Quick Tour

This Quick Tour provides an overview of Optic’s main UI elements and navigation features.

Tip

The Research Tool is the primary tool used to interact with Synapse. See the Navigation Basics section below for some fundamentals on interacting with Synapse through the Research Tool.

Top Bar

The green Top Bar provides an overview of your current environment and allows you to select or change various environment settings.

From left to right, the Top Bar includes the following:

Tool Indicator

The Tool Indicator displays the name of the active Tool (as selected from the Toolbar):

Workspace Selector

The Workplace Selector displays the active Workspace and allows you to select / change the Workspace in use or manage your favorite Workspaces:

View Selector

The View Selector displays the active View and allows you to select / change the View in use or manage your favorite Views:

View Task Bar

The View Task Bar allows you to perform basic View management tasks: fork a view, view the differences / changes between the current view and the underlying view, merge the current view into the underlying view, or delete the current view.

Notifications Icon

The Notifications Icon indicates whether notifications are available. A gray dot will appear next to the icon when you have notifications. Click the icon to view any messages.

Your Settings

Your Settings displays your username; clicking this area will open a dialog for user settings such as changing your password and configuring some user preferences.

Logout

The Logout icon (the X next to Your Settings) logs you out of Synapse.

Toolbar

The vertical Toolbar on the left provides easy access to Synapse’s Tools.

Research Tool

The Research Tool is the primary tool analysts use to query, navigate, and visualize data in Synapse.

Spotlight Tool

The Spotlight Tool is used to load and view HTML or PDF reports and to view and extract indicators and other information.

Ingest Tool

The Ingest Tool is used to load, view, and import data into Synapse from CSV, JSON, or JSONL formatted files.

Storm Editor Tool

The Storm Editor Tool provides a development environment to create, test, and save Storm queries, Storm macros, and other Storm code.

Stories Tool

The Stories Tool is used to collaborate on and create finished reporting from data in Synapse, either as one-time reports or generated on demand from a template.

Workflows Tool

The Workflows Tool provides access to Synapse Workflows. A Workflow is a custom UI interface tailored to a specific task.

Console Tool

The Console Tool provides CLI access to Synapse command help and is used to view status, warning, or error messages. It also includes a Storm query bar and can be used to run Storm queries or commands.

Workspaces Tool

The Workspaces Tool allows users to manage various aspects of their user environment, including customizing your environment and displaying and managing available Views.

Power-Ups Tool

The Power-Ups Tool allows users to view information about installed and available Power-Ups and to manage (install, update, or remove) Rapid Power-Ups (with appropriate permissions).

Metrics Tool

The Metrics Tool provides a dashboard for viewing changes (node edits) made over time to a view, layer, or the overall Synapse data store (Cortex).

Help Tool

The Help Tool provides access to useful features such as the Data Model Explorer and Tag Explorer, and includes links to Synapse’s documentation.

Admin Tool

The Admin Tool is used for Synapse Admin tasks, such as managing users, roles, and permissions; Views and layers; and automation such as cron jobs and triggers.

Navigation Basics

The Research Tool is the primary means for users to interact with data in Synapse. It includes the following features.

Storm Query Bar / Query Mode Selector

The Storm Query Bar appears at the top of the Research Tool. The query bar is how you begin interacting with Synapse. Use the query bar to tell Synapse what data you’d like to see to start your investigation.

Enter your query and press enter to run the query and view the results.

Use the Query Mode Selector to specify how you want to use the query bar:

Storm Mode

Storm mode allows you to use the full power of the Storm query language. Storm mode includes an autocomplete feature that will hint on the names of forms, properties, and tags, as well as libraries and variables. (Autocomplete is enabled by default, but can be set as a preference under Your Settings).

Lookup Mode

Lookup mode allows you to “look up” common indicators by simply pasting them into the query bar. Lookup mode supports:

• FQDNs

• URLs

• Email addresses

• Hashes (MD5, SHA1, SHA256)

• IPv4 addresses

• CVE numbers

• Some common cryptocurrency addresses (e.g., Bitcoin, Ethereum)

You can look up individual indicators or enter several at once. You can even enter “defanged” indicators - Lookup mode recognizes most common defang methods (such as hxxp:// or vertex[.]link) and will automatically “re-fang” anything you enter when running the query. In addition, lookup mode will simply ignore any data it does not recognize.

Tip

If you enter a valid indicator that does not yet exist in Synapse, Lookup mode will offer to create it for you.

Text Search Mode

Text search mode is available if the Synapse Search Advanced Power-Up is installed. Text Search performs a tokenized search of most text-based properties in Synapse. It can be useful for finding “everything” in Synapse related to a particular term or value; or “jump starting” a search if you’re not sure how to be more specific using Storm.

Tip

Text search mode searches by token only. Quoted strings (“my interesting search”) will be searched as individual tokens. Similarly, attempting to search a “dotted” string (such as the FQDN vertex.link) will split the string on the dot and independently search the tokens “vertex” and “link”. (If you’re looking for an FQDN or IPv4 address, use Lookup mode.)

In addition, to limit excessive results, search terms (tokens) must be a minimum of five characters in length - terms less than five characters will only return nodes with a property that exactly matches the term (vs. any indexed property that contains the term). For example, searching the four-character string apt1 would return the risk:threat node with risk:threat:org:name=apt1, but would not return the media:news node with media:news:title='mandiant apt1 report'.

Auto Add Mode

Auto add mode allows you to quickly add common indicators to Synapse by pasting them into the query bar. Auto add mode recognizes the same indicators as Lookup Mode and works in a similar manner; Auto add will return the node(s) if they already exist, and create them if they do not. The main difference is that Auto add will automatically create the nodes, but Lookup mode will prompt you and allow you to review the suggested nodes before creating them.

Display Mode Selector

You can display the results of any query run in the query bar using a variety of display modes. These allow you to visualize your results in different ways. Use the display mode selector underneath the query bar to select how you want to view the data:

Tip

Tabular mode is the default and is usually the best way to work with Synapse’s data. Other modes are useful for specific types of analysis questions.

Results Panel / Details Panel

When you run a query in the query bar, any results (nodes) are displayed in the Results Panel - the main body of the Research Tool.

Tip

Each display mode has a Results Panel, though what you see will depend on the display mode selected.

Select one or more objects in the Results Panel to view additional information about the object(s) in the Details Panel on the right:

The Details Panel has three tabs:

• The NODE tab displays all currently set properties and all tags for the selected node (or the common set of properties/tags if multiple nodes are selected).

• The ALL TAGS tab displays all tags for all nodes in the Results Panel, regardless of which node(s) are selected. This is a good way to quickly see all of the context associated with all of your results.

• The ALL PROPS tab displays all available properties for the selected node(s) (both set and unset properties).

Scroll to Form

The Scroll to Form button (available in Tabular Display Mode) makes it easy to work with large result sets. Clicking the button gives you a summary of your results by object (form) name and count. Select a form name to jump to that form in the Results Panel.

Menus

Many objects in Synapse have associated menus that display additional options.

Storm Query Bar Menu

The Storm query bar menu is accessed by clicking the three horizontal dots (the “meatball menu”) on the right of the query bar:

Hamburger Menus

Most objects use three horizontal lines (a “hamburger menu”) to indicate that a menu is available. For example, a hamburger menu is located next to the Scroll to Form button, and each object (form) in the Results Panel in Tabular mode has an associated menu.

Results Panel (Context) Menu

The Results Panel includes a context menu for most display modes. Select one or more nodes in the Results Panel and right-click to display the menu. A right arrow / greater than sign ( > ) indicates that more options are available:

Details Panel Dropdown / Menu

Each item in the Details Panel has an associated dropdown menu with item-specific options. Click (left-click) the dropdown icon (or anywhere on the item itself) to display the menu. A right arrow / greater than sign ( > ) indicates that more options are available:

Explore Button / Breadcrumbs

The Explore Button (available in Tabular Display Mode) allows you to navigate the data in Synapse. Select one or more nodes and click the Explore button next to any selected node to navigate to adjacent nodes and see the objects that are “connected” to your starting node(s):

You can continue to select and explore from any objects displayed in the Results Panel. As you navigate using the Explore button, Synapse will leave a trail of breadcrumbs beneath the display mode selector:

Click any of the breadcrumbs to return to an earlier point in your navigation; or click the query breadcrumb to return to your original query / starting point.

Tip

Many Optic UI features simplify working with Synapse by running Storm for you “under the hood” when you click a button or select a menu option. The Explore button is one example - it shows you “all the connected nodes” by running the following Storm operations for each selected node:

• a “wildcard” pivot out ( -> * )

• a “wildcard” pivot in ( <- * )

• a “traverse all light edges” out ( -(*)> * )

• a “traverse all light edges in ( <(*)- * )

Technically, the wildcard pivot out / traverse all edges out can be combined into a single operation ( --> * ), and so can the wildcard pivot in / traverse all edges in ( <-- * ). Explore combines both operations using the Storm tee command, so clicking the Explore button is equivalent to the following Storm query:

tee { --> * } { <-- * }