# Dropzone AI Documentation ## Dropzone Documentation - [Home](https://docs.dropzone.ai/readme.md) - [Dropzone 101](https://docs.dropzone.ai/dropzone-101.md) - [Common Terms and Definitions](https://docs.dropzone.ai/dropzone-101/terms-and-defs.md) - [Alert Sources](https://docs.dropzone.ai/dropzone-101/terms-and-defs/alert-sources.md) - [Data Sources](https://docs.dropzone.ai/dropzone-101/terms-and-defs/data-sources.md) - [Investigations](https://docs.dropzone.ai/dropzone-101/terms-and-defs/investigations.md) - [Getting Started](https://docs.dropzone.ai/dropzone-101/getting-started.md) - [What's Needed to Use Dropzone](https://docs.dropzone.ai/dropzone-101/getting-started/whats-needed.md) - [Accessing Your Dropzone Tenants](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants.md) - [Direct Login Links/Local Auth](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/direct-login-links.md) - [Managing Users with SAML/SSO](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users.md) - [Signing in with Okta](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/okta-saml.md) - [Signing in with Google Workspace](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/google-workspace-saml.md) - [Signing in with Microsoft Entra](https://docs.dropzone.ai/dropzone-101/getting-started/accessing-tenants/managing-users/microsoft-entra-saml.md) - [Roles and Permissions](https://docs.dropzone.ai/dropzone-101/getting-started/roles-and-permissions.md) - [Onboarding with Dropzone](https://docs.dropzone.ai/dropzone-101/getting-started/onboarding.md) - [The Platform](https://docs.dropzone.ai/platform.md) - [The Dashboard](https://docs.dropzone.ai/platform/dashboard.md) - [Tenant Tree (if applicable)](https://docs.dropzone.ai/platform/tenant-tree.md) - [Fleet Dashboard (if applicable)](https://docs.dropzone.ai/platform/fleet-dashboard.md) - [Investigations](https://docs.dropzone.ai/platform/investigations.md) - [Chat (Dropline)](https://docs.dropzone.ai/platform/chat.md) - [Context Memory](https://docs.dropzone.ai/platform/context-memory.md) - [Settings](https://docs.dropzone.ai/platform/settings.md) - [AI Interviewer](https://docs.dropzone.ai/platform/settings/ai-interviewer.md) - [Custom EBS Volume Encryption](https://docs.dropzone.ai/platform/settings/ebs-volume-encryption.md) - [Custom Strategies](https://docs.dropzone.ai/platform/settings/custom-strategies.md) - [Global Alert Filters](https://docs.dropzone.ai/platform/settings/global-alert-project.md) - [Creating and Managing Rules](https://docs.dropzone.ai/platform/settings/global-alert-project/creating-and-managing-rules.md) - [Writing CEL Expressions](https://docs.dropzone.ai/platform/settings/global-alert-project/writing-cel-expressions.md) - [Reviewing Filter Activity](https://docs.dropzone.ai/platform/settings/global-alert-project/reviewing-filter-activity.md) - [Migrating From Advanced Filtering](https://docs.dropzone.ai/platform/settings/global-alert-project/migrating-from-advanced-filtering.md) - [Response Actions and Automations](https://docs.dropzone.ai/platform/settings/response-actions.md) - [System Events](https://docs.dropzone.ai/platform/settings/system-events.md) - [System Info](https://docs.dropzone.ai/platform/settings/system-info.md) - [Consent Governance](https://docs.dropzone.ai/platform/settings/consent-governance.md) - [On-prem Support - Dropzone Connector](https://docs.dropzone.ai/platform/settings/connector.md) - [Dropzone Connector Installation](https://docs.dropzone.ai/platform/settings/connector/connector-installation.md) - [Account and Team Admin](https://docs.dropzone.ai/platform/admin.md) - [Metrics Guide](https://docs.dropzone.ai/platform/metrics-guide.md) - [Raw Alert Tracking](https://docs.dropzone.ai/platform/raw-alert-tracking.md) - [Dropzone Integrations](https://docs.dropzone.ai/integrations.md) - [Alert Integrations](https://docs.dropzone.ai/integrations/alert.md) - [Abnormal AI (Beta)](https://docs.dropzone.ai/integrations/alert/abnormalai_alert.md) - [Amazon Web Services (AWS)](https://docs.dropzone.ai/integrations/alert/aws_alert.md) - [Cross-Account Access via CloudFormation](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-cloudformation_alert.md) - [Cross-Account Access via Console](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-console_alert.md) - [Cross-Account Access via Role Chaining](https://docs.dropzone.ai/integrations/alert/aws_alert/aws-role-chain_alert.md) - [Cato Networks](https://docs.dropzone.ai/integrations/alert/cato-networks_alert.md) - [Check Point Harmony Email & Collaboration](https://docs.dropzone.ai/integrations/alert/checkpoint-harmony_alert.md) - [CrowdStrike](https://docs.dropzone.ai/integrations/alert/crowdstrike_alert.md) - [Datadog](https://docs.dropzone.ai/integrations/alert/datadog_alert.md) - [Elasticsearch](https://docs.dropzone.ai/integrations/alert/elasticsearch_alert.md) - [ExtraHop](https://docs.dropzone.ai/integrations/alert/extrahop_alert.md) - [Gem](https://docs.dropzone.ai/integrations/alert/gem.md) - [Google GCP](https://docs.dropzone.ai/integrations/alert/gcp_alert.md) - [Google Security Operations](https://docs.dropzone.ai/integrations/alert/googlesecops_alert.md) - [Google Workspace](https://docs.dropzone.ai/integrations/alert/google-workspace_alert.md) - [Jira](https://docs.dropzone.ai/integrations/alert/jira_alert.md) - [Microsoft (MS 365 etc)](https://docs.dropzone.ai/integrations/alert/ms_alert.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365_alert.md) - [Microsoft Security Group](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365_email_group.md) - [Microsoft Sentinel](https://docs.dropzone.ai/integrations/alert/ms_alert/mssentinel_alert.md) - [Microsoft 365 Exchange Online Management](https://docs.dropzone.ai/integrations/alert/ms_alert/ms365-exchange-online-management_alert.md) - [Mimecast](https://docs.dropzone.ai/integrations/alert/mimecast.md) - [Palo Alto Cortex](https://docs.dropzone.ai/integrations/alert/palo-alto-cortex_alert.md) - [Palo Alto Networks Firewall](https://docs.dropzone.ai/integrations/alert/palo-alto_alert.md) - [Panther](https://docs.dropzone.ai/integrations/alert/panther_alert.md) - [Proofpoint](https://docs.dropzone.ai/integrations/alert/proofpoint_alert.md) - [QRadar](https://docs.dropzone.ai/integrations/alert/qradar_alert.md) - [Rapid7 Insight IDR](https://docs.dropzone.ai/integrations/alert/rapid7-insight-idr_alert.md) - [SentinelOne](https://docs.dropzone.ai/integrations/alert/sentinelone_alert.md) - [ServiceNow](https://docs.dropzone.ai/integrations/alert/servicenow.md) - [Splunk](https://docs.dropzone.ai/integrations/alert/splunk_alert.md) - [Stellar Cyber](https://docs.dropzone.ai/integrations/alert/stellarcyber_alert.md) - [Sumo Logic](https://docs.dropzone.ai/integrations/alert/sumo-logic_alert.md) - [Vectra AI](https://docs.dropzone.ai/integrations/alert/vectra-ai_alert.md) - [Wiz](https://docs.dropzone.ai/integrations/alert/wiz_alert.md) - [ZScaler (Beta)](https://docs.dropzone.ai/integrations/alert/zscaler_alert.md) - [Communicators](https://docs.dropzone.ai/integrations/communicator.md) - [Microsoft Teams](https://docs.dropzone.ai/integrations/communicator/msteams.md) - [Slack Communicator](https://docs.dropzone.ai/integrations/communicator/slack.md) - [Data Source Integrations](https://docs.dropzone.ai/integrations/data.md) - [AbuseIPDB](https://docs.dropzone.ai/integrations/data/abuseipdb.md) - [Active Directory (LDAP)](https://docs.dropzone.ai/integrations/data/active-directory-ldap.md) - [Amazon Web Services (AWS)](https://docs.dropzone.ai/integrations/data/aws_data.md) - [Cross-Account Access via CloudFormation](https://docs.dropzone.ai/integrations/data/aws_data/aws-cloudformation_data.md) - [Cross-Account Access via Console](https://docs.dropzone.ai/integrations/data/aws_data/aws-console_data.md) - [Cross-Account Access via Role Chaining](https://docs.dropzone.ai/integrations/data/aws_data/aws-role-chain_data.md) - [Analyst1](https://docs.dropzone.ai/integrations/data/analyst1_data.md) - [ANY.RUN](https://docs.dropzone.ai/integrations/data/anyrun.md) - [Archive Inspector](https://docs.dropzone.ai/integrations/data/archive-inspector.md) - [Blocklist.de](https://docs.dropzone.ai/integrations/data/blocklist-de.md) - [CAPA](https://docs.dropzone.ai/integrations/data/capa.md) - [Cato Networks](https://docs.dropzone.ai/integrations/data/cato-networks_data.md) - [Censys](https://docs.dropzone.ai/integrations/data/censys.md) - [Cribl](https://docs.dropzone.ai/integrations/data/cribl.md) - [CrowdStrike](https://docs.dropzone.ai/integrations/data/crowdstrike_data.md) - [Crowdstrike Falcon Intelligence](https://docs.dropzone.ai/integrations/data/pangea.md) - [Datadog](https://docs.dropzone.ai/integrations/data/datadog_data.md) - [DNSResolver](https://docs.dropzone.ai/integrations/data/dnsresolver.md) - [Dropzone Security Knowledge Base](https://docs.dropzone.ai/integrations/data/dzsecknowledgebase.md) - [Dropzone URL Sandbox](https://docs.dropzone.ai/integrations/data/dzurlsandbox.md) - [Elasticsearch](https://docs.dropzone.ai/integrations/data/elasticsearch_data.md) - [ExtraHop](https://docs.dropzone.ai/integrations/data/extrahop_data.md) - [File](https://docs.dropzone.ai/integrations/data/file.md) - [Google GCP](https://docs.dropzone.ai/integrations/data/gcp_data.md) - [Google Safe Browsing](https://docs.dropzone.ai/integrations/data/google-safe-browsing.md) - [Google Security Operations](https://docs.dropzone.ai/integrations/data/googlesecops_data.md) - [Google Workspace](https://docs.dropzone.ai/integrations/data/google-workspace_data.md) - [GreyNoise](https://docs.dropzone.ai/integrations/data/greynoise.md) - [Host.io](https://docs.dropzone.ai/integrations/data/host-io.md) - [Hybrid Analysis](https://docs.dropzone.ai/integrations/data/hybrid-analysis.md) - [iboss](https://docs.dropzone.ai/integrations/data/iboss.md) - [IPInfo.io](https://docs.dropzone.ai/integrations/data/ipinfo-io.md) - [IPQualityScore](https://docs.dropzone.ai/integrations/data/ipqualityscore.md) - [Jira](https://docs.dropzone.ai/integrations/data/jira_data.md) - [MalwareBazaar](https://docs.dropzone.ai/integrations/data/malwarebazaar.md) - [Microsoft (MS 365 etc)](https://docs.dropzone.ai/integrations/data/ms_data.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/data/ms_data/ms365_data.md) - [Microsoft Azure](https://docs.dropzone.ai/integrations/data/ms_data/azure_data.md) - [Azure Data Explorer](https://docs.dropzone.ai/integrations/data/ms_data/azure-data-explorer.md) - [Microsoft Sentinel](https://docs.dropzone.ai/integrations/data/ms_data/mssentinel_data.md) - [Microsoft 365 Exchange Online Management](https://docs.dropzone.ai/integrations/data/ms_data/ms365-exchange-online-management_data.md) - [Nuclei](https://docs.dropzone.ai/integrations/data/nuclei.md) - [NVD](https://docs.dropzone.ai/integrations/data/nvd.md) - [Okta](https://docs.dropzone.ai/integrations/data/okta.md) - [oletools](https://docs.dropzone.ai/integrations/data/oletools.md) - [OpenSourceMalware](https://docs.dropzone.ai/integrations/data/opensourcemalware.md) - [OpenSSL Sign Code](https://docs.dropzone.ai/integrations/data/openssl-sign-code.md) - [Palo Alto Cortex](https://docs.dropzone.ai/integrations/data/palo-alto-cortex_data.md) - [Palo Alto Networks Firewall](https://docs.dropzone.ai/integrations/data/palo-alto_data.md) - [Panther](https://docs.dropzone.ai/integrations/data/panther_data.md) - [PDF Analysis](https://docs.dropzone.ai/integrations/data/pdf-analysis.md) - [People Data Labs](https://docs.dropzone.ai/integrations/data/people-data-labs.md) - [Perplexity AI](https://docs.dropzone.ai/integrations/data/perplexity-ai.md) - [PhishTank](https://docs.dropzone.ai/integrations/data/phishtank.md) - [QRadar](https://docs.dropzone.ai/integrations/data/qradar_data.md) - [Rapid7 Insight IDR](https://docs.dropzone.ai/integrations/data/rapid7-insight-idr_data.md) - [ReversingLabs](https://docs.dropzone.ai/integrations/data/reversinglabs.md) - [SentinelOne](https://docs.dropzone.ai/integrations/data/sentinelone_data.md) - [ServiceNow](https://docs.dropzone.ai/integrations/data/servicenow_data.md) - [Shodan](https://docs.dropzone.ai/integrations/data/shodan.md) - [Splunk](https://docs.dropzone.ai/integrations/data/splunk_data.md) - [Stellar Cyber](https://docs.dropzone.ai/integrations/data/stellarcyber_data.md) - [Sumo Logic](https://docs.dropzone.ai/integrations/data/sumo-logic_data.md) - [Swimlane Threat Intelligence](https://docs.dropzone.ai/integrations/data/swimlane-ti.md) - [TShark](https://docs.dropzone.ai/integrations/data/tshark.md) - [UnshortenMe](https://docs.dropzone.ai/integrations/data/unshortenme.md) - [Upwind (Beta)](https://docs.dropzone.ai/integrations/data/upwind_data.md) - [URLhaus](https://docs.dropzone.ai/integrations/data/urlhaus.md) - [Urlscan.io](https://docs.dropzone.ai/integrations/data/urlscan-io.md) - [Vectra AI](https://docs.dropzone.ai/integrations/data/vectra-ai_data.md) - [VirusTotal](https://docs.dropzone.ai/integrations/data/virustotal.md) - [Vision](https://docs.dropzone.ai/integrations/data/vision.md) - [VulnCheck](https://docs.dropzone.ai/integrations/data/vulncheck.md) - [WHOIS](https://docs.dropzone.ai/integrations/data/whois.md) - [Wiz](https://docs.dropzone.ai/integrations/data/wiz_data.md) - [YARAify](https://docs.dropzone.ai/integrations/data/yaraify.md) - [ZScaler (Beta)](https://docs.dropzone.ai/integrations/data/zscaler_data.md) - [Remediator Integrations](https://docs.dropzone.ai/integrations/remediator.md) - [Crowdstrike](https://docs.dropzone.ai/integrations/remediator/crowdstrike_remediator.md) - [Google Workspace](https://docs.dropzone.ai/integrations/remediator/google-workspace_remediator.md) - [Microsoft 365 / Microsoft Defender](https://docs.dropzone.ai/integrations/remediator/ms365_remediator.md) - [Okta](https://docs.dropzone.ai/integrations/remediator/okta_remediator.md) - [Other Tools](https://docs.dropzone.ai/integrations/tools.md) - [Slack Chatops](https://docs.dropzone.ai/integrations/tools/slack-chatops.md) - [API](https://docs.dropzone.ai/api.md) - [Context Memory](https://docs.dropzone.ai/api/context-memory.md) - [Custom Strategies](https://docs.dropzone.ai/api/custom-strategies.md) - [Email](https://docs.dropzone.ai/api/email.md) - [Investigation](https://docs.dropzone.ai/api/investigation.md) - [Investigation Bulk Feedback](https://docs.dropzone.ai/api/investigation-bulk-feedback.md) - [Investigation User Notes](https://docs.dropzone.ai/api/investigation-user-notes.md) - [Ping](https://docs.dropzone.ai/api/ping.md) - [Response Actions](https://docs.dropzone.ai/api/response-actions.md) - [System Events](https://docs.dropzone.ai/api/system-events.md) - [Models](https://docs.dropzone.ai/api/models.md) - [FAQ](https://docs.dropzone.ai/faq.md) - [Multi-Tenancy Options](https://docs.dropzone.ai/faq/multi-tenancy-options.md) - [Email Ingestion Option](https://docs.dropzone.ai/faq/email-ingestion-options.md) - [Monitoring Dropzone](https://docs.dropzone.ai/faq/monitoring-dropzone.md) - [Best Practices](https://docs.dropzone.ai/best-practices.md) - [Context Memory](https://docs.dropzone.ai/best-practices/context-memory.md) - [Building Response Automations and Actions](https://docs.dropzone.ai/best-practices/how-to-build-response-automations-and-actions.md) - [Investigation Reviews Deep Dive](https://docs.dropzone.ai/best-practices/deep-dive-into-investigation-reviews.md) - [Utilizing the Dropzone AI Chatbot](https://docs.dropzone.ai/best-practices/utilizing-the-dropzone-ai-chatbot.md) - [Custom Strategies](https://docs.dropzone.ai/best-practices/custom-strategies.md) - [How to Create a Custom Strategy](https://docs.dropzone.ai/best-practices/custom-strategies/how-to-create-custom-strategy.md) - [Analysis Guidance Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/analysis-guidance-quick-setup-guide.md) - [Investigation Questions Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/investigation-questions-quick-setup-guide.md) - [Priority Rules Quick Setup Guide](https://docs.dropzone.ai/best-practices/custom-strategies/priority-rules-quick-setup-guide.md) - [Release Notes](https://docs.dropzone.ai/release-summary.md) - [2026](https://docs.dropzone.ai/release-summary/2026.md) - [March](https://docs.dropzone.ai/release-summary/2026/release-202603-summary.md) - [February](https://docs.dropzone.ai/release-summary/2026/release-202602-summary.md) - [January](https://docs.dropzone.ai/release-summary/2026/release-202601-summary.md) - [Unlinked](https://docs.dropzone.ai/unlinked.md) - [Google Drive Collaboration](https://docs.dropzone.ai/unlinked/google-drive-collaboration.md) - [Exabeam](https://docs.dropzone.ai/unlinked/exabeam.md) - [RocketCyber](https://docs.dropzone.ai/unlinked/rocketcyber_alert.md)