# Home ## What is Dropzone? Dropzone's AI SOC Analyst replicates the techniques of elite analysts to autonomously investigate every security alert. We ingest alerts from tools you already have (check out all of our integrations [here](https://www.dropzone.ai/integrations)) and enrich them with context from data sources you already have, along with threat intelligence and other data sources that come with your Dropzone AI subscription. These docs will walk you through how to set up and tune your Dropzone AI SOC analyst, and then integrate Dropzone further into your workflows. Dropzone is designed to work the way that you want it to, and your Dropzone team is here to walk with you through everything along the way. Have any questions? Check out our FAQ or contact your Dropzone team today! ## Demo Dropzone Want to check out Dropzone a bit more before your purchase, or show someone new how it works without giving them access to your data? We have a few options: Sign up for our [Guided Demo](https://www.dropzone.ai/self-guided-demo), which gives a quick walkthrough of Dropzone before ending in a demo environment you can play around in. Download [COACH](https://www.dropzone.ai/coach), our free web extension that guides analysts through investigations. You'll be able to preview the workflow our AI analyst explores, like the questions posed to determine a conclusion, and it's a great tool for junior analysts on your team. # Dropzone 101 This section will give you the tools you need to get started using Dropzone. We have included a list of a few common terms and definitions that will be used throughout the documentation in the **Common Terms and Definitions** Section. The **Getting Started** section will give you a high level overview of what the platform does and how it works as well as how you can access your tenant grant users access. # Common Terms and Definitions This section will give allow you to look up common terms and definitions as it relates to Dropzone. As you utilize the platform these terms will become second nature. # Alert Sources The Dropzone platform creates Investigations based on alerts that it receives via connected customer systems, for example cloud native alerting, EDR, workforce solutions, and SIEM. Common Alert Sources include AWS GuardDuty, CrowdStrike, Microsoft Defender, and Splunk. Some typical features of alert sources: * Require API-access to your corporate systems, such as API keys, or sharing your resources with a customer-specific Dropzone service account * May have filtering to investigate only some portion of available alerts, such as only HIGH or CRITICAL * Can "backfill" alerts from before you enabled the Alert source to capture and investigate historical alerts * Dropzone can "write back" to some Alert sources, such as select ticketing systems ## Configuration Options Alert sources have a number of common configuration options: | Type | Purpose | Examples | | -------------------------- | ---------------------------------------------------------------------------------- | ----------------------------------------------------- | | API parameters and secrets | Access credentials and configuration used by Dropzone authenticate to service APIs | URL endpoints, Client IDs, Client secrets, API tokens | | Ingest filters | Select which types of events you want to investigate | High and Critical alerts only | | Ingest frequency | How often the source is polled for more actionable events | 60 seconds | Each integration documentation page will go into details about which values you'll need and how to find them.

An example Alert Source configuration with severity selector

## Backfilling Alerts When you enable an Alert Source it starts looking for new alerts immediately. You may also wish to "backfill" to pull in historical alerts for processing. On all Alert Source configuration pages, after the configuration section, you'll find "Backfill alerts":

Backfill Time Selection

Simply pick a time range you wish to pull for historical alerts and hit "Save". Instantly a new backfill progress section will appear and you can watch:

Backfill Time Complete

# Data Sources Data Sources enrich the information Dropzone uses to perform alert investigations and respond to interactive chat. Dropzone has support for many Threat Intelligence (TI) feeds, tools, and corporate systems such as identity, directory, and SIEM tools. For example when investigating possible malicious URLs or IP addresses it may query a TI source, and when understanding systems access it may first make API calls to your cloud provider to find user activity details and then query your corporate directory services to look up user metadata or login history. Common Data Sources include corporate systems such as Microsoft Entra ID and Google Workspace, Threat Intel tools such as CrowdStrike Falcon Intelligence and VirusTotal, and built in tooling such as WHOIS and PDF Analysis. {% hint style="info" %} Enabling more data sources enhances Dropzone analysis, just like more institutional knowledge improves a SOC analyst's capabilities. The Dropzone platform dynamically determines which sources may be useful for enriching investigations, so you should consider enabling as many as you can. {% endhint %} ## Configuration Options Data sources typically have a minimal number of configuration options: | Type | Purpose | Examples | | -------------------------- | ---------------------------------------------------------------------------------- | ----------------------------------------------------- | | API parameters and secrets | Access credentials and configuration used by Dropzone authenticate to service APIs | URL endpoints, Client IDs, Client secrets, API tokens | | Search filters | Limit what data will be returned | Ticket project filters | Each integration documentation page will go into details about which values you'll need and how to find them.

An example Data Source with issue filter

# Investigations **Investigations** are the core workflow in Dropzone. They represent the automated analysis of security alerts using the Dropzone AI SOC Analyst, combining alert data, contextual enrichment, and investigative reasoning into a single, reviewable case. Investigations help security teams move from raw alerts to actionable conclusions quickly and consistently, reducing manual effort while maintaining analyst oversight. *** ## What Is an Investigation? An investigation is created when Dropzone ingests a security alert from a connected alert source. The AI SOC Analyst then: * Collects relevant data from integrated tools * Enriches alerts with context and evidence * Analyzes activity using investigative logic * Produces a conclusion and supporting findings Each investigation captures the full lifecycle of this process, from alert ingestion through final review. *** ## Investigation Outcomes Every investigation results in a conclusion that reflects the AI’s assessment of the activity, such as: * **Malicious** – Confirmed threat or attack * **Suspicious** – Potentially malicious activity requiring attention * **Benign** – Legitimate or expected behavior * **Inconclusive** – Insufficient evidence to determine intent These conclusions help teams quickly understand risk and prioritize response. ## Key Investigation Components At a high level, investigations include: * **Alert context** – Details about the triggering alert * **Findings** – Key evidence and investigative insights * **Evidence** – Data pulled from integrated tools * **Conclusion** – The AI’s assessment of the activity * **Review state** – Status indicating whether the investigation has been reviewed Each component is designed to support fast understanding and informed decision-making. ## Prioritization and Workflow Investigations are organized by priority—such as **Urgent**, **Notable**, or **Informational**—to help teams focus on the most critical work first. They move through a clear workflow, from creation and analysis to review and closure, enabling scalable operations without sacrificing control. ## Why Investigations Matter Investigations are the foundation of Dropzone’s value. They: * Reduce alert fatigue by automating analysis * Provide consistent, repeatable investigative outcomes * Preserve transparency through evidence and reasoning * Enable analysts to focus on high-impact decisions By combining automation with human review, investigations allow teams to scale security operations while maintaining confidence and accountability. ## What’s Next This overview introduces what investigations are and how they fit into the platform.\ For detailed guidance, see our [Best Practices Guide for Reviewing investigations](/best-practices/deep-dive-into-investigation-reviews) # Getting Started This section will give you a high level overview of what the platform does and how it works as well as how you can access your tenant grant users access. The **What's Needed to Use Dropzone** section will give a high level overview of how dropzone works. The **Accessing Your tenants** section will show you how to connect to a tenant either with your username/password or with various SAML v2 options. The **Roles and Permissions** sections will discuss the RBAC model used in Dropzone along with information on how to add and disable users. The **Onboarding with Dropzone** page will give you an idea of what to expect in your onboarding journey with the Customer Success team. # What's Needed to Use Dropzone To get started with Dropzone, you'll need at minimum one **Alert Source** and one **Data Source**. This gives Dropzone alerts to investigate and the contextual information needed to perform thorough analysis. ## Alert Sources We recommend starting with your primary security monitoring platform, typically your: * **SIEM**, for example: * Splunk * Microsoft Sentinel * Panther * **Cloud-native security services**, for example: * AWS GuardDuty * Microsoft Defender * Google Cloud Security Command Center These serve as your “single pane of glass” for security events and provide the most comprehensive alert coverage. Dropzone also integrates with additional alert-producing tools, including: * **EDR platforms**, such as: * CrowdStrike * SentinelOne * Palo Alto Cortex XDR * **Email security tools** * **Identity platforms**, such as: * Okta * Microsoft 365 * Google Workspace * And many other security tools ## Data Sources For Data Sources, the more you enable, the more powerful Dropzone becomes. Think of it like giving a SOC analyst access to more institutional knowledge—each additional data source enhances the platform’s ability to provide context, correlate information, and make informed decisions. Dropzone supports 100+ integrations across technologies such as: * **Threat intelligence**, for example: * CrowdStrike Falcon Intelligence * VirusTotal * Hybrid Analysis * GreyNoise * PhishTank * And more * **Corporate systems**, for example: * Microsoft Entra ID * Google Workspace * Active Directory * Jira * ServiceNow * **Cloud platforms**, for example: * AWS * Azure * Google Cloud The platform intelligently determines which data sources are relevant for each investigation, so you can confidently enable as many as possible without worrying about information overload. Check out all of our integrations [here](https://www.dropzone.ai/integrations). # Accessing Your Dropzone Tenants When starting with Dropzone, we will invite you and your team members to the tenant via email with a prompt to set up a username and password. If you’d like to move to SSO/SAML, please notify your Dropzone team to assist in the transition. Note that even if your team moves to SSO, there will still be a username/password sign in option available on the log in page, but your team’s credentials will not work. ## Login Options | Method | MFA | User Management | | ---------------------- | ------------------------------------------------ | ------------------------------------------------------- | | Username/Password | Yes, via TOTP, e.g. Google Authenticator | Invite and manage users via the Dropzone UI | | Sign in with Google | Enforced at Google per your policies | Invite and manage users via the Dropzone UI | | Sign in with Microsoft | Enforced at Microsoft per your policies | Invite and manage users via the Dropzone UI | | Custom SAML provider | Enforced at your SAML provider per your policies | Manage users and roles via your Identity Provider (IDP) | # Direct Login Links/Local Auth Dropzone environments can authenticate using a username/password, or federate against Google or Microsoft providers, or against your SAML IDP. In the unauthenticated case when you visit your Dropzone URL it will send you to the login page: For federated / SAML logins, you can save clicks by bookmark a more specific URL that will log you in directly, as if you clicked the login button of your choice. Assuming your domain is https\://*mycompany*.dropzone.app you could use the following links instead. | Login Option | URL | | ----------------------------- | ---------------------------------------------------------------------------------------------- | | Log in with Google | https\://*mycompany*.dropzone.app/oidc/authenticate/?idp=google | | Log in with Microsoft | https\://*mycompany*.dropzone.app/oidc/authenticate/?idp=entra | | Log in with your SSO provider | https\://*mycompany*.dropzone.app/oidc/authenticate/?idp=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx | For the customer SSO provider case reach out to your Customer Success representative and they can get you the uuid that is associated with your corporate SSO and use that in place of the `xxxx....xxxx` placeholder above. {% hint style="warning" %} Impatient and geeky? To find this uuid from your Dropzone representative, from the login page right click on your corporate SSO login button, select "Inspect", and you'll find it as the value associated with the `data-identity-provider-id`, as seen here: ```