Operate your security platform with confidence.
A practical guide to DEFENSOR.in — learn how to monitor Linux infrastructure, investigate threats, analyze evidence, review security posture and execute controlled response workflows.
Getting Started
After signing in, select your protected server and begin from the Dashboard. The following sequence provides a practical starting point for security operations.
Security Dashboard
The DEFENSOR.in Dashboard provides a centralized overview of system health, security state, scan activity and recommended actions.
System Health
CPU, memory, disk, swap, load and uptime.
Threat State
Security findings and process behaviour context.
Latest Scans
Audit, vulnerability and malware scan status.
Suggested Actions
Security recommendations requiring attention.
Use it when: Starting a daily security review or checking the overall state of a server.
Global Attack Map
Visualize detected attack activity and geographic source information associated with security events.
Attack Locations
Geographic representation of mapped attack sources.
Attack Activity
Review detected attempts within the selected time range.
Incident Context
Connect attack activity with incident and response information.
Use it when: You need a visual overview of external attack activity before examining individual events.
Security Incidents
Investigate correlated security events with severity, evidence, MITRE ATT&CK context and response workflows.
Severity
Prioritize incidents based on their recorded security severity.
Categories
Organize incidents by security event and attack category.
Response Workflows
Connect incidents with approved response playbooks.
Use it when: An alert requires investigation, documentation or an authorized response.
Review the available evidence before approving any disruptive or destructive response action.
Threat Intelligence
Review indicators of compromise and determine whether known indicators appear in security activity.
Active IOCs
Review enabled indicators used for threat detection.
Server Matches
Identify indicators observed in server activity.
Filtering
Search and narrow indicators using available attributes.
Use it when: Checking whether known malicious indicators have appeared in your environment.
Security Logs
Review security-related events collected from protected Linux infrastructure.
Security logs provide the raw event context behind detections and incidents, including authentication activity, network events and other monitored security signals.
Network Monitoring
Monitor interface activity, bandwidth, latency, packet loss and active network connections.
Upload / Download
Review current traffic and transferred data.
Latency & Packet Loss
Observe network response and delivery stability.
Connections
Review established connections and listening sockets.
Use it when: Investigating connectivity problems, unusual traffic or network behaviour.
Digital Forensics & Attack Provenance
Use the forensic workspace to investigate processes, network activity, file activity and evidence associated with security events.
Timeline Events
Connect incidents, evidence, threats and response activity.
Process Investigation
Review process identity, parent chains and related activity.
File Investigation
Review file metadata, activity and SHA-256 evidence.
Use it when: You need deeper context around a suspicious process, file or security event.
Audit Log
Review system audit information and security-oriented configuration checks.
Use it when: Performing a baseline review or examining system security posture.
Vulnerability Scan
Review known vulnerabilities associated with installed software and packages.
Use it when: Checking whether installed software requires security updates or remediation.
Malware & Virus Scan
Review malware detection results and investigate suspicious files or processes.
Detection
Review files, processes or scripts flagged by security scanners.
False-Positive Handling
Review previous false-positive decisions where applicable.
Evidence
Use available scanner and hash information during investigation.
Use it when: You suspect a malicious file or need to review malware scan findings.
Active Response
Review suspicious processes and services and use controlled response actions when an event has been confirmed.
Focused Threat View
Concentrate on processes identified as requiring security attention.
Process Validation
Response workflows can validate current process identity before action.
Controlled Response
Response actions are separated from passive forensic investigation.
Use it when: A suspicious process has been sufficiently investigated and an authorized response is required.
SOAR Console
Manage security playbooks, approval workflows and response execution tracking.
Playbook Executions
Track response playbook activity and execution history.
Execution Status
Review approval, running, success and failure states.
Approval Control
High-risk workflows can require explicit approval.
Use it when: A security incident has a defined response workflow that needs approval or execution tracking.
Resource Usage
Monitor CPU, memory, disk, swap, load and uptime to understand server resource usage.
Use it when: A server is slow, a security scan is consuming resources, or capacity planning requires historical information.
CPU: 0.5% | Memory: 26.1% | Disk: 77.5%
Frequently Asked Questions
What should I check first every day?
Do I need to open every security module?
When should I use SOAR?
Why can a security page appear empty?
Ready to secure your Linux infrastructure?
Start using DEFENSOR.in for centralized Linux security monitoring, threat detection, investigation and controlled response.
Start 7-Day Free Trial