulnerability",
  "filters": {
    "date_range": "7d",
    "sources": ["CISA", "Microsoft"]
  }
}

# Submit article review
POST /api/v1/articles/{id}/review
{
  "decision": "relevant",
  "comments": "Affects our Azure infrastructure",
  "tags": ["azure", "critical", "infrastructure"]
}

# Generate report
POST /api/v1/reports/generate
{
  "type": "technical",
  "filters": {
    "date_range": "30d",
    "priority": ["critical", "high"]
  },
  "format": "pdf"
}

Webhook Support

Configure webhooks for real-time notifications:

# Webhook configuration
webhooks:
  critical_alerts:
    url: "https://your-system.com/webhooks/security"
    events: ["article.critical", "vulnerability.discovered"]
    headers:
      Authorization: "Bearer webhook-token"
      
  daily_summary:
    url: "https://reporting.company.com/sentinel"
    events: ["report.daily"]
    schedule: "daily_08:00"

Mobile Access

Responsive Web Interface

Sentinel's web interface is fully responsive and optimized for mobile devices:

Mobile Features

Touch-optimized interface for article review
Swipe gestures for quick decisions
Offline reading capability for downloaded articles
Push notifications for critical alerts

Mobile Workflows

Quick article triage during commute
Emergency response access
Real-time alert monitoring
Voice-to-text for adding comments

Mobile App (Future)

Planned native mobile applications will provide:

Enhanced offline capabilities
Biometric authentication
Advanced push notifications
Camera integration for incident documentation

Customization Options

Dashboard Customization

Users can extensively customize their dashboard experience:

Widget Library

Article summary cards
Trend analysis charts
Source performance metrics
Keyword match statistics
System health indicators
Custom query results

Layout Options

Grid-based drag-and-drop interface
Responsive column layouts
Collapsible sections
Full-screen widget views

Branding and Themes

Organizations can customize the interface appearance:

Visual Customization

Company logo and branding
Custom color schemes and themes
Font selection and sizing
Dark mode and accessibility options

Content Customization

Custom terminology and labels
Organizational-specific help content
Localized interface languages
Custom report templates

Troubleshooting

Common Issues and Solutions

1. Login and Authentication Issues

Problem: Cannot log in to Sentinel Solutions:

Verify username and password
Check if MFA is required and properly configured
Clear browser cache and cookies
Try incognito/private browsing mode
Contact administrator for account status

Problem: MFA not working Solutions:

Verify authenticator app time synchronization
Try backup MFA codes if available
Reset MFA device with administrator help
Check network connectivity for SMS/email codes

2. Performance Issues

Problem: Slow page loading or timeouts Solutions:

Check internet connection speed and stability
Clear browser cache and temporary files
Disable browser extensions that might interfere
Try different browser or device
Report persistent issues to IT support

Problem: Search queries taking too long Solutions:

Simplify complex queries with fewer conditions
Use more specific keywords and filters
Limit date ranges for better performance
Try exact phrase matching instead of fuzzy search

3. Data and Content Issues

Problem: Missing or outdated articles Solutions:

Check feed processing status on dashboard
Verify RSS feed sources are accessible
Review system alerts for processing errors
Contact administrator about feed configuration

Problem: Incorrect relevancy scoring Solutions:

Review and update keyword configurations
Provide feedback through article review process
Check if organizational context is properly configured
Report systematic issues to administrators

4. Report Generation Issues

Problem: Reports not generating or incomplete Solutions:

Verify sufficient data exists for selected filters
Check report generation queue status
Try smaller date ranges or fewer filters
Ensure proper permissions for report type
Contact support for persistent generation failures

Problem: Export files corrupted or unreadable Solutions:

Try different export formats (PDF vs XLSX)
Check file download completion
Verify sufficient disk space on local device
Use different browser or download manager
Request re-generation of report

Getting Help

Self-Service Resources

Built-in Help: Contextual help tooltips and guides
User Documentation: Comprehensive online documentation
Video Tutorials: Step-by-step video guides
FAQ Section: Frequently asked questions and answers

Support Channels

Help Desk: Submit support tickets for technical issues
Email Support: Direct email to security team
Slack Channel: Real-time chat support during business hours
Phone Support: Emergency support for critical issues

Training and Onboarding

New User Training: Comprehensive onboarding program
Advanced User Training: Power user features and workflows
Administrator Training: System configuration and management
Regular Updates: Training on new features and capabilities

Best Practices for Users

Efficient Article Review

Use Filters Effectively: Set up default filters to focus on relevant content
Batch Similar Articles: Group similar articles for efficient bulk review
Add Meaningful Comments: Provide context for future reference and team members
Use Tags Consistently: Develop consistent tagging practices for better organization

Effective Searching

Start Broad, Then Narrow: Begin with general terms, then add specific filters
Use Saved Queries: Create shortcuts for frequently used searches
Leverage Natural Language: Ask questions in plain English for better results
Review Query History: Learn from successful searches and refine techniques

Report Optimization

Define Clear Objectives: Know what information you need before creating reports
Use Appropriate Timeframes: Balance comprehensiveness with relevance
Customize for Audience: Tailor reports for technical teams vs. management
Schedule Regular Reports: Automate routine reporting for consistency

Security Best Practices

Protect Credentials: Use strong passwords and enable MFA
Log Out Properly: Always log out when finished, especially on shared devices
Report Suspicious Activity: Notify administrators of any unusual system behavior
Keep Software Updated: Ensure browsers and devices have latest security updates

This user guide provides comprehensive coverage of Sentinel's capabilities and workflows. For additional support or questions not covered in this guide, please contact your system administrator or the Sentinel support team.

FilesExpand file tree

11-user-guide.md

Latest commit

History