Console tour¶

The FreeDR console is a local, single-user web application served by the FreeDR service at http://127.0.0.1:29173/ (default port). It works only on the protected host itself (loopback) and uses the local API for everything it shows; nothing is sent to a cloud service unless you enable an optional provider (AI, threat intel, web research).

Use 127.0.0.1, not localhost

The service checks the browser's Host header exactly. Open http://127.0.0.1:29173/; http://localhost:29173/ is rejected with invalid request.

When you are not signed in, / shows Unlock your console: one password field and Sign in. The password is the one set during installation.

Sessions last 12 hours. Restarting the service, changing the password or signing out ends sessions. At most 16 sessions exist at once; the oldest is dropped first.
Five failed attempts within a minute return Too many attempts. Wait a moment and try again.
Deep links (for example from a tray notice) are kept through sign-in.
Collection and detection continue while the console is locked.

Layout¶

Sidebar: Overview, Alerts, Search, Alert rules, Cases, Health, Settings.
Top bar: breadcrumb, Go to… quick navigation (Ctrl+K; jump to a page or a saved view), connection pill (Connecting, Ready, Degraded, Unavailable) and Sign out.
Isolation banner: shown on every page while host isolation is active, being changed, or possibly active (unverified).
Every page has a URL (/?view=alerts&alert=<id>, /?view=cases&case=<id>, /?view=detections&rule=<id>, Search queries and ranges), so links and browser back/forward work.

Overview¶

Summary of this host for the Last 24 hours or Last 7 days.

Area	Shows
Cards	Urgent alerts (unresolved Critical/High), Investigations (open or in-progress cases), Rule operation (enabled/installed rules), Collection health. Click a card to open the matching page. Counts based on the first 100 records say "or more".
Pending exclusions	Rule exclusions proposed by the AI investigator, with Approve / Reject. Nothing is suppressed until you approve. Hidden when empty.
Alert activity	Alerts over time by severity (paged, up to 5,000 alerts; marked incomplete if capped).
Observed telemetry	Retained events by source family.
Recent evidence	Latest retained events, identical repeats grouped; Explore events opens Search.
Priority alerts	Unresolved, non-muted alerts grouped by rule, most severe first.
Collection & detection health	Agent ready, degraded component count; Full health opens Health.
Resume work	Recent cases and saved searches.

Buttons: Refresh, Isolate host (blocks all non-loopback network traffic; the console stays reachable) and Release isolation. Both ask for confirmation.

Alerts¶

Triage detections.

Tabs: New, Investigating, Resolved, All.
Filters: text (alert or rule name), severity (Critical, High, Medium, Low, Informational), outcome (True positive, Expected activity, False positive), case membership (Any / Not in a case / In a case), date range.
Detection queue: paged list with a severity summary, Group repeats, and Columns (detected, severity, alert, entity, state, case). Select rows for bulk Review (mark investigating), Resolve or Add to case.
Muted rules are listed above the queue with time left and Unmute.

Selecting an alert opens the detail panel:

Tab	Content
Why it fired	Severity, Muted marker if recorded during a mute, state, outcome, rule description, detection time, confidence, case, process/file, host context (for alerts in a case), Explain this alert (AI), links to Inspect evidence in Search, Open in SQL Hunt, Open case, and IDs.
Evidence	The triggering event with all retained fields and a Process tree button where a process is known.
Activity	Nearby events within ±1, ±5, ±15 or ±60 minutes (context only; not what matched).

Footer actions: Investigate, Create case, Add to case, False positive / mute…, and Resolve with an outcome.

False positive / mute… opens Tune this rule: choose fields of the triggering event to match, optionally Ask AI to draft, Preview the effect, then either Save exclusion (a user exception for this rule only; events are still collected) or Mute the rule (whole rule or rule plus selected fields) for 24 hours or 7 days. Muted matches are recorded and marked muted but create no cases, AI runs or notifications.

If an alert already belongs to another case, an Alert assignment conflict dialog offers Open existing case or Merge cases.

Search¶

Event search over retained evidence.

Query mode: a Hunt WHERE expression, for example event_type = 'process.start' AND image_path LIKE '%powershell%'. Builder mode: pick field, operator, value and AND/OR.
Time range: Last 15 minutes, Last hour, Last 24 hours, Last 7 days, Custom, All time.
Events over time: exact 12-bucket histogram for the whole query; click a bar to zoom, Back / reset zoom to return.
Fields sidebar with a filter.
Events tab: table with every event field as a column (paged). Click a cell for the top values of that field across all matching events; right-click a cell for Add to search / Exclude from search. Columns (show, hide, pin, reorder), Sort, Select page, Export (Export filtered result or Export selected rows as CSV).
Statistics tab: top 10 values of any field with counts and Add to search.
Event details inspector: Summary, All fields (with filter and Hide empty), Related activity; Add to case, Copy ID. COM class/interface GUIDs show their registered names.
Save view / Open saved use the local saved-query library (with favourites).
SQL Hunt tab switches to the SQL editor.

SQL Hunt¶

Read-only DuckDB SQL over the logical events table.

Describe what to find + Draft SQL with AI or Draft as rule: the AI writes a draft into the editor. It never runs a query or saves a rule. Requires an AI provider in Settings.
Query editor: Run query (Ctrl+Enter), Validate syntax (no evidence scanned), Cancel, field completion (Ctrl+Space), Export CSV, Export NDJSON.
Results: table with event actions (including Process tree for rows with a process); grouped results can be shown as a Chart.
Available fields: the schema of the events table with a filter.
Save query, Open saved, Use as rule (opens the rule editor).

Alert rules¶

The header shows detection engine status (healthy, or degraded with the reason).

Catalogue tab: installed rules with search (name, category, ATT&CK technique) and filters (state, category, required telemetry, built-in/custom). Select rules for bulk Enable, Disable or Export (freedr-selected-rules.json).
Coverage tab: rules grouped by ATT&CK technique (or category) with enabled counts. This is declared coverage only, not proof of detection.
Rule detail: state, built-in/custom, severity, confidence, run interval (2, 8 or 15 minutes), lookback, version, category, required telemetry, ATT&CK, rule ID, SQL (read-only for built-ins) and investigation playbook. Actions: Use as starting point (built-in) or Edit custom rule, Duplicate (custom), Test, View alerts, Export, Version history (custom: compare versions and Restore selected as new version).
Effective rule logic: built-in exclusions (versioned with the rule), user exceptions (add, remove, approve/reject AI-proposed ones), mutes and tuning history.
Recent runs for the selected rule.

New rule opens the rule editor: start from a template (Blank, Process execution, Registry persistence, Repeated process starts), set name, kind (Each matching event or Count threshold per run), severity, confidence, category, ATT&CK techniques, required telemetry, description, alert text and investigation note. Build the query with the column picker and Generate SQL, add built-in exclusions, Validate rule, Test rule against the last 24 hours or 7 days, choose Run every and Look back, then Save disabled or Save & enable. Built-in rules stay read-only.

Cases¶

Investigations and their evidence.

List: filter by text, status (Open, In progress, Resolved, Closed, Merged) and severity; Group repeats; New case.
Case header: number, title, status, severity, assessment, outcome, counts, and Start investigation, Resolve, Close case (Resolve and Close need an outcome and conclusion first), Export report.

Tab	Content
Summary	Deterministic case summary built from retained evidence (alerts by rule, related cases, timeline, attached events, enrichment, response jobs, unresolved gaps, host context, investigation steps you can run as live checks). Pending AI-proposed exclusions for this case. Facts, not a verdict.
Evidence	Linked alerts and events with Inspect, Pin (to the case timeline), Annotate in notes, Remove from case; Add from Alerts / Add from Search; move selected evidence to a new case (split).
Investigation	Why linked (automatic correlation reasons), findings and hypotheses (Record finding), and Targeted enrichment (file hash, file signature, hash/IP/domain reputation for linked evidence). Unknown or not-found results do not mean safe.
AI investigator	Ask a question, follow up in the same session, stop a run, view report, cited findings, evidence gaps, token use and tool history; Review response draft; public web research (search or read a URL). See AI features.
Response	Case-scoped response (see below).
Timeline	Pinned evidence and notes in time order; Load complete timeline.
Notes	Append-only notes.
Activity	Case audit trail.

Assessment, conclusion and case details (expandable): set assessment (unknown, suspicious, malicious, benign) with reason and supporting events; outcome (True positive, Expected activity, False positive, Inconclusive), closure reason and conclusion; edit title/description/severity; Lock automatic correlation; Reopen case with a reason when resolved or closed.

Response tab¶

Choose a linked alert or event and Inspect current targets.
Add this exact action for each target you want. Supported actions: terminate processes, quarantine file, restore quarantined file, disable exact persistence, restore captured persistence, block traffic, remove traffic block, isolate host, release isolation, permanently delete file (irreversible).
Order the steps (up to 32), enter a purpose and Run selected actions.
Saved plans and outcomes shows each job, its state and the observed outcome per step, with Cancel future effects (does not undo completed changes) and Restore now / Release now where recovery is possible.

An AI response draft can be imported here for review; nothing runs until you submit it.

Case HTML report¶

Export report downloads one self-contained HTML file (no scripts or external links) with the case record, deterministic summary, alerts and rules, enrichment, AI verdicts (labelled as AI), response jobs, notes, findings and audit trail. Long lists are capped and the file stops at 4 MiB; each cut is named in the report. The report contains local evidence (paths, command lines), so handle it accordingly.

Process tree¶

Available from an alert's triggering evidence, SQL Hunt result rows and case summary tables when they include a process (Process tree button). It shows the ancestor chain, the selected process and its children/grandchildren started near that time, with image, PID, start/end, account, session, command line, offline tags, new-to-host and signer flags, and any alerts on those processes. If the process cannot be resolved exactly (ambiguous PID, exited, not retained), the dialog says why instead of guessing.

Health¶

Collection, detection and storage diagnostics, with Export diagnostics and Refresh. See Health and status.

Settings¶

Section	What you can do
Collection	View each component and its state. Collection is set in the service configuration; changes need a service restart.
Sources	Check optional Windows telemetry sources (Sysmon, PowerShell script-block logging, audit policy, event channels, Microsoft Defender) with a colour status, enable/disable/restore them, Install Sysmon, and see an audit of every change. Defender is reported only. Turning a source off raises an alert.
Storage	View hot/cold sizes, free disk and hot age (read-only), and set Retention period (1-3650 days). Shortening retention requires confirmation.
Enrichment & AI	Enable threat-intel providers and enter their keys (write-only), choose AI provider, model and thinking level, enable AI investigation, daily token limit, Let AI contain threats it finds, and public web research; check provider access.
Password & access	Change the password (at least 12 characters; signs out all sessions) and sign out of this browser.
Detection	Installed/enabled/disabled rule counts; link to Alert rules.
Notifications	Windows notifications for new alerts and minimum severity.
Appearance	Browser-local: time zone (device or UTC), absolute/relative times, table density, rows per page, auto-refresh of Overview and Health.
About & status	Agent version, ready state, component count, degraded components.

Not available

Hot retention (how long evidence stays in the hot database) cannot be changed in Settings; it is shown read-only.

Setup wizard¶

FreeDR-Setup.exe is a native Windows installer (not part of the web console). Pages: Welcome (optional Import configuration file), Administrator password, AI investigator, Threat-intel keys, progress, Finish (opens the console). FreeDR-Setup.exe /config <file.json> installs without UI. See Getting started.