About FLow Manager

Flow Manager Documentation

Flow Manager is a service that provides an API for storing, manipulating, retrieving, and analyzing Attack Flow, the graph data format for infosec. This site is meant to help Attack Flow and Flow Manager users understand how to create attack flow, store it retrieve it, and use it.

You can't have Flow Manager without Attack Flow

Many parts of this documentation are not Flow Manager specific. The reason is that the better you are at using Attack Flow, the more value you will get from Flow Manager. In support of this, the Flow Manager documentation has and will continue to add examples of using Attack Flow for multiple different use-cases, potentially with minimal or no need for Flow Manager. Don't get us wrong, even when not needed, Flow Manager will make using Attack Flow easier and more manageable. But don't be surprised when it isn't necessarily the hero of it's own story.

SPARQL: The query language powering Attack Flow

Another key to Flow Manager is SPARQL. Don't google it. The documentation that pops up first will make you want to put it at the bottom of your reading list and only when you come back to it half a decade from now will you realize how amazingly simple it is.

Instead, we'll take a very opinionated approach to SPARQL and using it for storing and querying attack flow. Honestly, as long as you try and learn how to use it for Flow Manager, and don't try and learn it as a whole, you'll find it's easier to write than most the stuff you deal with.