Documentation / Getting started
Start with the layer, not an installation command.
The DNA Cybertech platform is built around a behavioral representation layer between security telemetry and the systems that perform detection, investigation, hunting and response. The first useful step is therefore to understand the object moving through that architecture—not to copy an unverified command into a terminal.
Scope: this guide covers the evaluation sequence: understanding behavior records and their evidence. For installation, API and integration questions, contact us.
The evaluation path
1. Locate behavior in the pipeline
Read the architecture overview and verify the boundary: telemetry enters the behavior layer before any individual detector owns the representation.
2. Inspect a complete record
Review the behavior schema. A behavior should carry the actor, capability, actions, immediate effects, persistent effects and evidence state together.
3. Read the missing evidence
The final dimension is not a confidence decoration. Evidence states separate what was observed directly, what was inferred and what could not have been observed with available telemetry.
4. Walk a conclusion backward
A detection or response should remain navigable through behavior and evidence to its originating telemetry. That structure is described in security reasoning traceability.
What to ask during an evaluation
| Question | What a sufficient answer contains |
|---|---|
| Where is behavior created? | A labeled architectural boundary before detection |
| What does a behavior contain? | Context, capability, actions, effects and observability |
| Can a conclusion be checked? | Identifiers connecting response back to supporting evidence |
| How are gaps represented? | Explicit observed, inferred and not-observed states |
| What is measured? | A published method and a named scope—not an unsupported percentage |
Continue
Go next to Architecture for the system boundary or Behavior schema for the record itself.