Training
How much will the team need to learn?
One console to learn
Shared administration gives the team a familiar foundation across SIEM, DLP and SOAR. Training focuses on the work each role owns and the evidence needed to make a sound decision.
What each role learns
Practice following a finding back to source events, challenging an assessment and recording what remains unresolved. AI Investigation gives the reviewer a starting point to examine.
A useful case presents the evidence, assessment and open questions together. Training covers acceptance, disagreement and the decision to request more investigation.
There is one set of users, roles and updates to learn, for every product.
Engineers maintain sources, field mappings and detection rules. They also review collection health and behavioral findings, so new analysis can be evaluated alongside existing detection.
Builders mark the steps that need approval and test each SOAR playbook on sample data before it goes live.
DLP administrators set policy for each concern, from USB drives to AI tools, and choose how each rule responds.
In-product learning and languages
How teams learn each product.
In product
Each AI Detection finding shows the baseline it departed from and its evidence, so analysts learn as they work.
Languages
The console runs in many languages.
