Docs
WebsiteLog in

Getting started

Get started

The first steps to go from an empty account to a working setup, with logs flowing, rules watching and Emma helping.

Before you start

You need a datagab account and the right to add connections in the tools you want to connect, such as an admin account in your identity provider or read access to your cloud account.

First steps

  1. Log inOpen the console and log in. You land on Dashboards.
  2. Connect your first sourceOpen Integrations from the name menu and connect your identity provider or office suite first. These logs give the most value on day one.
  3. Turn on detection rulesGo to Security › SIEM › Content Packs and turn on the packs that match your sources. Every rule in the library comes with tests.
  4. Invite your teamUnder Settings, invite colleagues and give each one a role. Roles decide what people can see and do.
  5. Choose where alerts goConnect Slack, Microsoft Teams or email so signals and approval requests reach people where they already work.
  6. Let Emma helpEmma starts investigating new signals right away. Add a daily update under Automation › Emma to get a short summary every morning.
  7. Pick a start dashboardOpen Dashboards, choose a ready-made dashboard or ask Emma to build one, and set it as your start page.

What happens next

Within minutes of connecting a source, logs appear in Observability › Logs. When a rule matches, a signal appears in Security, and Emma adds her investigation to it.

Good to know
Connecting a source only reads data. datagab does not change anything in your systems until someone approves an action.

Next steps