Send findings to an Operation
This guide will show you how to send objects from Explorer to Operator.
You can send objects from Explorer to Operator to be used in your defensive operations, red teaming, and training or adversary emulation operations.
Requirements
This feature will only conditionally appear if the criteria for creating an Operation are met:
- A single environment is selected in your basic filters. Operations are scoped to a single environment, so sending objects that span across multiple environments is not supported.
- An object type that Operator can accept as input is selected. Currently, these are FQDNs, IP Addresses, CIDRs, and URLs.
How to send Objects to Operator
After selecting an environment and an object type that can be an input to an Operation, construct your search queries as you normally would. To send an object or multiple objects to a new Operation, clicking on the checkbox on that line item will reveal the Send to Operator button.
This will bring up a modal where you can configure your new Operation.
Configure the Operation
Fill in the following fields:
- Title: A short name for the Operation
- Objective: What you want to investigate or accomplish
- Access vector: How the Operation will reach the targets (Internet or Installed Agent)
The selected Objects from Explorer will be pre-populated as the Operation’s starting points. Click Create Operation to launch a new Operator session with those Objects ready to go.
For a full walkthrough of Operations, see Run your first Operation.
