Training Salem in Web Browser

With the Salem Browser extension, every tool and portal is now you're single panel of glass

What is the Salem Brower Extension?

Salem's browser extension allows users to view and update Salem alerts from within other web-based portals they use for their cyber investigation work. With the Salem investigation context and enriched alert details handy, analysts can quickly access relevant alert details to understand and react to threat activity without having to jump between browser tabs.

To learn more about how to configure the Salem browser extension, see Browser Extension Settings

Viewing alerts with the browser extension

When enabled by the Salem administrator, Salem will auto-detect alert IDs on the current web page. When it does, it will display those alerts when the Salem floating action button is selected.

If one alert is matched, that alert will be shown. If many alert IDs are found, then a list of the alerts will be displayed. A user can select to view a specific alert. To prevent the view from reverting back to a list of alerts, use the pin button to force Salem to stay on the same view.

If no alert is found on the current page, Salem will show the last five alerts viewed by that user, and a search bar where they can enter the ID of an alert they wish to view. The search feature only supports full ID match, no other search parameters are accepted.

Training Salem using the browser extension

All Salem training capabilities, as described in Train Salem, are available from the browser extension. Using the browser extension to view Salem analysis for an alert you are already viewing is a convenient way to see what context Salem understood about the reported threat activity and using the Salem learning features to bolster Salem's knowledge based on additional details you know about the underlying activity, entities and data.