This guide is intended for use by Security Operations Center (SOC) analysts and investigators. This guide describes how to set up the Apache Zeppelin dashboard and use runbooks generated with Zeppelin. Like the Metron dashboard, the Zeppelin dashboard can be used to view and analyze the enriched telemetry data provided by Hortonworks Cybersecurity Platform (HCP). However Zeppelin can be used by a data scientist to create runbooks for recreatable investigations. These runbooks can be static, which require no input, or dynamic, which require you to enter or choose information.

This guide contains the following information: