Clear guidance before you sign in.

Welcome to Nova documentation Find the public guidance you need before sign-in, then continue with task-specific Help inside Nova. What Nova does Learn how Nova helps teams find cloud risks, detect threats, investigate incidents and coordinate response. Plan a Nova evaluation Define the decision, evidence scope, people, safeguards, and success measures before an evaluation begins. Prepare for Nova onboarding Bring the people, scope, access decisions, and support information needed for an orderly start.

How Nova works Follow a security investigation from the first alert to the response, with the evidence and responsible team kept together. Understand Nova operations Keep source activity, evidence freshness, active work, ownership, and retained results ready for the next security decision.

Understand Nova cloud security Connect cloud assets, posture, data exposure, reachable paths, compliance evidence, and remediation work without hiding coverage gaps. Review cloud assets and ownership Use a cloud asset inventory to confirm what exists, where it runs, who owns it, and which security evidence is connected to it. Understand cloud data security Relate supported data assets to exposure, access context, policy evidence, ownership, and the cloud risks that can affect them. Understand cloud security posture Review configuration and control evidence, affected resources, severity, ownership, exceptions, and assessment coverage together. Connect cloud posture and exposure Prioritize cloud weaknesses by understanding whether they are exposed, reachable, identity-connected, data-relevant, and supported by current evidence. Understand attack surface management Find internet-facing assets and services, validate ownership, and separate expected exposure from unknown or risky exposure. Understand attack paths and the security graph Follow supported relationships from an entry point toward important assets while keeping modeled possibility separate from observed activity. Understand cloud compliance evidence Review assessed controls, supporting evidence, gaps, exceptions, and coverage without treating the view as certification. Plan cloud remediation and exceptions Turn validated findings into owned work, record justified exceptions, and verify the result with current evidence. Understand code security posture Relate supported code and delivery findings to their source, ownership, release context, and remediation decision.

Understand response controls and approvals Learn how Nova checks proposed response actions, applies policies and approvals, and records execution results. Understand Nova security operations Bring detections, event evidence, investigations, ownership, threat context, and supported response into one analyst workflow. Prioritize detections and alerts Use severity, confidence, exposure, asset context, threat evidence, age, and ownership to decide which alert needs review first. Manage alert work and ownership Track alerts through their status, owner, waiting reason, age, service targets and activity history. Search and investigate security events Narrow security activity by time, source, entity, and fields, then preserve the evidence and scope that support the investigation. Understand detection engineering in Nova Measure detection coverage and quality, review proposed improvements and validate rules before publication. Understand proactive threat hunting Test a threat hypothesis against related events, including activity that did not trigger an alert. Review the findings and gaps in coverage. Understand threat intelligence in Nova Relate external threat context to observed activity, affected entities, cloud exposure, and investigations without treating a feed match as a conclusion. Understand entity behavior analytics Review meaningful changes from an entity’s supported baseline while keeping confidence, coverage, freshness, and original activity visible. Follow an evidence-led investigation Keep the trigger, chronology, affected entities, supporting records, conflicts, unknowns, and analyst decision in one review path.

Understand Nova ACDP and its seven engines Understand each Nova engine's role in behavior analytics, alert prioritization, detection improvement, investigations, pattern analysis, attack simulation and response. Understand AI assistance and human control See how AI can assist an investigation, how to check its findings and which decisions remain with your team. Understand Velora intelligence Learn how Velora brings related activity into an investigation, explains its findings and helps analysts choose what to check next. Understand Nova Core and Nova Prime Understand what Nova Core includes in an investigation and when Nova Prime can add an AI explanation with supporting references. Understand Qyronis behavioral intelligence Learn how Qyronis compares current activity with earlier behavior, identifies unusual changes and shows the evidence behind its findings. Understand NovaSignal prioritization See how NovaSignal combines supported alert context into an explainable priority while preserving contributing evidence, confidence, coverage, safeguards, and score movement. Understand the Nova Autonomous Detection Engine Learn how NADE finds gaps in detection coverage and prepares rule improvements for review before activation. Understand RAZE adversary modeling Learn how RAZE uses MITRE ATT&CK techniques to explore possible attack scenarios and detection gaps without launching an attack. Understand Velora Federated Patterns Learn how VFP identifies recurring patterns and suggests threat hunts or detection reviews during controlled preview, while protecting customer data. Understand Nova DRX See how Nova Detection and Response eXchange turns an approved decision into a supported provider outcome through explicit scope, policy, approval, simulation, and retained evidence.

Supported Nova DRX integrations Explore 23 supported DRX integrations and 44 actions for notifications, threat enrichment, case creation, containment and response. DRX integration for Amazon Web Services See which actions Nova DRX supports for Amazon Web Services and which policies and approvals apply. DRX integration for Atlassian Jira See which actions Nova DRX supports for Atlassian Jira and which policies and approvals apply. DRX integration for Cloudflare See which actions Nova DRX supports for Cloudflare and which policies and approvals apply. DRX integration for CrowdStrike Falcon See which actions Nova DRX supports for CrowdStrike Falcon and which policies and approvals apply. DRX integration for Discord See which actions Nova DRX supports for Discord and which policies and approvals apply. DRX integration for Elastic Security See which actions Nova DRX supports for Elastic Security and which policies and approvals apply. DRX integration for Generic Webhook See which actions Nova DRX supports for Generic Webhook and which policies and approvals apply. DRX integration for Google Cloud Platform See which actions Nova DRX supports for Google Cloud Platform and which policies and approvals apply. DRX integration for MISP See which actions Nova DRX supports for MISP and which policies and approvals apply. DRX integration for Microsoft Azure and Entra ID See which actions Nova DRX supports for Microsoft Azure and Entra ID and which policies and approvals apply. DRX integration for Microsoft Defender for Endpoint See which actions Nova DRX supports for Microsoft Defender for Endpoint and which policies and approvals apply. DRX integration for Microsoft Teams See which actions Nova DRX supports for Microsoft Teams and which policies and approvals apply. DRX integration for Okta See which actions Nova DRX supports for Okta and which policies and approvals apply. DRX integration for PagerDuty See which actions Nova DRX supports for PagerDuty and which policies and approvals apply. DRX integration for Palo Alto Networks See which actions Nova DRX supports for Palo Alto Networks and which policies and approvals apply. DRX integration for Proofpoint See which actions Nova DRX supports for Proofpoint and which policies and approvals apply. DRX integration for SMTP Email See which actions Nova DRX supports for SMTP Email and which policies and approvals apply. DRX integration for SentinelOne Singularity See which actions Nova DRX supports for SentinelOne Singularity and which policies and approvals apply. DRX integration for ServiceNow See which actions Nova DRX supports for ServiceNow and which policies and approvals apply. DRX integration for Slack See which actions Nova DRX supports for Slack and which policies and approvals apply. DRX integration for Splunk HTTP Event Collector See which actions Nova DRX supports for Splunk HTTP Event Collector and which policies and approvals apply. DRX integration for Telegram See which actions Nova DRX supports for Telegram and which policies and approvals apply. DRX integration for VirusTotal See which actions Nova DRX supports for VirusTotal and which policies and approvals apply.

Work from connected evidence Understand how Nova keeps source facts, security context, and decisions linked without turning every signal into the same thing. Understand customer and organization scope Know which business boundary a view describes before comparing, assigning, or acting on its evidence. Read coverage and freshness correctly Separate what Nova assessed from what was connected, current, delayed, incomplete, or not assessed. Understand confidence and uncertainty Use confidence as one part of a decision and keep unknowns visible during review. Follow work from finding to outcome Understand how a security observation becomes owned work, a reviewed decision, and a recorded outcome.

Review supported environments and systems Understand Nova connection categories and confirm exact evidence and action coverage for your environment. Plan a new connection Define the purpose, owner, scope, access, validation, and operating expectations before connecting a source. Prepare least-privilege access Give a connection only the access needed for its approved evidence scope and review that access throughout its life. Understand source health and data freshness Use connection status, last successful collection, expected delay, and coverage together before trusting a result. Resolve common connection problems Use a safe, evidence-based check before changing credentials, permissions, or provider configuration.

Supported Nova collectors Explore 148 implemented collectors across 63 provider families and choose the evidence sources that fit your Nova evaluation. Supported AWS collectors Review the AWS activity, asset, finding, identity, network, storage, and security-service sources Nova can use during an evaluation. Supported Microsoft and Azure collectors Review supported Azure, Microsoft Entra, Microsoft 365, Defender, and Sentinel sources for cloud, identity, productivity, and security operations. Supported Google Cloud and Workspace collectors Review supported Google Cloud, Google Workspace, and Google Chronicle sources for cloud inventory, posture, audit, flow, identity, and alert context. Supported Oracle Cloud collectors Review supported Oracle Cloud Infrastructure sources for audit activity, cloud assets, and Cloud Guard findings. Supported identity and access collectors Review supported Auth0, Duo, Okta, and OneLogin activity sources for identity monitoring, access investigation, and account-risk analysis. Supported endpoint and device collectors Review supported endpoint alerts, event streams, and device inventories from leading endpoint and device-management platforms. Supported network and email security collectors Review supported firewall, secure-access, endpoint-detection, and email-security sources for investigation and response context. Supported vulnerability and posture collectors Review supported vulnerability assets, findings, and cloud-security alerts from Prisma Cloud, Qualys, Rapid7, and Tenable. Supported data, SIEM, and streaming collectors Review supported search, log, observability, streaming, and data sources for bringing existing security data into Nova. Supported container and DevOps collectors Review supported container, Kubernetes, source-control, and registry sources for workload inventory, audit, and runtime context. Supported SaaS audit collectors Review supported Salesforce, ServiceNow, and Slack audit sources for administrative and user-activity investigation. Supported threat intelligence collectors Review supported public, commercial, community, and customer-managed threat-intelligence sources for investigation, matching, and prioritization.

Review security priorities and progress Use connected priorities, coverage, ownership, and retained outcomes to understand risk without losing the evidence behind the summary. Modernize security operations with Nova Connect fragmented alert, evidence, investigation, ownership, detection-quality, and response work around measurable operating outcomes. Accelerate incident investigation Bring the alert, source events, timeline, affected assets and investigation findings together so analysts spend less time gathering context. Operate Nova for MSSP teams Manage security work across customers while keeping their data, owners, service targets, reports and response permissions separate.

Understand NQL event search Learn when to use NQL to narrow connected event evidence and how to review a search result responsibly. Understand NovaQL detection logic Understand NovaQL detection rules, the evidence they need and the checks required before a rule is activated. Understand Nova API access Understand how an entitled customer can pull approved Nova data or submit events through a secure, purpose-bound integration.

Sign in to Nova Use your organization's Nova address, enter your account details, and complete any required identity check. Set up your authenticator Enroll a compatible authenticator at the required sign-in step and verify it before continuing. Protect and use recovery codes Store one-time recovery codes safely and use one only when your normal authenticator is unavailable. Reset your Nova password Start from the approved sign-in page, verify your identity with an available method, and choose a strong new password. Resolve sign-in and recovery problems Check the account, address, device time, and available recovery path before escalating without exposing secrets.

Review Nova security and trust principles Understand the public principles used to protect access, customer scope, evidence, decisions, and supported action. Report a security concern responsibly Use Hansec's published security contact, protect sensitive details, and allow safe investigation before public disclosure. Contact Hansec Support Choose the right support reason and provide enough safe detail for the team to understand impact and begin work. Check service status and report an incident Confirm known service information, identify the affected scope, and report urgent impact through the approved support path.

Nova release notes Review the customer-visible product capabilities and operating boundaries introduced in each Nova release. Current limitations and availability Review the public boundaries that should be understood before evaluating or relying on a Nova capability. Nova glossary Use plain definitions for the public Nova terms that appear across evaluation, product, connection, trust, and support guidance.