Table of Contents

• Overview
  • What?
  • Why?
  • Goals
  • Architecture
  • Status
  • Roadmap
• Introduction
  • Concept of operations
• Demo Instance
• Installation
  • Build and run MozDef
  • Run tests
  • Manual Installation for Yum or Apt based distros
  • Web and Workers nodes
• Alert Development Guide
  • Starting a feature branch
  • How to start developing your new alert
  • How to run tests on your alert
  • Background on concepts
  • Example first alert
  • Scheduling your alert
  • How to run the alert in the docker containers
  • How to get the alert in a release of MozDef?
  • Customizing the alert summary
  • Questions?
  • Resources
• Mozdef_util Library
  • Connecting to Elasticsearch
  • Creating/Updating Documents
  • Searching for documents
  • Match/Query Classes
• Screenshots
  • Health and Status
  • Alerts
  • Incident Handling
  • d3 visualizations
  • Geo location of Attackers
  • 3D interactive Attacker visualization
  • 3D interactive Attack visualization via Landmass
• Usage
  • Web Interface
  • Sending logs to MozDef
  • JSON format
  • Simple test
  • Writing alerts
• MozDef for AWS
  • Feedback
  • Dependencies
  • Supported Regions
  • Architecture
  • Deployment Process
  • Troubleshooting
  • Using MozDef
  • AWS re:invent 2018 SEC403 Presentation
• Advanced Settings
  • Conf files
• Code
  • Plugins
• Benchmarking
  • Elasticsearch
• Continuous Integration and Continuous Deployment
  • Overview
  • Travis CI
  • AWS CodeBuild
• Contributors

Indices and tables

• Index
• Module Index
• Search Page

License

Mozilla Public License Version 2.0

Contact

• mozdef INSERTAT mozilla.com
• #mozdef