Getting started full revamp by alexane-bougeardbebin-sekoia · Pull Request #3088 · SEKOIA-IO/documentation

alexane-bougeardbebin-sekoia · 2026-06-26T14:40:25Z

No description provided.

Updated the documentation to reflect the new name and features of the Roy AI assistant, including its capabilities and usage instructions.

Corrected the link for event drop notifications in best practices.

Added workspace mode scope details and updated triggers.

Added webhook payload reference and example to documentation.

Added information on finding incoming webhook URLs for Slack, Microsoft Teams, and Mattermost.

Added instructions for generating a HAR file and troubleshooting steps for WebSocket connectivity issues.

Added a note about legacy role names and their descriptions for users maintaining older scripts or using the Sekoia API directly.

Added access information for different user roles regarding subscriptions.

Removed duplicate 'FAQ and troubleshooting' entry.

Updated the notification creation instructions to reflect changes in terminology and structure.

Updated markdown links and improved clarity in instructions for triaging alerts.

Updated links in glossary to include '.md' extension for consistency.

Updated links in the getting started documentation to include the .md extension for consistency.

Updated user invitation steps and related links for clarity.

Updated links in the login guide to include file extensions.

Updated links to use .md extension for consistency.

Updated link to roles and permissions documentation.

Updated links in the secure your account documentation to include the .md extension.

Removed markdown link from note about 2FA deployment.

github-actions · 2026-07-03T15:47:37Z

Newest code from alexane-bougeardbebin-sekoia has been published to preview environment

🚀 Latest deployment was built on 2026-07-03 15:47:36 (f442e6e489d058cc179418927f9f0e685cd4c9f2).

TomLecSek

The theme is really black&white 😅 . Intended i suppose but i think changing the color for titles and subtitles will improve the readibility of pages by identifying sections visually.

Review to continued...

TomLecSek · 2026-07-06T08:35:19Z

+| Step | What to do |
+|---|---|
+| 1 | [Understand the platform](/getting_started/what_is_sekoia.md) — Learn what Sekoia is and how its products work together. |
+| 2 | [Set up your account](/getting_started/log_in_for_the_first_time.md) — Log in, secure your account, and customize your interface. |


Just a feedback. When i clicked on the link "Understand the platform", i arrive on the page with the main title "What is Sekoia". And for a second i wondered if it was the correct page. I saw the second title "The Sekoia platform" and i knew i was on the proper page. But the transition was a bit confusing.

TomLecSek · 2026-07-06T08:56:56Z

+
+## Related links
+
+- [What is Sekoia](/getting_started/what_is_sekoia.md) — Overview of the Sekoia AI SOC platform and its product suite.


Really necessary ? as this link has already 3 references above ?

TomLecSek · 2026-07-06T08:58:35Z

+| [Quick start: Reveal](/getting_started/quick_start_reveal.md) | Asset intelligence setup |
+| [Get help](/getting_started/support_and_resources.md) | Support portal, Academy, community, troubleshooting |
+
+## Your onboarding journey


At the end, it's the same as the previous section minus links and with other words. A bit redundant no ?

TomLecSek · 2026-07-06T09:02:11Z

+
+### Sekoia Defend
+
+Sekoia Defend is the extended detection and response (XDR) product. It collects logs from your entire environment, applies a continuously updated catalog of over 1,000 detection rules mapped to the MITRE ATT&CK framework, and gives you the tools to investigate alerts and automate responses.


XDR should have an entry in Glossary imo.

TomLecSek · 2026-07-06T09:03:42Z

+
+# What is Sekoia
+
+Sekoia is an AI-powered Security Operations Center (SOC) platform that brings together detection, threat intelligence, and automated response in a single, integrated solution. It is designed to help security teams of all sizes detect threats faster, investigate with more context, and respond with less manual effort.


Enhancement suggestion:

I would be nice to have an automated link between words and their anchor in the Glossary.
I'm sure mkdocs does that somehow (with a plugin maybe ?)

https://mkdocstrings.github.io/autorefs/

TomLecSek · 2026-07-06T09:12:32Z

+
+Roy does not retain query history or personal data between sessions.
+
+## What you can do in your first session


No links to appropriate pages ?

there are below in related links, i think they'll be better in this section.

pbivic · 2026-07-06T09:53:56Z

+
+**What to do:**
+
+1. Verify your region URL with your administrator. Each Sekoia region has a different app URL (see [Log in for the first time](/getting_started/log_in_for_the_first_time.md) for the full table).


The URL will be specific to their community if they are using SSO

pbivic · 2026-07-06T09:57:10Z

+2. Try accessing the URL directly in your browser instead of using a saved bookmark.
+3. Check that your network does not block access to `*.sekoia.io`.
+
+### Your password does not work


A note with the following may be nice
If a user has never accessed their account before, they must first use the invitation link sent by email to activate it. Attempting to reset the password using the “Forgot password” option will not work until the account has been activated through this initial invitation link.
Password reset is not available for users who log in using Single Sign-On (SSO).

pbivic · 2026-07-06T10:00:12Z

+!!! tips "HAR archive step"
+   If the net-export log file does not provide enough detail, generate a HAR (HTTP Archive) file to capture the full request and response trace:
+
+   1. Open Chrome DevTools (F12) and select the **Network** tab.


I would personally prefer to directly redirect them to external documentation to gnerate an HAR as it is not specifically related to sekoia

pbivic · 2026-07-06T10:01:00Z

+   5. Attach the `.har` file to your support ticket.
+
+!!! note "Other browsers"
+    If you are not using Chrome, contact [support.sekoia.com](https://support.sekoia.com) and describe your browser. The support team will guide you through the equivalent steps.


same than my last note. It would be nice to avoid that thy contact us just to learn how to generate an HAR

pbivic · 2026-07-06T10:07:49Z

+
+### Your intake shows a high rate of warning or invalid events
+
+**What to do:**


Please make sure that your log is correctly formatted. You can check this by looking at the "raw event" section for the relevant intake in our documentation. If the log format is different from what we expect (for example, an unknown header or an unexpected structure), the log is considered malformed. In this case, you should review the entire ingestion chain and the configuration of the third-party application sending the log. If the log is well formed but we do not extract fields relevant to detection, please contact the support team and provide a copy of the raw event.

pbivic · 2026-07-06T10:09:11Z

+
+| Intake type | Check |
+|---|---|
+| **Push** | Verify the intake key is correctly deployed in your data source configuration. Confirm your firewall permits outbound connections to the Sekoia intake endpoint for your region. |


Mayb it would be relevant to have a link to the troubleshoot section of the forwarder in case they use the sekoia io forwarder

Corentincoutable · 2026-07-06T14:46:51Z

I would suggest to re-word it as follow :
"In multi-tenant workspaces, a "Communities" button appears in the breadcrumb at the top of the page. Use it to filter the platform based on a specific community or select multiple communities to view aggregated data for all of them."

I would suggest to re-word it as follow :
"If you are not sure whether a setting belongs to the workspace or the community, check the Settings menu. Workspace-level settings appear at the top of the listing (Workspace label), and community-level settings appear just bellow it (Communities you manage label)."

And here is the specified screenshot :

I would suggest to re-word it as follow :
"To filter on a specific community in a multi-tenant workspace, click the Communities button in the breadcrumb at the top of one page and select the community (or communities) you want to access."

alexane-bougeardbebin-sekoia added 30 commits June 26, 2026 16:40

Add files via upload

9e0865f

delete outdated articles

cabce21

Revise documentation for Roy AI assistant

f9a6840

Updated the documentation to reflect the new name and features of the Roy AI assistant, including its capabilities and usage instructions.

Fix link for event drop notifications in best practices

8dbbc9d

Corrected the link for event drop notifications in best practices.

Revise navigation structure in mkdocs.yml

82e460e

Enhance notification system overview with workspace modes

d4824f0

Added workspace mode scope details and updated triggers.

Enhance notification examples with webhook details

e941c8d

Added webhook payload reference and example to documentation.

Update notification creation documentation

5ec0349

Added information on finding incoming webhook URLs for Slack, Microsoft Teams, and Mattermost.

Add files via upload

f9c82b3

Enhance troubleshooting guide with HAR file instructions

ac722b9

Added instructions for generating a HAR file and troubleshooting steps for WebSocket connectivity issues.

Document legacy role names and their descriptions

6368f6b

Added a note about legacy role names and their descriptions for users maintaining older scripts or using the Sekoia API directly.

Document user role access for subscriptions

4e32d20

Added access information for different user roles regarding subscriptions.

Fix duplicate entry in mkdocs.yml

6e72b1a

Removed duplicate 'FAQ and troubleshooting' entry.

Add files via upload

927de2c

Revise notification creation steps and terminology

0c01876

Updated the notification creation instructions to reflect changes in terminology and structure.

Add files via upload

67bcb74

Update customize_your_interface.md

55b5bed

Update links and headings in getting started guide

35b9e5d

Update links and section titles in documentation

069a173

Update defend_step3_activate_detection_rules.md

746f152

Fix markdown links and enhance alert triage instructions

883ed94

Updated markdown links and improved clarity in instructions for triaging alerts.

Update defend_step5_automate_with_playbooks.md

0b8ca57

Add .md extension to glossary links

5760970

Updated links in glossary to include '.md' extension for consistency.

Update index.md

22f8fcc

Fix links in intelligence_step1_explore_threat_database

42c34e6

Updated links in the getting started documentation to include the .md extension for consistency.

Update links and navigation in threat reports guide

6399f9f

Revise user invitation instructions and links

41316eb

Updated user invitation steps and related links for clarity.

Fix links in log in guide to include .md extensions

31f6f3a

Updated links in the login guide to include file extensions.

Update manage_api_keys.md

08b0775

Fix markdown links in manage_notifications.md

6725135

Updated links to use .md extension for consistency.

alexane-bougeardbebin-sekoia added 21 commits July 3, 2026 14:50

Fix image path in notification creation documentation

64d7092

Update image path for drag and drop screenshot

761643a

Update customize_your_interface.md

5fdd2bd

Update link format for best practices reference

3e4a248

Update defend_step3_activate_detection_rules.md

89c2be1

Update defend_step5_automate_with_playbooks.md

4ce47c3

Fix link format in invite_users.md

a4d7c9f

Updated link to roles and permissions documentation.

Update links in navigate_the_platform.md to include .md

167cbb8

Update quick_start_elevate.md

0578879

Update links in quick start guide for consistency

3e3d656

Update links in quick_start_reveal.md to include .md

13fab50

Update links in roles and permissions documentation

bef3670

Fix markdown links in secure your account guide

68f8b8c

Updated links in the secure your account documentation to include the .md extension.

Fix link to notifications examples in best practices

64aef44

Update quick_start_elevate.md

d166c6d

Update quick_start_reveal.md

6d08556

Update support_and_resources.md

4e17d65

Update note on 2FA configuration for users

ae53819

Removed markdown link from note about 2FA deployment.

Update intakes.md

a89cae5

Delete docs/getting_started/navigation.md

ac78899

Update mkdocs.yml

6b34f0f

TomLecSek reviewed Jul 6, 2026

View reviewed changes

pbivic reviewed Jul 6, 2026

View reviewed changes


		## Related links

		- [What is Sekoia](/getting_started/what_is_sekoia.md) — Overview of the Sekoia AI SOC platform and its product suite.


		### Sekoia Defend

		Sekoia Defend is the extended detection and response (XDR) product. It collects logs from your entire environment, applies a continuously updated catalog of over 1,000 detection rules mapped to the MITRE ATT&CK framework, and gives you the tools to investigate alerts and automate responses.


		# What is Sekoia

		Sekoia is an AI-powered Security Operations Center (SOC) platform that brings together detection, threat intelligence, and automated response in a single, integrated solution. It is designed to help security teams of all sizes detect threats faster, investigate with more context, and respond with less manual effort.


		Roy does not retain query history or personal data between sessions.

		## What you can do in your first session


		What to do:

		1. Verify your region URL with your administrator. Each Sekoia region has a different app URL (see [Log in for the first time](/getting_started/log_in_for_the_first_time.md) for the full table).


		### Your intake shows a high rate of warning or invalid events

		What to do:

Uh oh!

Conversation

alexane-bougeardbebin-sekoia commented Jun 26, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

TomLecSek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Corentincoutable commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants