# UTMSTACK > UTMSTACK documentation ## Docs - [Introduction](https://docs.utmstack.com/siem/getting-started/introduction.md): UTMStack has officially released version 11.0.0, a major stable update that transforms its SIEM platform. This release introduces a redesigned architecture, stronger security, and a more intuitive … - [Community Resources](https://docs.utmstack.com/siem/getting-started/community-resources.md): Osmany Montero edited this page on Jan 19 · 2 revisions - [Architecture](https://docs.utmstack.com/siem/installation/architecture.md): UTMStack v11 introduces a revolutionary architecture designed for modern cybersecurity operations. The platform offers flexible and scalable deployment models that adapt to organizations of any siz… - [System Requirements](https://docs.utmstack.com/siem/installation/system-requirements.md): This guide outlines the hardware, software, and network requirements needed to successfully deploy UTMStack v11. - [Installation](https://docs.utmstack.com/siem/installation/installation.md): This guide provides comprehensive instructions for installing UTMStack v11 on Ubuntu 24.04 LTS using the installer script. - [ISO Install (Deprecated)](https://docs.utmstack.com/siem/installation/iso-install-deprecated.md): This ISO provides a streamlined, automated installation of UTMStack v11 Community Edition on Ubuntu 24.04.3 LTS. It applies predefined system settings and runs the UTMStack installer automatically … - [Firewall Rules](https://docs.utmstack.com/siem/installation/firewall-rules.md): Proper firewall configuration is essential for UTMStack v11 security and functionality. This guide details all required ports and provides security recommendations for different deployment scenarios. - [SSL Certificate](https://docs.utmstack.com/siem/installation/ssl-certificate.md): Secure your UTMStack v11 installation with proper SSL/TLS certificate configuration. This guide covers manual installation, automatic generation with Let's Encrypt, and certificate renewal. - [Installer Update Guide](https://docs.utmstack.com/siem/installation/installer-update-guide.md): This guide explains the procedure to recover and reinstall the UTMStack Installer using the automated recovery script provided by UTMStack. - [Architecture Overview](https://docs.utmstack.com/siem/getting-started-rules-and-filters/architecture-overview.md): The EventProcessor and UTMStack integration consists of several components working in harmony to provide a complete security monitoring solution. - [Components](https://docs.utmstack.com/siem/getting-started-rules-and-filters/components.md): The ecosystem is built on a two-tier architecture: the high-performance EventProcessor engine (managed core) and the UTMStack extension layer (open-source ecosystem). - [Standard Event Schema](https://docs.utmstack.com/siem/getting-started-rules-and-filters/standard-event-schema.md): To ensure consistency and allow rules to work across different data sources, the EventProcessor uses a standardized event schema. All filters should aim to map extracted data to these standard fields. - [Development Workflow](https://docs.utmstack.com/siem/getting-started-rules-and-filters/development-workflow.md): This guide outlines the standard process for creating and deploying new detection logic and parsing filters. - [Settings](https://docs.utmstack.com/siem/configuration-implementation/settings.md): UTMStack offers a comprehensive configuration module where administrators can adjust various settings to customize the application according to their organizational preferences. Here's a detailed b… - [Implementing Rules](https://docs.utmstack.com/siem/configuration-implementation/implementing-rules.md): This is a new page. Start editing to add your content. - [Implementing Filters](https://docs.utmstack.com/siem/configuration-implementation/implementing-filters.md): A well-designed pipeline follows these four phases: - [Best practices](https://docs.utmstack.com/siem/configuration-implementation/best-practices.md): To maintain a high-performance and reliable security monitoring environment, follow these guidelines when developing rules and filters. - [Filter Steps Reference](https://docs.utmstack.com/siem/configuration-implementation/filter-steps-reference.md): This page provides a detailed reference for all 12 transformation steps available in the EventProcessor parsing pipeline. - [CEL Overloads](https://docs.utmstack.com/siem/configuration-implementation/cel-overloads.md): The where field in rules and filters uses a customized version of the Common Expression Language (CEL). Unlike standard CEL which uses method-call syntax (e.g., field.contains()), UTMStack uses fun… - [Advanced Features](https://docs.utmstack.com/siem/configuration-implementation/advanced-features.md): Take your detection and parsing to the next level with advanced correlation and expression language features. - [Real World Examples](https://docs.utmstack.com/siem/configuration-implementation/real-world-examples.md): Practical YAML configurations for common security scenarios. - [Threat Intelligence](https://docs.utmstack.com/siem/configuration-implementation/threat-intelligence.md): The EventProcessor and UTMStack ecosystem can integrate with external systems to enrich data and streamline response workflows. - [Trubleshooting](https://docs.utmstack.com/siem/configuration-implementation/trubleshooting.md): SymptomPotential CauseSolutionRule not triggeringMismatched dataType or where logic.Check the "Log Explorer" to ensure the event has the correct type and all fields referenced in the rule.Filter no… - [Data retention](https://docs.utmstack.com/siem/configuration-implementation/data-retention.md): Defines policies for storing and managing log data in UTMStack, ensuring compliance with security regulations and optimizing storage efficiency - [Multitenancy](https://docs.utmstack.com/siem/configuration-implementation/multitenancy.md): This article explains how to set up and manage multi-tenancy in UTM Stack using either federation services or data source groups. It also covers how to apply tenant-based filtering for alerts, logs… - [Playground](https://docs.utmstack.com/siem/developer-resources/playground.md): The Playground is a command-line tool designed to test your filters and rules in an isolated environment without affecting production. It allows you to simulate log ingestion and observe how logs a… - [Tools](https://docs.utmstack.com/siem/developer-resources/tools.md): In addition to the core EventProcessor, several tools are provided to facilitate data ingestion, testing, and debugging. - [Custom Plugins](https://docs.utmstack.com/siem/developer-resources/custom-plugins.md): The EventProcessor is designed for high extensibility through a micro-plugin architecture. By implementing custom plugins, you can extend the system's capabilities in log ingestion, parsing, analys… - [Alert Management](https://docs.utmstack.com/siem/threat-management/alert-management.md): UTM Stack is powered by more than a thousand correlation rules that are updated daily. In addition, there are also threat intelligence correlation rules that are updated every hour. This section wi… - [False Positive handling](https://docs.utmstack.com/siem/threat-management/false-positive-handling.md): A freshly installed SIEM might create alerts for benign processes. Every organization is different, and certain internal, legitimate processes might be mistaken for threat activity. It's essential … - [Introduction](https://docs.utmstack.com/soar/introduction.md): UTMStack SOAR enables automated incident response by executing predefined workflows when specific alert conditions are detected. Instead of requiring manual intervention for every security event, S… - [Creating & Configuring Workflows](https://docs.utmstack.com/soar/creating-configuring-workflows.md): This guide walks through how to create, edit, and activate SOAR workflows in UTMStack. - [Built-in Action Templates](https://docs.utmstack.com/soar/built-in-action-templates.md): UTMStack ships with 73 pre-built action templates that can be used as building blocks in SOAR workflows. Each template is a reusable command that targets a specific platform and performs a specific… - [Built-in Playbooks](https://docs.utmstack.com/soar/built-in-playbooks.md): UTMStack ships with 23 pre-built SOAR playbooks that provide ready-to-use automated responses for common security threats. Each playbook is a complete workflow with a trigger condition, target plat… - [Interactive Console & Execution](https://docs.utmstack.com/soar/interactive-console-execution.md): Beyond automated workflows, UTMStack SOAR provides an Interactive Console for running commands on agents in real time, Automation Variables for storing reusable values, and an Execution Audit view … - [Custom Actions](https://docs.utmstack.com/soar/custom-actions.md): While UTMStack ships with 73 built-in action templates, you can create fully custom actions to handle scenarios unique to your environment. Custom actions let you run any shell command, call extern… - [Proxy Agents](https://docs.utmstack.com/soar/proxy-agents.md): Many devices in your network — firewalls, routers, switches, IoT appliances, and legacy systems — cannot run the UTMStack agent directly. Proxy agents solve this by allowing a machine with an insta… - [Use Cases](https://docs.utmstack.com/soar/use-cases.md): This page walks through real-world SOAR use cases with complete workflow configurations you can adapt for your environment. Each use case includes the threat scenario, trigger configuration, action… - [macOS](https://docs.utmstack.com/integrations/agents-and-syslog/macos.md) - [Windows Agent](https://docs.utmstack.com/integrations/agents-and-syslog/windows-agent.md) - [Linux Agent](https://docs.utmstack.com/integrations/agents-and-syslog/linux-agent.md) - [Syslog](https://docs.utmstack.com/integrations/agents-and-syslog/syslog.md) - [Cisco ASA](https://docs.utmstack.com/integrations/devices/cisco-asa.md) - [Fortigate](https://docs.utmstack.com/integrations/devices/fortigate.md) - [Sophos XG](https://docs.utmstack.com/integrations/devices/sophos-xg.md) - [SonicWall](https://docs.utmstack.com/integrations/devices/sonicwall.md) - [IBM AIX](https://docs.utmstack.com/integrations/devices/ibm-aix.md) - [IBM AS400](https://docs.utmstack.com/integrations/devices/ibm-as400.md) - [Fortiweb](https://docs.utmstack.com/integrations/devices/fortiweb.md) - [pfSense](https://docs.utmstack.com/integrations/devices/pfsense.md) - [Palo Alto](https://docs.utmstack.com/integrations/devices/palo-alto.md) - [Mikrotik](https://docs.utmstack.com/integrations/devices/mikrotik.md) - [Cisco Switch](https://docs.utmstack.com/integrations/devices/cisco-switch.md) - [Firepower](https://docs.utmstack.com/integrations/devices/firepower.md) - [Cisco Meraki](https://docs.utmstack.com/integrations/devices/cisco-meraki.md) - [Oracle](https://docs.utmstack.com/integrations/databases/oracle.md): sudo touch /etc/rsyslog.d/oracle-utmstack.conf - [Sophos Central](https://docs.utmstack.com/integrations/xdr/sophos-central.md) - [SentinelOne](https://docs.utmstack.com/integrations/xdr/sentinelone.md) - [CrowdStrike](https://docs.utmstack.com/integrations/xdr/crowdstrike.md): This guide describes the steps required to generate API credentials in CrowdStrike Falcon for integration with UTMStack using the Event Streams API. - [Azure](https://docs.utmstack.com/integrations/cloud/azure.md): At its core, Azure is a public cloud computing platform—with solutions including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) that can be used … - [Google Cloud](https://docs.utmstack.com/integrations/cloud/google-cloud.md): Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes a range of hosted services for compute, storage and application development that run on … - [Office365](https://docs.utmstack.com/integrations/cloud/office365.md): Microsoft 365, formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line - [AWS](https://docs.utmstack.com/integrations/cloud/aws.md): AWS Cloudwatch enables auditing, security monitoring, and operational troubleshooting by tracking user activity and API usage. CloudTrail logs, continuously monitors, and retains account activity r… - [Netflow](https://docs.utmstack.com/integrations/network/netflow.md) - [VMware ESXi](https://docs.utmstack.com/integrations/hypervisors/vmware-esxi.md) - [Config CURL](https://docs.utmstack.com/integrations/configurations/config-curl.md): You might not need to install anything: - [Understanding Vulnerability Detection](https://docs.utmstack.com/vulnerability-scanner/vulnerability-scanning/understanding-vulnerability-detection.md): The UTMStack vulnerability scanner relies on a powerful combination of industry-standard open-source tools and proprietary threat intelligence to keep your systems secure. This page explains the co… - [Performing Network Scans](https://docs.utmstack.com/vulnerability-scanner/vulnerability-scanning/performing-network-scans.md): Network vulnerability scans help you identify exposed services and externally reachable vulnerabilities on your servers, websites, and web applications. In this guide, you will learn how to run an … - [Configuring Advanced Scans and Schedules](https://docs.utmstack.com/vulnerability-scanner/vulnerability-scanning/configuring-advanced-scans.md): Learn how to configure advanced vulnerability scans using the UTMStack agent, automate your scanning schedules, and generate compliance reports. While network scans are great for external exposure,… - [Detection Use Cases and Templates](https://docs.utmstack.com/vulnerability-scanner/vulnerability-scanning/detection-use-cases-templates.md): This guide provides a reference mapping of common security use cases and misconfigurations to their corresponding detection templates. You can use these templates to quickly identify, categorize, a… - [FAQ](https://docs.utmstack.com/vulnerability-scanner/vulnerability-scanning/faq.md): UTMStack includes a built-in vulnerability scanner powered by three detection engines: Nuclei (network and general scanning), Intel's CVE Binary Tool (agent-based scanning), and a proprietary in-ho… - [Introduction](https://docs.utmstack.com/api-documentation/api-documentation/introduction.md): UTMStack SIEM and SOAR provides a REST API for programmatic access to alerts, log data, incidents, and system management. The API uses OpenSearch as its underlying search engine (API endpoints are … - [Authentication](https://docs.utmstack.com/api-documentation/api-documentation/authentication.md): UTMStack API supports authentication via API key. Include the key in the Utm-Api-Key header on every request. - [Alert Retrieval](https://docs.utmstack.com/api-documentation/api-documentation/alert-retrieval.md): Alerts are stored in the v11-alert-* index pattern. Use the search endpoint to query alerts with filters, pagination, and sorting. - [Alert Management](https://docs.utmstack.com/api-documentation/api-documentation/alert-management.md): Endpoint: POST /api/utm-alerts/status - [Log Explorer (Search & Query)](https://docs.utmstack.com/api-documentation/api-documentation/log-explorer-search-query.md): The Log Explorer allows you to search, filter, and analyze log data stored in OpenSearch indices. UTMStack organizes logs by data type into different index patterns. - [Incident Management](https://docs.utmstack.com/api-documentation/api-documentation/incident-management.md): Incidents group related alerts together for coordinated investigation and response. - [Data Sources & Agents](https://docs.utmstack.com/api-documentation/api-documentation/data-sources-agents.md): Endpoint: GET /api/utm-data-input-statuses - [Reference Tables](https://docs.utmstack.com/api-documentation/api-documentation/reference-tables.md): The FilterType object is used across all search, count, and chart-view endpoints. - [Overview](https://docs.utmstack.com/rules/overview.md): UTMStack includes a comprehensive library of 622 built-in detection rules that continuously monitor your environment for threats, suspicious activity, and policy violations. These rules are powered… - [ESMC / ESET](https://docs.utmstack.com/rules/antivirus/esmc-eset.md): Detection rules for ESMC / ESET data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Deceptive Bytes](https://docs.utmstack.com/rules/antivirus/deceptive-bytes.md): Detection rules for Deceptive Bytes data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [SentinelOne](https://docs.utmstack.com/rules/antivirus/sentinelone.md): Detection rules for SentinelOne data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Kaspersky](https://docs.utmstack.com/rules/antivirus/kaspersky.md): Detection rules for Kaspersky data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Bitdefender GravityZone](https://docs.utmstack.com/rules/antivirus/bitdefender-gravityzone.md): Detection rules for Bitdefender GravityZone data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [CrowdStrike](https://docs.utmstack.com/rules/antivirus/crowdstrike.md): Detection rules for CrowdStrike data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [ASA](https://docs.utmstack.com/rules/cisco/asa.md): Detection rules for ASA data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Switch](https://docs.utmstack.com/rules/cisco/switch.md): Detection rules for Switch data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Firepower](https://docs.utmstack.com/rules/cisco/firepower.md): Detection rules for Firepower data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Meraki](https://docs.utmstack.com/rules/cisco/meraki.md): Detection rules for Meraki data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Google Cloud](https://docs.utmstack.com/rules/cloud/google-cloud.md): Detection rules for Google Cloud data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Azure](https://docs.utmstack.com/rules/cloud/azure.md): Detection rules for Azure data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [AWS](https://docs.utmstack.com/rules/cloud/aws.md) - [FortiGate](https://docs.utmstack.com/rules/fortinet/fortigate.md): Detection rules for FortiGate data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [FortiWeb](https://docs.utmstack.com/rules/fortinet/fortiweb.md): Detection rules for FortiWeb data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Generic](https://docs.utmstack.com/rules/generic.md): Detection rules for Generic data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [AIX](https://docs.utmstack.com/rules/ibm/aix.md): Detection rules for AIX data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [AS/400](https://docs.utmstack.com/rules/ibm/as-400.md): Detection rules for AS/400 data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [JSON Input](https://docs.utmstack.com/rules/json-input.md): Detection rules for JSON Input data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [RHEL Family](https://docs.utmstack.com/rules/linux/rhel-family.md): Detection rules for RHEL Family data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Debian Family](https://docs.utmstack.com/rules/linux/debian-family.md): Detection rules for Debian Family data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [General](https://docs.utmstack.com/rules/linux/general.md): Detection rules for General data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [macOS](https://docs.utmstack.com/rules/macos.md): Detection rules for macOS data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [MikroTik](https://docs.utmstack.com/rules/mikrotik.md): Detection rules for MikroTik data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Netflow](https://docs.utmstack.com/rules/netflow.md): Detection rules for Netflow data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [NIDS / Suricata](https://docs.utmstack.com/rules/nids-suricata.md): Detection rules for NIDS / Suricata data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Palo Alto](https://docs.utmstack.com/rules/palo-alto.md): Detection rules for Palo Alto data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [pfSense](https://docs.utmstack.com/rules/pfsense.md): Detection rules for pfSense data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [SonicWall](https://docs.utmstack.com/rules/sonicwall.md): Detection rules for SonicWall data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [XG Firewall](https://docs.utmstack.com/rules/sophos/xg-firewall.md): Detection rules for XG Firewall data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Sophos Central](https://docs.utmstack.com/rules/sophos/sophos-central.md): Detection rules for Sophos Central data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Syslog / CEF](https://docs.utmstack.com/rules/syslog-cef.md): Detection rules for Syslog / CEF data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [VMware ESXi](https://docs.utmstack.com/rules/vmware-esxi.md): Detection rules for VMware ESXi data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Windows](https://docs.utmstack.com/rules/microsoft/windows.md): Detection rules for Windows data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Office 365](https://docs.utmstack.com/rules/microsoft/office-365.md) - [GitHub](https://docs.utmstack.com/rules/microsoft/github.md): Detection rules for GitHub data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects. - [Upgrading to version 11](https://docs.utmstack.com/upgrade/upgrading-to-version-11.md): This guide walks you through migrating an UTMStack V10 installation to V11. - [Installing the Federation Service](https://docs.utmstack.com/federation-service/federation-setup/installing-federation-service.md): Welcome to the Federation Service installation guide. In this tutorial, you will learn how to install the UTMStack Federation Service on your server using the command line, and how to generate the … - [Connecting Instances to Federation](https://docs.utmstack.com/federation-service/federation-setup/connecting-instances-to-federation.md): After setting up your Federation server, the next step is to link your target UTMStack instances to your centralized dashboard. This guide walks you through generating a secure API key, connecting …