How to Use ProPera

The dashboard is your command centre. It shows system status, integration health, incident severity, MITRE tactics, vulnerability posture, Secure Score history, active exploitation and the latest threat intelligence - all computed from real data.

• Incidents - open Incidents to see detections grouped by severity. Click one for the full detail page: devices, users, MITRE techniques, evidence timeline and the AI analysis.
• Alerts - Alerts lists every raw alert with per-alert triage intelligence.
• Devices - Devices shows risk, health and exposure across your fleet; the device detail page includes network ports and response actions.

Open an incident and use the Investigation page (or the incident detail's AI panel) to get an attack narrative: what happened, which devices/users are involved, which MITRE ATT&CK techniques match, and what the recommended response is - with honest confidence levels. Everything is derived from evidence; the platform never claims malicious activity without proof.

Advanced Hunting gives you a full KQL editor with query history, saved hunts, charts and export. Use the 🤖 AI Query Assistant to describe what you want to find in plain language and get a ready-to-run KQL query. Sentinel hunting (Microsoft Sentinel → Advanced Hunting) works the same way with its own AI prompt box.

• Save queries and turn them into scheduled detections or automation triggers.
• One-click "Run in Advanced Hunting" moves a Sentinel query into the main hunting page.

Vulnerabilities lists CVEs with CVSS, exploit status and affected devices. Recommendations adds a 🛠️ How to fix guide under each recommendation so your team knows exactly what to change. From either page you can start a remediation workflow.

Remediation lists every action with its status, mode and result. The ⚡ Auto Remediation panel lets you pick an action and a device with Dry Run preview before executing. Safety rules:

• Registry changes are always blocked with a warning popup and escalated to an Administrator - ProPera never writes the registry.
• Updates-only fixes proceed (queued via patch management) and notify you.
• Non-admins are blocked with the reason shown in the popup.
• Approvals (Automation → Approvals) show exactly what will change: action, target device, method, risk score and MITRE technique - so approvers decide with full context.

The Response Pipeline ties the whole chain together for each incident: detect → enrich → MITRE map → risk (CVSS + EPSS + exposure) → CIS/NIST controls → isolate → investigate → remediate → verify → Secure Score → audit/report. Open an incident, review each stage, and click Advance on the active stage to move it forward. Every advance is gated by role and registry safety checks.

• Secure Score (Secure Score) - track your Microsoft Secure Score, its history and improvement actions; use Secure Now for governed one-click remediation.
• Reports (Reports) - Executive, SOC, Vulnerability and Compliance reports, exportable as branded PDFs.
• Compliance (Compliance) - continuous control monitoring mapped to live evidence (ISO 27001, NIST CSF, CIS v8, Essential Eight).
• Audit (System Logs) - every user action, approval decision and configuration change is recorded and searchable.