# Analyst Guidance

{% content-ref url="/pages/sITyqQV98q2As9ygj278" %}
[New close workflow](/operations/analyst-guidance/new-close-workflow.md)
{% endcontent-ref %}

{% content-ref url="/pages/QouznRrJ8PxdufKoibWX" %}
[Understanding Vectra AI detections](/operations/analyst-guidance/understanding-vectra-ai-detections.md)
{% endcontent-ref %}

{% content-ref url="/pages/rWZfKnCNQuU1v3a0ghp2" %}
[Assignnment workflow FAQ (prior to New close workflow)](/operations/analyst-guidance/assignnment-workflow-faq-prior-to-new-close-workflow.md)
{% endcontent-ref %}

{% content-ref url="/pages/cpRnIpDdL8diCIIsAMPK" %}
[Monitoring honeypot (honeytoken) identities](/operations/analyst-guidance/monitoring-honeypot-honeytoken-identities.md)
{% endcontent-ref %}

{% content-ref url="/pages/vbJftmat95XjhEFY0Z0p" %}
[Triggering detections for testing purposes](/operations/analyst-guidance/triggering-detections-for-testing-purposes.md)
{% endcontent-ref %}

{% content-ref url="/pages/IJcKk8cBCGpnhPVbJIrJ" %}
[TCP reset does not stop modern attacks](/operations/analyst-guidance/tcp-reset-does-not-stop-modern-attacks.md)
{% endcontent-ref %}

{% content-ref url="/pages/KEHfCguEidvp363333AB" %}
[CDR (Detect) for AWS detection test guide](/operations/analyst-guidance/cdr-detect-for-aws-detection-test-guide.md)
{% endcontent-ref %}

{% content-ref url="/pages/MuoHfrkBpTqwvNI8UL7A" %}
[Recall best practices guide](/operations/analyst-guidance/recall-best-practices-guide.md)
{% endcontent-ref %}

{% content-ref url="/pages/eUJKXR0YAAHEZCM9SoAu" %}
[Investigate Quick Start Guide (prior to SQL search)](/operations/analyst-guidance/investigate-quick-start-guide-prior-to-sql-search.md)
{% endcontent-ref %}

{% content-ref url="/pages/zaj23hAG8TgHWIcLb5uI" %}
[Advanced search reference guide (QUX)](/operations/analyst-guidance/advanced-search-reference-guide-qux.md)
{% endcontent-ref %}

{% content-ref url="/pages/LcRmdXFMLg0ZpUU6HN08" %}
[Broken mention](broken://pages/LcRmdXFMLg0ZpUU6HN08)
{% endcontent-ref %}

{% content-ref url="/pages/ERoGpRqGlFfHkIpFl6J3" %}
[Recall custom models - how to create detections (QUX)](/operations/analyst-guidance/recall-custom-models-how-to-create-detections-qux.md)
{% endcontent-ref %}

{% content-ref url="/pages/eMPAJxlEwPzi2oBets1o" %}
[Broken mention](broken://pages/eMPAJxlEwPzi2oBets1o)
{% endcontent-ref %}

{% content-ref url="/pages/hVIFOPXJEP398gB8RFlB" %}
[Crowdstrike EDR process correlation user guide](/operations/analyst-guidance/crowdstrike-edr-process-correlation-user-guide.md)
{% endcontent-ref %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.vectra.ai/operations/analyst-guidance.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.