livewells
Menu

livewells documentation

Guides for analysts and administrators.

Start

  • Getting started with livewells

    livewells lets a security analyst open a suspicious link by hand in a disposable browser, and send a suspicious file to be read. You keep a video and a defanged report of the redirect chain, the domains and the IP addresses, with IP context and reputation. A file gets a defanged report of what it holds.

Use livewells

  • Cases

    A case is the saved record of one session: one link, opened by one analyst, with its video, report and enrichment. A case can also hold one file, with its report. See Files.

  • Files

    livewells checks files as well as links. Send a file and livewells reads it in a disposable container. The case shows what the file holds, with a defanged report.

  • Email and calendar files

    Upload an email file to open a case about the full message. livewells reads the file and reports what it finds. All links go to your case, ready to open in the disposable browser.

  • HTML files

    You can submit a web page that arrived as a file: an .html or .htm attachment, an application page (.hta) or a vector image (.svg). livewells reads the file as text, lists what it holds and flags what looks risky.

  • PDF files

    livewells reads a PDF as data. It shows pictures of the pages, lists what the file holds and flags the parts that can harm you. The file never opens on your computer.

  • Word, Excel, PowerPoint and RTF files

    livewells reads Office files for you. Attackers use these files to start a program, to load content from another place and to hide a link or a command inside a macro. livewells reads the file as data and shows what it holds.

  • Archives

    Send an archive and livewells opens it, lists every file inside and hands each file to the reader for its type. All files from one archive stay in one case.

  • Macro emulation

    Attackers hide the links, commands and file names of a macro behind many small steps. The macro builds them while it runs, so they stay hidden in the text of the macro.

  • QR codes in images

    livewells reads QR codes in images. A QR code is a square picture that holds text, most often a web address. Attackers print a malicious address as a QR code so that a mail filter cannot read it.

  • Captured downloads

    A page can offer a file for download while an analyst drives the disposable browser. livewells captures the file, checks it and shows it in the case.

  • Enrichment

    After a session ends, livewells checks the domains and public IP addresses of a case against commercial threat intelligence: reputation, blocklist hits and a risk score. It adds the result to the case.

Administer

  • Administering livewells

    Administrators manage the settings of an organisation. The buyer names the first administrator by email at checkout. The administrator confirms on the first sign-in with that email, within 30 days, and then becomes the first administrator. If Maelstrom AI sets up your organisation by email, it names the first administrators.

  • Microsoft Entra set-up

    livewells signs people in with Microsoft Entra ID. Your Entra administrator approves the livewells app once. After that, your people sign in with their work accounts.

  • Billing

    One plan, livewells:

  • Integrations

    The integration templates make a livewells run for each link in an incident. They post the Start link to your analysts.

Reference

  • API

    Use the API to submit links and files from your own tools and to read finished cases. The API calls a session a run. An analyst drives the browser by hand, so a run waits for an analyst to start it. A file is read at once, with no analyst needed.

  • Limits

    Your organisation has limits on what it can use. This page lists each limit: how much it holds, what it counts, when it resets, what you see when you reach it, and whether a top-up adds to it.

  • Privacy and security

    This guide covers what is protected and what your organisation controls.

  • Support

    Write to support@livewells.io. For sales and plan questions, write to sales@livewells.io.