behavioral detection — NetSecWall Help Center

Reading the ATT&CK tab: incidents and kill-chain tactics The ATT&CK tab fuses warning signs from a parent program and the programs it launched into one incident, scores it by how many attack stages it spans, and maps it on a 12-tactic matrix. 4 min read

Choose your alerts, and get them on your phone Open Security ▸ Alerts & detection… to pick which events raise an alert. Two are on by default. Add an ntfy topic or HTTPS webhook to push alerts to your phone (Pro plan and trial). 4 min read

The Detections tab: what a risk score means The Detections tab scores each program that is online right now from 0 to 100 by adding up warning signs it shows. At 40 or more it is worth a look, but a score is a lead, not a verdict. 4 min read

Stop alerts for trusted apps and publishers Add a program by path, or a whole publisher, under Security ▸ App whitelist…. Whitelisted apps are no longer risk-scored, so they stop raising suspicious-process alerts and incidents. 3 min read

Threat intelligence and behavioral detection NetSecWall checks every remote address against six public threat lists, and separately scores each program's behavior from 0 to 100. Lists catch known-bad addresses; behavior catches new ones. 3 min read