Cheat sheet
Everything you need on one page: the commands, the severities, the reading order and the checks before calling a host clean.
Commands
signal live -all -o .\
signal live -all -profile case.json -o .\
signal live -all -shadow newest -o .\
signal live -m Executions,Persistence -vsignal live -all -push https://console:7446 -push-key-file key.txt
signal push -push https://console:7446 -push-key-file key.txtsignal rules -check -rules C:\signal-rules
signal rules -pack -rules C:\signal-rules
signal profile -check case.json
signal profile -encode case.json
signal listSeverities
critical | An incident. Never matches anything legitimate. |
high | An incident unless a false positive. Review first. |
medium | Suspicious. Look in context. |
low | Worth knowing beside other signals. |
Rule outcomes
| It fired. |
| Evaluated over complete data; nothing. |
| Could not be evaluated - read the reason. |
Telemetry
| Recording / turned off. |
| The host has no such source. |
| Could not be found out. |
Reading order
Telemetry and LogIntegrity: what could be seen.
Entities by severity: critical, then high.
Each signal's source: which log, which record.
The fleet: on one host, or many?
Pivot: new indicators into the profile, re-run the fleet.
Before calling a host clean
Elevated - every module ran - telemetry on - logs trustworthy - protection on - pivots searched. See When to rely on Signal.