On a phone
What the phone version is for, what it leaves to a computer, and how to keep it on your home screen.
The phone version is for what someone really does on a phone: see whether anything is wrong, decide an alert, cut off an attack that cannot wait, and check the file or link that just reached them. It opens by itself on any phone, at the same address and with the same account.
What a phone does
Section titled “What a phone does”| Tab | What it is for |
|---|---|
| Home | Critical alerts waiting for a decision, what waits for you, and what is reporting |
| Alerts | The queue: read an alert, confirm it, dismiss it with a reason, take it, open an investigation, or respond |
| Scan | Check a file or a PCAP capture, a link, an IP address, a domain or a hash |
| AI | Ask the AI analyst about an alert, a scan or an address |
| More | Investigations, servers and agents, language and sign-out |
The shield beside the bell is Approvals: response actions, agent commands and playbook steps that wait for a person. A number on it says how many wait for you.
Scanning
Section titled “Scanning”One button takes any file. A .pcap, .pcapng or .cap capture goes through the network analysis, anything else through the file scan; you do not choose. You can open another screen while it runs, and the result waits for you.
A file goes in parts, so a large one passes whatever stands in front of the server, and a dropped connection only costs the part it was sending. The largest file a server can scan depends on its memory, and it says so before anything is sent; a capture can be up to 512 MB. An upload nobody finishes is deleted after 24 hours.
One field takes a link, an IP address, a domain or a hash, including addresses written as hxxp://example[.]com. A link is judged by its address and is not opened. Something that is not in your threat data is shown as unknown, not as safe.
Responding
Section titled “Responding”Respond on an alert isolates its host or blocks the addresses it names. It follows your organisation’s response rule, the same as on a computer: a second administrator approves it, or, in solo mode, you type the host name and give a fresh authenticator code.
What stays on a computer
Section titled “What stays on a computer”Rules, playbooks, the entity graph, attack paths, threat hunting, the event explorer, the network map, data sources, the secure terminal, compliance, the audit log, settings and administration all need a large screen. Opening one of these links on a phone says so and offers to copy the link. Stopping a single process and quarantining a file are also done on a computer.
Adding a first server is done on a computer too. A new account can sign in on a phone straight away.
Keep it on the home screen
Section titled “Keep it on the home screen”In your phone’s browser, choose Add to Home Screen. Legit AI then opens in its own window, without the browser’s bars.