Strixl LabsStrixl.Labs
Get started

Docs for analysts who read the manual.

Guides, format references, and the detection methodology behind every score. If something is missing or wrong, tell us and we'll fix it.

Getting started

Quickstart

From signup to your first confirmed beacon.

Supported formats

PCAP, Zeek, Suricata, NDJSON, CSV.

Field mapping

Onboarding exports with unusual column names.

Detection

Behavioral scoring

How every pair gets a beacon score.

Fingerprinting

JA3, JA4, JA4H, and JA4X explained.

Threat intel

Which feeds, how they're applied.

Severity modifiers

What pushes a score's severity up or down.

Workflow

Investigation panel

The interface you'll live in day-to-day.

False-positive learning

Mark once, suppress across the workspace.

Exports and reports

CSV, Executive PDF, IR Handoff PDF.

API and integrations

REST API

Programmatic ingest, lookup, and feedback.

Soon

Webhooks

Push detections into Slack, PagerDuty, or your SIEM.

Soon

Need something the docs don't cover yet?

We're writing docs alongside early customers. If you hit a wall, email us. You'll get an answer from the person who built the feature.

Email support