Full Getting Started Guide

1. Sign in

Visit builder.protoevidence.com, select Get Started, and complete Corelight Google Workspace sign-in.

2. Describe the experiment

State the behavior, integration, detection, or question you want to validate. A narrow, testable idea produces the most useful workspace.

3. Create and save the private link

CanWeBuildIt displays a URL like https://abcd1234.builder.protoevidence.com/?auth=….

Treat this complete URL like a password. Anyone who has it can establish a session in your environment. Save it in an approved secret manager. The service cannot recover it because it stores only a hash.

4. Open the workspace

The first visit exchanges the private token for a Secure, HttpOnly browser cookie and removes the token from the address bar. From then on, use the clean workspace URL.

5. Build

The detection workspace includes code-server, Docker, Python, Zeek, Suricata, tshark, and common command-line tools.

6. Return or re-authenticate

Use the clean URL while the browser session is valid. If the cookie is cleared or expires, reopen the saved complete URL.

7. Respect expiry

Every environment has a hard termination deadline. Move durable work to its project repository before that deadline.

Troubleshooting and Help