\chapter{User's Manual}
The following section has the purpose of explaining how to install and utilize any of the tool proposed in this research.

\subsection*{GraphViz}
GraphViz can be downloaded from its official website \cite{graphviz_site} in both executable and compileable versions, for all various widely-used operating systems. Once the tool is installed, it can be used via the command line interface. The website provides comprehensive documentation for both the GraphViz application itself and its specific extension, .DOT, which is utilized by the tool.

\subsection*{Rumint}
Rumint is available for download on its official website \cite{rumint_site}, offering both a compiled version and an executable version. It should be noted that Rumint is only available for Windows operating systems. Once installed and launched, you can load your pcap files in Rumint using the dedicated dropdown menu, keeping in mind the limitation of 30,000 packets. Once the file is loaded, you can manage the flow of packets using its VCR-like interface. To open the various visualization modes, including simultaneous views, you can select the desired view from the menu and click on it. All views follow the controlled flow of the application's main window. To replicate the tests conducted in this work, you can download the pcap files used from \cite{packet_captures_site}.

\subsection*{Tulip}
Tulip is available through its SourceForge page \cite{tulip_download} or you can access its source code on GitHub \cite{tulip_github}. If you choose to download the executable, please note that it is only provided for Windows. To replicate the examples provided, you can import your CSV data for visualization using the dedicated import procedure. This can be done by opening the Tulip application and using the appropriate icon for importing data. After importing the data, you can create a new panel and select the geographic view type. If Tulip does not automatically recognize the fields representing geolocation data, you can manually modify them through the view settings. Once you have obtained the desired view, you can modify various layout aspects according to your preferences. In this case, the modifications include changing the shape and color gradient. All these modifications can be easily made by following the documentation available on the Tulip website \cite{tulip_site}.

\subsection*{CodePulse}
Codepulse is available for Windows and can be downloaded from the official website of the application \cite{codepulse_site}. Once installed, you can launch CodePulse and initiate the first basic analysis by simply dragging and dropping the zip file of your project into the application. For the second part of the analysis, it is necessary to connect CodePulse to your application. A comprehensive guide is provided \cite{codepulse_guide}, detailing the various scenarios based on different types of applications to link to the tracker, both for Java and .NET projects. Once the two parts are connected, you can proceed with the various tests according to your needs.

\subsection*{Pixel Carpet}
Pixel Carpet is the first prototype encountered in this section. There are two possibilities for its usage: firstly, you can explore its functionalities through an online prototype available at the following link \cite{pixel_carpet_demo}, or secondly, there is the option to download the source code \cite{pixel_carpet_github} and run it locally on your machine for a more hands-on experience. 
By choosing the second option, you can insert your log files into the code by modifying the relevant line of code within the main file of the application. Once you launch the JavaScript application, for example using Node as performed in the previous test conducted in this work, you can access via browser the application with the url http://127.0.0.1:5500/.
\begin{lstlisting}[language=bash,caption={Command used for launch the application}]
node main.js
\end{lstlisting}

\subsection*{Visual Decision-Support for Live Digital Forensics}
In the case of Visual Decision-Support for Live Digital Forensics, the only option to use the application is to run it locally using the code provided by the developers \cite{LDF_github}. Along with the source code, the repository includes a brief but comprehensive guide on how to run the application. One additional requirement is to have a recent version of npm \cite{npm_site} installed on your machine. 

\subsection*{NetCapVis}
The NetCapVis prototype is only available through the online demo \cite{NetCapVis_site}. Please note that the demo allows you to either use the tool with a predefined data file or upload your own pcap file with a size limitation of 1 MB. In addition to the functionalities already mentioned in its description, a tutorial can be carried out that delves into the various elements that make up the application.

\subsection*{RopMate}
Also in the case of RopMate \cite{ropmate_github}, the developers provide along with the source code a set of instructions, both for setting up the environment and for starting the tool, which can always be visited via browser on localhost:5000.

\subsection*{RedEye}
Regarding RedEye, similar to the previous tools, instructions for execution can be found on the tool's GitHub page \cite{redeye_github}. Users can download the appropriate version based on their needs, including the executable and source code, tested for the main operating systems. The source code can be built manually or using Docker. It is important to note that both Red and Blue Team modes can be started from the same RedEye application binary.

\subsection*{Vulnus}
As mentioned in its description, Vulnus is only available through its online demo version \cite{vulnus_site}. The only recommendations provided are to use Firefox as the preferred browser, as recommended by the developers, and to use monitors and resolutions that allow for a complete display of the application.

\subsection*{Crumbs}
Through the Crumbs presentation page \cite{crumbs_site}, you can access both the online demo and download the source code. The demo does not provide customization options, while within the downloaded folder, you can make modifications regarding the Excel file that is loaded when the application is launched locally. The folder contains a file with instructions and guidelines to follow. The only prerequisite is to have Python installed on your machine (the instruction file specifies the various commands based on the version used).

\subsection*{SAGE}
For SAGE as well, there are two main usage modes, both of which are described step by step in the repository \cite{sage_github}. Regarding the tests conducted for this work, the Docker version was preferred over the executable version from the terminal for simplicity of adoption. If you opt for a different choice, it is important to install the various requirements listed in the instructions. Both versions have been tested and are functional. If you wish to replicate the tests conducted in this work, you can obtain the alerts used through \cite{suricata_alerts_dataset}.

\subsection*{Vulnex}
Finally, as far as Vulnex is concerned, via its Github page \cite{vulnex_github} it's possible to download its source files to be built and ran via Docker, as indicated by the guide. As mentioned during its description, the tool basically shows an example, defined as a demo, which is given in Chapter 4.1, but it is also possible to link and analyse one's own application via the Eclipse Steady Backend \cite{eclipse_steady}, through the indications provided in the guide available in the repository. Unfortunately, this was not possible during the course of our work, so we cannot guarantee that the procedure indicated will work.