# Dropzone AI Documentation ## Dropzone Documentation - [Home](https://docs.dropzone.ai/readme.md) - [Dropzone 101](https://docs.dropzone.ai/dropzone-101.md) - [Common Terms and Definitions](https://docs.dropzone.ai/dropzone-101/terms-and-defs.md) - [Alert Sources](https://docs.dropzone.ai/dropzone-101/terms-and-defs/alert-sources.md) - [Data Sources](https://docs.dropzone.ai/dropzone-101/terms-and-defs/data-sources.md) - [Investigations](https://docs.dropzone.ai/dropzone-101/terms-and-defs/investigations.md) - [Getting Started](https://docs.dropzone.ai/dropzone-101/getting-started.md) - [What's Needed to Use Dropzone](https://docs.dropzone.ai/dropzone-101/getting-started/whats-needed.md) - [Accessing Your Dropzone Tenants](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants.md) - [Direct Login Links/Local Auth](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/direct-login-links.md) - [Managing Users with SAML/SSO](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users.md) - [Signing in with Okta](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/okta-saml.md) - [Signing in with Google Workspace](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/google-workspace-saml.md) - [Signing in with Microsoft Entra](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/microsoft-entra-saml.md) - [Roles and Permissions](https://docs.dropzone.ai/dropzone-101/getting-started/roles-and-permissions.md) - [Onboarding with Dropzone](https://docs.dropzone.ai/dropzone-101/getting-started/onboarding.md) - [The Platform](https://docs.dropzone.ai/platform.md) - [The Dashboard](https://docs.dropzone.ai/platform/dashboard.md) - [Tenant Tree (if applicable)](https://docs.dropzone.ai/platform/tenant-tree.md) - [Fleet Dashboard (if applicable)](https://docs.dropzone.ai/platform/fleet-dashboard.md) - [Investigations](https://docs.dropzone.ai/platform/investigations.md) - [Chat](https://docs.dropzone.ai/platform/chat.md) - [Context Memory](https://docs.dropzone.ai/platform/context-memory.md) - [Settings](https://docs.dropzone.ai/platform/settings.md) - [Custom Strategies](https://docs.dropzone.ai/platform/settings/custom-strategies.md) - [AI Interviewer](https://docs.dropzone.ai/platform/settings/ai-interviewer.md) - [Response Actions and Automations](https://docs.dropzone.ai/platform/settings/response-actions.md) - [System Events](https://docs.dropzone.ai/platform/settings/system-events.md) - [System Info](https://docs.dropzone.ai/platform/settings/system-info.md) - [On-prem Support - Dropzone Connector](https://docs.dropzone.ai/platform/settings/connector.md) - [Dropzone Connector Installation](https://docs.dropzone.ai/platform/settings/connector/connector-installation.md) - [Account and Team Admin](https://docs.dropzone.ai/platform/admin.md) - [Metrics Guide](https://docs.dropzone.ai/platform/metrics-guide.md) - [Dropzone Integrations](https://docs.dropzone.ai/integrations.md) - [Alert Integrations](https://docs.dropzone.ai/integrations/alert.md) - [Amazon Web Services (AWS)](https://docs.dropzone.ai/integrations/alert/aws_alert.md) - [Cross-Account Access via CloudFormation](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-cloudformation_alert.md) - [Cross-Account Access via Console](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-console_alert.md) - [Cross-Account Access via Role Chaining](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-role-chain_alert.md) - [Cato Networks](https://docs.dropzone.ai/integrations/alert/cato-networks_alert.md) - [Check Point Harmony Email & Collaboration](https://docs.dropzone.ai/integrations/alert/checkpoint-harmony_alert.md) - [CrowdStrike](https://docs.dropzone.ai/integrations/alert/crowdstrike_alert.md) - [Datadog](https://docs.dropzone.ai/integrations/alert/datadog_alert.md) - [Elasticsearch](https://docs.dropzone.ai/integrations/alert/elasticsearch_alert.md) - [Gem](https://docs.dropzone.ai/integrations/alert/gem.md) - [Google GCP](https://docs.dropzone.ai/integrations/alert/gcp_alert.md) - [Google Security Operations](https://docs.dropzone.ai/integrations/alert/googlesecops_alert.md) - [Google Workspace](https://docs.dropzone.ai/integrations/alert/google-workspace_alert.md) - [Jira](https://docs.dropzone.ai/integrations/alert/jira_alert.md) - [Microsoft (MS 365 etc)](https://docs.dropzone.ai/integrations/alert/ms_alert.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365_alert.md) - [Microsoft Security Group](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365_email_group.md) - [Microsoft Sentinel](https://docs.dropzone.ai/integrations/alert/ms_alert/mssentinel_alert.md) - [Microsoft 365 Exchange Online Management](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365-exchange-online-management_alert.md) - [Mimecast](https://docs.dropzone.ai/integrations/alert/mimecast.md) - [Palo Alto Cortex](https://docs.dropzone.ai/integrations/alert/palo-alto-cortex_alert.md) - [Palo Alto Networks Firewall](https://docs.dropzone.ai/integrations/alert/palo-alto_alert.md) - [Panther](https://docs.dropzone.ai/integrations/alert/panther_alert.md) - [Proofpoint](https://docs.dropzone.ai/integrations/alert/proofpoint_alert.md) - [QRadar](https://docs.dropzone.ai/integrations/alert/qradar_alert.md) - [Rapid7 Insight IDR](https://docs.dropzone.ai/integrations/alert/rapid7-insight-idr_alert.md) - [SentinelOne](https://docs.dropzone.ai/integrations/alert/sentinelone_alert.md) - [ServiceNow](https://docs.dropzone.ai/integrations/alert/servicenow.md) - [Splunk](https://docs.dropzone.ai/integrations/alert/splunk_alert.md) - [Stellar Cyber](https://docs.dropzone.ai/integrations/alert/stellarcyber_alert.md) - [Sumo Logic](https://docs.dropzone.ai/integrations/alert/sumo-logic_alert.md) - [Vectra AI](https://docs.dropzone.ai/integrations/alert/vectra-ai_alert.md) - [Wiz](https://docs.dropzone.ai/integrations/alert/wiz_alert.md) - [ZScaler (Beta)](https://docs.dropzone.ai/integrations/alert/zscaler_alert.md) - [Communicators](https://docs.dropzone.ai/integrations/communicator.md) - [Microsoft Teams](https://docs.dropzone.ai/integrations/communicator/msteams.md) - [Slack Communicator](https://docs.dropzone.ai/integrations/communicator/slack.md) - [Data Source Integrations](https://docs.dropzone.ai/integrations/data.md) - [AbuseIPDB](https://docs.dropzone.ai/integrations/data/abuseipdb.md) - [Active Directory (LDAP)](https://docs.dropzone.ai/integrations/data/active-directory-ldap.md) - [Archive Inspector](https://docs.dropzone.ai/integrations/data/archive-inspector.md) - [Amazon Web Services (AWS)](https://docs.dropzone.ai/integrations/data/aws_data.md) - [Cross-Account Access via CloudFormation](https://docs.dropzone.ai/integrations/data/aws_data/aws-cloudformation_data.md) - [Cross-Account Access via Console](https://docs.dropzone.ai/integrations/data/aws_data/aws-console_data.md) - [Cross-Account Access via Role Chaining](https://docs.dropzone.ai/integrations/data/aws_data/aws-role-chain_data.md) - [ANY.RUN](https://docs.dropzone.ai/integrations/data/anyrun.md) - [Blocklist.de](https://docs.dropzone.ai/integrations/data/blocklist-de.md) - [CAPA](https://docs.dropzone.ai/integrations/data/capa.md) - [Cato Networks](https://docs.dropzone.ai/integrations/data/cato-networks_data.md) - [Censys](https://docs.dropzone.ai/integrations/data/censys.md) - [CrowdStrike](https://docs.dropzone.ai/integrations/data/crowdstrike_data.md) - [Crowdstrike Falcon Intelligence](https://docs.dropzone.ai/integrations/data/pangea.md) - [Datadog](https://docs.dropzone.ai/integrations/data/datadog_data.md) - [DNSResolver](https://docs.dropzone.ai/integrations/data/dnsresolver.md) - [Dropzone Security Knowledge Base](https://docs.dropzone.ai/integrations/data/dzsecknowledgebase.md) - [Dropzone URL Sandbox](https://docs.dropzone.ai/integrations/data/dzurlsandbox.md) - [Elasticsearch](https://docs.dropzone.ai/integrations/data/elasticsearch_data.md) - [File](https://docs.dropzone.ai/integrations/data/file.md) - [Google GCP](https://docs.dropzone.ai/integrations/data/gcp_data.md) - [Google Security Operations](https://docs.dropzone.ai/integrations/data/googlesecops_data.md) - [Google Workspace](https://docs.dropzone.ai/integrations/data/google-workspace_data.md) - [GreyNoise](https://docs.dropzone.ai/integrations/data/greynoise.md) - [Host.io](https://docs.dropzone.ai/integrations/data/host-io.md) - [Hybrid Analysis](https://docs.dropzone.ai/integrations/data/hybrid-analysis.md) - [IPInfo.io](https://docs.dropzone.ai/integrations/data/ipinfo-io.md) - [IPQualityScore](https://docs.dropzone.ai/integrations/data/ipqualityscore.md) - [Jira](https://docs.dropzone.ai/integrations/data/jira_data.md) - [MalwareBazaar](https://docs.dropzone.ai/integrations/data/malwarebazaar.md) - [Microsoft (MS 365 etc)](https://docs.dropzone.ai/integrations/data/ms_data.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/data/ms_data/ms365_data.md) - [Microsoft Azure](https://docs.dropzone.ai/integrations/data/ms_data/azure_data.md) - [Azure Data Explorer](https://docs.dropzone.ai/integrations/data/ms_data/azure-data-explorer.md) - [Microsoft Sentinel](https://docs.dropzone.ai/integrations/data/ms_data/mssentinel_data.md) - [Microsoft 365 Exchange Online Management](https://docs.dropzone.ai/integrations/data/ms_data/ms365-exchange-online-management_data.md) - [Nuclei](https://docs.dropzone.ai/integrations/data/nuclei.md) - [NVD](https://docs.dropzone.ai/integrations/data/nvd.md) - [Okta](https://docs.dropzone.ai/integrations/data/okta.md) - [oletools](https://docs.dropzone.ai/integrations/data/oletools.md) - [OpenSourceMalware](https://docs.dropzone.ai/integrations/data/opensourcemalware.md) - [OpenSSL Sign Code](https://docs.dropzone.ai/integrations/data/openssl-sign-code.md) - [Palo Alto Cortex](https://docs.dropzone.ai/integrations/data/palo-alto-cortex_data.md) - [Palo Alto Networks Firewall](https://docs.dropzone.ai/integrations/data/palo-alto_data.md) - [Panther](https://docs.dropzone.ai/integrations/data/panther_data.md) - [PDF Analysis](https://docs.dropzone.ai/integrations/data/pdf-analysis.md) - [People Data Labs](https://docs.dropzone.ai/integrations/data/people-data-labs.md) - [Perplexity AI](https://docs.dropzone.ai/integrations/data/perplexity-ai.md) - [PhishTank](https://docs.dropzone.ai/integrations/data/phishtank.md) - [QRadar](https://docs.dropzone.ai/integrations/data/qradar_data.md) - [Rapid7 Insight IDR](https://docs.dropzone.ai/integrations/data/rapid7-insight-idr_data.md) - [ReversingLabs](https://docs.dropzone.ai/integrations/data/reversinglabs.md) - [SentinelOne](https://docs.dropzone.ai/integrations/data/sentinelone_data.md) - [ServiceNow](https://docs.dropzone.ai/integrations/data/servicenow_data.md) - [Shodan](https://docs.dropzone.ai/integrations/data/shodan.md) - [Splunk](https://docs.dropzone.ai/integrations/data/splunk_data.md) - [Stellar Cyber](https://docs.dropzone.ai/integrations/data/stellarcyber_data.md) - [Sumo Logic](https://docs.dropzone.ai/integrations/data/sumo-logic_data.md) - [TShark](https://docs.dropzone.ai/integrations/data/tshark.md) - [UnshortenMe](https://docs.dropzone.ai/integrations/data/unshortenme.md) - [URLhaus](https://docs.dropzone.ai/integrations/data/urlhaus.md) - [Urlscan.io](https://docs.dropzone.ai/integrations/data/urlscan-io.md) - [Vectra AI](https://docs.dropzone.ai/integrations/data/vectra-ai_data.md) - [VirusTotal](https://docs.dropzone.ai/integrations/data/virustotal.md) - [Vision](https://docs.dropzone.ai/integrations/data/vision.md) - [VulnCheck](https://docs.dropzone.ai/integrations/data/vulncheck.md) - [WHOIS](https://docs.dropzone.ai/integrations/data/whois.md) - [Wiz](https://docs.dropzone.ai/integrations/data/wiz_data.md) - [YARAify](https://docs.dropzone.ai/integrations/data/yaraify.md) - [ZScaler (Beta)](https://docs.dropzone.ai/integrations/data/zscaler_data.md) - [Remediator Integrations](https://docs.dropzone.ai/integrations/remediator.md) - [Crowdstrike](https://docs.dropzone.ai/integrations/remediator/crowdstrike_remediator.md) - [Google Workspace](https://docs.dropzone.ai/integrations/remediator/google-workspace_remediator.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/remediator/ms365_remediator.md) - [Okta](https://docs.dropzone.ai/integrations/remediator/okta_remediator.md) - [Other Tools](https://docs.dropzone.ai/integrations/tools.md) - [Slack Chatops](https://docs.dropzone.ai/integrations/tools/slack-chatops.md) - [API](https://docs.dropzone.ai/api.md) - [Context Memory](https://docs.dropzone.ai/api/context-memory.md) - [Custom Strategies](https://docs.dropzone.ai/api/custom-strategies.md) - [Email](https://docs.dropzone.ai/api/email.md) - [Investigation](https://docs.dropzone.ai/api/investigation.md) - [Investigation Bulk Feedback](https://docs.dropzone.ai/api/investigation-bulk-feedback.md) - [Investigation User Notes](https://docs.dropzone.ai/api/investigation-user-notes.md) - [Ping](https://docs.dropzone.ai/api/ping.md) - [Response Actions](https://docs.dropzone.ai/api/response-actions.md) - [System Events](https://docs.dropzone.ai/api/system-events.md) - [Models](https://docs.dropzone.ai/api/models.md) - [FAQ](https://docs.dropzone.ai/faq.md) - [Multi-Tenancy Options](https://docs.dropzone.ai/faq/multi-tenancy-options.md) - [Email Ingestion Option](https://docs.dropzone.ai/faq/email-ingestion-options.md) - [Guided Demo FAQ](https://docs.dropzone.ai/faq/guided-demo.md) - [Monitoring Dropzone](https://docs.dropzone.ai/faq/monitoring-dropzone.md) - [Best Practices](https://docs.dropzone.ai/best-practices.md) - [Context Memory](https://docs.dropzone.ai/best-practices/context-memory.md) - [Building Response Automations and Actions](https://docs.dropzone.ai/best-practices/how-to-build-response-automations-and-actions.md) - [Investigation Reviews Deep Dive](https://docs.dropzone.ai/best-practices/deep-dive-into-investigation-reviews.md) - [Utilizing the Dropzone AI Chatbot](https://docs.dropzone.ai/best-practices/utilizing-the-dropzone-ai-chatbot.md) - [Custom Strategies](https://docs.dropzone.ai/best-practices/custom-strategies.md) - [How to Create a Custom Strategy](https://docs.dropzone.ai/best-practices/custom-strategies/how-to-create-custom-strategy.md) - [Analysis Guidance Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/analysis-guidance-quick-setup-guide.md) - [Investigation Questions Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/investigation-questions-quick-setup-guide.md) - [Priority Rules Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/priority-rules-quick-setup-guide.md) - [Release Notes](https://docs.dropzone.ai/release-summary.md) - [2026](https://docs.dropzone.ai/release-summary/2026.md) - [March](https://docs.dropzone.ai/release-summary/2026/release-202603-summary.md) - [February](https://docs.dropzone.ai/release-summary/2026/release-202602-summary.md) - [January](https://docs.dropzone.ai/release-summary/2026/release-202601-summary.md) - [Unlinked](https://docs.dropzone.ai/unlinked.md) - [Google Drive Collaboration](https://docs.dropzone.ai/unlinked/google-drive-collaboration.md) - [Cribl](https://docs.dropzone.ai/unlinked/cribl.md) - [Exabeam](https://docs.dropzone.ai/unlinked/exabeam.md) - [RocketCyber](https://docs.dropzone.ai/unlinked/rocketcyber_alert.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on a page URL with the `ask` query parameter: ``` GET https://docs.dropzone.ai/readme.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.