ADDA living manual

Checklist

• • Review the landing page and main modules.
• • Try Inspector with an IP address or a domain you control.
• • Open the console and review domains, alerts, and incidents.

Quickstart

• • Open Inspector for a quick reading of an IP, domain, or URL.
• • Enter the console to view domains, tasks, notifications, and incidents.
• • Use the manual to follow the procedure in the same language ADDA uses.

Checklist

• • Verify that the reading is recorded with a date and version.
• • Confirm that the reasons for the decision can be explained clearly.
• • Seal evidence if a blocking action or incident occurred.

Quickstart

• • Read severity and action together: never one without the other.
• • Review the reason codes before explaining a measure to third parties.
• • If the measure affects access, DNS, WAF, or credentials, attach evidence.

Checklist

• • Validate the active policies in the organization.
• • Run a DNS check on highly exposed domains.
• • Record the decision when the domain needs special monitoring.

Quickstart

• • Choose a priority domain and run an institutional check.
• • Compare severity, action, and reason codes before blocking or flagging.
• • If the domain affects email, cross-check the mail article and evidence.

Checklist

• • Inspect active rules and published versions.
• • Review matches in test requests.
• • Escalate to recorded evidence when the action is to block.

Quickstart

• • Test a sensitive route with a controlled case.
• • Read matched rules and the decision before assuming the block was correct.
• • Open an incident if the pattern repeats or affects multiple surfaces.

Checklist

• • Identify critical forms and capture routes.
• • Review recent events before increasing friction.
• • Escalate to WAF or an incident if the pattern becomes repeatable.

Quickstart

• • Find which forms concentrate abuse or sensitive volume.
• • Review recent events and adjust friction by priority, not intuition.
• • Raise evidence if protection affects operations or relevant users.

Checklist

• • Identify critical integration routes.
• • Check whether the source uses known credentials, tunnels, or sessions.
• • Support the decision with evidence if it changes service continuity.

Quickstart

• • Start from the integration route, not only the isolated request.
• • Check whether the API is linked to Secrets, Access, or active credentials.
• • Use tasks when the adjustment requires coordination with another area.

Checklist

• • Locate the most sensitive authentication routes.
• • Cross-check the signal with sessions and devices in Access.
• • Escalate to an incident if the pattern compromises institutional continuity.

Quickstart

• • Review login routes with sessions and devices, never in isolation.
• • Check whether the applied friction matches the criticality of access.
• • Record evidence if the case led to session closure or revocation.

Checklist

• • Check the domain and authentication before deciding on a measure.
• • Cross-check links, subject, and campaign if the case appears repeated.
• • Connect evidence or an incident when the finding affects operations.

Quickstart

• • Validate the domain and spoofing before communicating a campaign.
• • Assess whether the case requires an abuse report, early warning, or incident.
• • Save evidence if the finding led to blocking or external coordination.

Checklist

• • Compare the automation reading with the session and domain readings.
• • Confirm that the recommended action matches the severity.
• • Record feedback if the reasons are insufficient to explain the decision.

Quickstart

• • Read severity, action, and reason codes as one operational sentence.
• • Cross-check the score with the affected module before blocking by default.
• • For a sensitive case, bring the reading into an incident, task, or evidence.

Checklist

• • Review devices, sessions, and policies before revoking access.
• • Confirm whether the tunnel or device lost its trust score.
• • Record evidence or a task when the measure affects operational continuity.

Quickstart

• • Read the overall Access status first to see coverage, trust, and degraded peers.
• • Then examine devices or sessions to locate the source of lost trust.
• • If continuity is affected, open a task or incident before closing permanently.

Checklist

• • Seal evidence when blocking, limiting, or escalating an incident.
• • Save a summary understandable to operations and legal review.
• • Link the record to the corresponding flow or incident.

Quickstart

• • Seal evidence whenever a measure changes system behavior.
• • Use a summary suitable for operators and institutional review.
• • Link the incident, task, or affected resource before closing the case.

Checklist

• • Open an incident when the situation crosses modules or requires coordination.
• • Assign tasks and evidence from the same flow.
• • Close with visible status, lessons, and next steps.

Quickstart

• • Open an incident when a finding is no longer an isolated event.
• • Move relevant evidence, tasks, and artifacts into the incident.
• • Use incident closure to leave reusable operational learning.

Checklist

• • Validate subject, domain, and trust level before issuing.
• • Check validity and the verification code.
• • Publish supporting evidence if the certificate responds to an incident.

Quickstart

• • Issue only when trust can already be justified.
• • Check verification and validity before sharing the certificate.
• • Link evidence if issuance accompanies a response or sensitive milestone.

Checklist

• • Review watchlists and the threat graph before responding to an incident.
• • Issue an early warning when the pattern is repeatable and cross-cutting.
• • Prepare a takedown pack for a persistent campaign or infrastructure.

Quickstart

• • Move to intelligence when a finding already shows repetition or a campaign.
• • Use watchlists and reports to avoid starting from zero in each case.
• • If an external response is needed, prepare a takedown or abuse report with context.

Checklist

• • Register the sensor or domain before enabling production ingestion.
• • Test trust readings and evidence recording with controlled cases.
• • Document common integration errors.

Quickstart

• • Register the source or domain to integrate first.
• • Test a minimum end-to-end flow before considering the integration ready.
• • If the integration leaves a recurring question, turn it into a manual candidate.