> ## Documentation Index
> Fetch the complete documentation index at: https://dsp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Install DSP and complete the simplest XDR/NDR customer POC run in a few minutes.

# Quick Start

This page is the shortest supported path to a first DSP result.

<Info>
  For the first run, use **local** execution and the **normal** profile. You do not need webshell mode or XDR API credentials to verify that DSP itself is working.
</Info>

## 1. Check prerequisites

You need a Linux operator host with:

* Python **3.11 or newer**
* `git` and `curl`
* network reachability to the authorized target network
* an approved CIDR and test window

Check the software requirements first:

```bash theme={null}
python3 --version
git --version
curl --version
```

If the available Python runtime is older than 3.11, follow [Installation](/installation) before continuing.

## 2. Install DSP

Run the bootstrap installer:

```bash theme={null}
curl -fsSL https://raw.githubusercontent.com/xdr-labs/xdr-poc-script/release/v1.4.0-rc/install-dsp.sh | bash
```

The installer uses `$HOME/xdr-poc-script` by default, clones or updates DSP, creates `.venv`, installs the package, and opens the operator menu. Existing configuration and run artifacts under `~/.dsp/` are preserved.

If the menu is not open, launch it with:

```bash theme={null}
$HOME/xdr-poc-script/dsp-menu.sh
```

## 3. Configure the first run

Choose **2 — Configure environment** and set only these values for the simplest test:

| Setting        | Recommended first value                               |
| -------------- | ----------------------------------------------------- |
| Target network | Your **authorized** CIDR, for example `10.10.10.0/24` |
| Execution mode | `local`                                               |
| Profile        | `normal`                                              |

<Warning>
  Do not use the example CIDR unless it is actually approved for the POC. DSP intentionally generates security-relevant network activity.
</Warning>

Leave webshell settings alone for the first run. They are only needed when traffic must originate from a remote host inside the customer environment.

## 4. Run

Choose **3 — Run scenario**.

For direct CLI use, activate the DSP virtual environment first:

```bash theme={null}
source "$HOME/xdr-poc-script/.venv/bin/activate"
dsp run --profile normal --target-net 10.10.10.0/24
```

Replace the example CIDR with the authorized target network.

## 5. Review the result

The fastest check is **4 — Show latest report** in the menu.

Each run is also stored under:

```text theme={null}
~/.dsp/runs/<run_id>/
```

Start with these three files:

| File                        | Why to check it first                                             |
| --------------------------- | ----------------------------------------------------------------- |
| `traffic_summary.json`      | Confirms what activity DSP attempted/generated                    |
| `report.md`                 | Human-readable run summary                                        |
| `verification_checklist.md` | Place to record matching XDR/NDR detections and customer evidence |

Additional artifacts such as `events.db`, `events.jsonl`, and `validation.json` are useful for deeper verification and troubleshooting.

## What counts as success?

A successful DSP run means the **activity-generation and evidence pipeline** worked. It does not guarantee that the XDR/NDR product generated an alert.

For the customer POC, verify the same time window, source/destination hosts, and scenario type in the XDR/NDR console, then record the matching alert or case identifiers in the evidence templates.

## Next steps

<CardGroup cols={2}>
  <Card title="POC workflow" icon="diagram-project" href="/poc-program">Turn a DSP run into a repeatable customer validation process.</Card>
  <Card title="Scenario coverage" icon="radar" href="/scenarios">See which activity types the current profile can generate.</Card>
  <Card title="Webshell mode" icon="terminal" href="/execution-modes">Use an authorized internal host as the execution origin when needed.</Card>
  <Card title="Reports & evidence" icon="file-lines" href="/reports-and-evidence">Understand the run artifacts and evidence chain.</Card>
</CardGroup>