Skip to main content
Affinity/Documentation
Español

Getting Started

  • What is Affinity
  • Sign In
  • Your First 15 Minutes
  • Navigation Map

Integrations (Admin)

  • Integration List
  • Create Integration
  • Start Ingestion
  • Secrets

Logs (Analyst)

  • Overview
  • SQL Queries
  • Search & Export
  • Analytics Mode
  • Share Queries
  • Create Rule from Logs

Alerts (Analyst)

  • List & Filters
  • Details & Management
  • Full View

Detection & Notifications (Admin)

  • Detection Rules
  • Notification Channels

Incident Response (Analyst)

  • Extract IOCs
  • Query IOCs in Logs
  • Export Results

Usage Analytics

  • Ingestion Metrics

Administration

  • User Management

Troubleshooting

  • Common Issues

Reference

  • Glossary
  • Integration Catalog
  • FAQ
  • Step-by-Step Guides

FAQ

Analyst | Administrator5 min

What it's for

Quick answers to the most common questions about Affinity.

Where do I land after sign in?

  • Security Alerts (`/alerts-view`), not Logs. It's the main screen for SOC analysts.

What is the investigation mode in Logs called?

  • It's Analytics (subtitle `Investigation`). Don't use "Hunter Mode" — that term is outdated in the in-app wiki.

What are valid alert statuses?

  • `Open`, `Investigating`, `Resolved`, `False Positive`. Don't use `In Progress`, `Closed`, or `Under Review`.

Who creates users?

  • An administrator from User Management. If you don't have access, contact support (Need access? Contact us on login).

Where do I get help?

  • This web documentation, the in-app wiki (`/wiki`) — prioritize this doc if there's a conflict — and [email protected].
Previous

Integration Catalog

Next

Step-by-Step Guides