Documents.
The Documents tab lets you upload any documentation relevant to an Organization's threat profile. The agent commits each document to memory and draws on it whenever it evaluates new Events or writes an analysis, which is the fastest way to give the agent the context it needs to tailor reporting. See Seed Organization documents for the upload flow.
What you can upload
Upload anything that helps the agent understand the Organization, such as:
- Corporate identity documents.
- A list of physical store locations.
- A risk register.
- A network topology map.
- Lists of Assets, software, or Suppliers.
When you upload a document, the agent commits its content to memory and considers it whenever it evaluates new Events or runs a fresh analysis for that Organization.
Extracting Assets and Suppliers
When a document contains Assets or Suppliers, the agent extracts them and asks you to confirm the entities it found. Once you confirm, it creates them and tracks them from that point on. Uploading a document is the easiest way to populate your Asset and Supplier lists, since you are not limited to plain lists and can drop in spreadsheets or richer documents instead.
Uploading a document is faster than adding Assets and Suppliers one by one, and lets you bring in context that no list captures, like prior threat profiles or corporate identity documents.
Frequently asked questions
What kind of documents should I upload?
Anything relevant to the threat profile: corporate identity documents, store-location lists, a risk register, a network topology map, or lists of assets, software, and suppliers.
What happens when a document contains Assets or Suppliers?
The agent extracts them and asks you to confirm the entities it found, then creates them and tracks them from that point on.