matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
https://matano.dev
Apache License 2.0
1.46k stars 100 forks source link

User guide for querying data #72

Open timoguin opened 1 year ago

timoguin commented 1 year ago

Add a basic user guide showing how to run queries.

Considerations

I'm not sure if we should have a top-level guide (perhaps below the "Tables" section), or if we should have some examples included for each type of managed log source.

Without a robust UI to poke around with, many users will stall at this step. Some example queries for common use cases would be helpful to ensure users get quick feedback.

These can eventually be made into a collection of views, UDFs, prepared statements, etc. Later we could allow defining custom ones as part of the Matano config.

References