During processing, Red Canary will correlate alerts to endpoint and identity records that already exist in our system. You can also optionally enable discovery, which allows Red Canary to create new endpoint or identity records if they don’t already exist.
Enabling Endpoint or Identity Discovery
To turn on endpoint and/or identity discovery:
Click your user icon at the top right, then click Endpoint/Identity Discovery.
Check the Enable endpoint discovery and/or Enable identity discovery checkboxes, then add the applicable domain name(s).
Click Save.