ThreatLens Core Quickstart
From zero to your first AI-augmented investigation.
The Goal
By the end of this guide, you will have:
- Connect 1 SIEM & 1 EDR.
- Ingest live alerts.
- Generate your first Analyst-Grade Summary.
Prerequisites
You need Admin access to ThreatLens Core and API credentials for at least one SIEM (Splunk/Sentinel) and one EDR (CrowdStrike/Defender).
The Step-by-Step Walkthrough
Create Workspace
Set up your ThreatLens Core environment.
Action:
- • Create Tenant (e.g.,
Acme-Prod) - • Set Timezone
- • Enable Audit Logs
Connect SIEM
Connect your primary data source for alerts.
Action:
Navigate to Integrations > SIEM. Enter your API credentials.
Connect EDR
Add endpoint detection for context enrichment.
Action:
Navigate to Integrations > EDR. Test Connection.
Enable Intel
Activate threat intelligence for enrichment.
Action:
Enable Google TI or Microsoft TI.
Run First Investigation
THE "AHA" MOMENTExperience the power of AI-augmented analysis.
Action:
Open an alert → Click Analyze.
Result:
ThreatLens extracts entities, correlates signals, and maps to MITRE ATT&CK.
Validation Checklist
Confirm each milestone to complete your setup: