From a9c714d402c4503573d0f6f52441515e7bce5186 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 17 Dec 2024 10:56:47 -0600 Subject: [PATCH 1/5] Make terms lowercase in 'Get Started' section --- .../about-cse-insight-ui.md | 14 +-- .../cloud-siem-content-catalog.md | 2 +- .../cloud-siem-ui.md | 94 +++++++++---------- .../cse-heads-up-display.md | 62 ++++++------ .../insight-generation-process.md | 68 +++++++------- .../onboarding-checklist-cse.md | 24 ++--- 6 files changed, 132 insertions(+), 132 deletions(-) diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md index eb6372cef7..a648ddfeb4 100644 --- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md +++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md @@ -23,7 +23,7 @@ Cloud SIEM displays insights and the signals attached to them in the Cloud SIEM ### List view -This screenshot shows the **Insights** page in List view.  +This screenshot shows the **Insights** page in list view.  Insights page @@ -39,7 +39,7 @@ Here’s one row from the List view. The numbered definitions below correspond t 1. **Global Confidence**. If sufficient data is available, a [Global Confidence score](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/) for the insight is shown.  1. **Assignee**. The analyst assigned to the Incident. 1. The [MITRE ATT&CK](https://attack.mitre.org/) tactics and techniques exhibited by the insight. -1. **Severity**. The severity of the insight. The value is a function of the configured Entity Activity Score threshold for insight generation. For more information, see [About Insight Severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process#about-insight-severity). +1. **Severity**. The severity of the insight. The value is a function of the configured entity activity score threshold for insight generation. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process#about-insight-severity). 1. **Entity**. The entity associated with the insight. 1. **Signal Data**. This area has three bits of information: * The count of signals that caused the insight to be created. @@ -62,7 +62,7 @@ You can switch back to the list view by clicking the **Show List** icon, near th You can use the **Filters** area near the top of the page to narrow down the insights that appear on the insights page. You can filter by: * Assignee -* [Custom Resolution](/docs/cse/administration/manage-custom-insight-resolutions/) +* [Custom resolution](/docs/cse/administration/manage-custom-insight-resolutions/) * Created * Entity * Event Time @@ -91,7 +91,7 @@ The left pane of the insight details page displays detailed information about th Insight details -1. **Actions.** The [Insight Actions](/docs/cse/administration/create-cse-actions#insight-actions) defined in your environment. +1. **Actions.** The [insight actions](/docs/cse/administration/create-cse-actions#insight-actions) defined in your environment. 1. **Close Insight.** Use this option to close an insight. When you click this option, you’re prompted to select an insight resolution. 1. **Delete Icon.** Use this option to delete an insight. You’ll be prompted to confirm your choice. 1. **Status.** Current status of the insight. @@ -138,7 +138,7 @@ Below the signal timeline, you’ll see a list of signals. By default, only atta Signal list area -1. **Remove** button. Removes multiple signals selected with the checkbox. You cannot select all signals for removal. If you do, the **Remove** button is disabled and this message appears when you hover over it with your mouse: **Bulk removal of signals is disabled as a minimum of 1 signal must be attached to the Insight. Deselect 1 or more signals to enable bulk removal.** +1. **Remove** button. Removes multiple signals selected with the checkbox. You cannot select all signals for removal. If you do, the **Remove** button is disabled and this message appears when you hover over it with your mouse: **Bulk removal of signals is disabled as a minimum of 1 signal must be attached to the insight. Deselect 1 or more signals to enable bulk removal.** 1. **Checkbox**. Click to select multiple signals for removal. 1. **Signal name**. Click to view signal details. 1. **Remove** button. Removes an individual signal. @@ -255,8 +255,8 @@ When you select an entity on the page, the right pane displays details about tha * Geographic location * Suppression Status * Tags -* [Entity Criticality](/docs/cse/records-signals-entities-insights/entity-criticality), if it is set to something other than the default -* Metadata such as geographic location, Inventory information, the [Network Blocks](/docs/cse/administration/create-use-network-blocks) it falls within, as applicable, and so on. +* [Entity criticality](/docs/cse/records-signals-entities-insights/entity-criticality), if it is set to something other than the default +* Metadata such as geographic location, Inventory information, the [network blocks](/docs/cse/administration/create-use-network-blocks) it falls within, as applicable, and so on. * A signal graph if the entity was the primary entity in any signals during the detection window (time/date is the horizontal axis and severity of each signal is the vertical axis; the icon/color for each point depends on the signal type) * Lists of the recent signals and insights the entity has been associated with, and links to each object’s details page. diff --git a/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog.md b/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog.md index a44af49b0c..7cd9eeb8d6 100644 --- a/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog.md +++ b/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog.md @@ -7,7 +7,7 @@ description: The Cloud SIEM Content Catalog shows the out-of-the-box Rules, Sche import useBaseUrl from '@docusaurus/useBaseUrl'; -The Cloud SIEM Content Catalog is a public GitHub repository of Cloud SIEM's Rules, Schema, Mappings, and Parsers. This repository serves as a single place to view Cloud SIEM content in both markdown form and CSVs. This catalog is automatically generated based on content included out-of-the-box as it is released. +The Cloud SIEM Content Catalog is a public GitHub repository of Cloud SIEM's rules, schema, mappings, and parsers. This repository serves as a single place to view Cloud SIEM content in both markdown form and CSVs. This catalog is automatically generated based on content included out-of-the-box as it is released. Access the Cloud SIEM Content Catalog here: [https://github.com/SumoLogic/cloud-siem-content-catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md) diff --git a/docs/cse/get-started-with-cloud-siem/cloud-siem-ui.md b/docs/cse/get-started-with-cloud-siem/cloud-siem-ui.md index 16af5a85d6..d5bf4db534 100644 --- a/docs/cse/get-started-with-cloud-siem/cloud-siem-ui.md +++ b/docs/cse/get-started-with-cloud-siem/cloud-siem-ui.md @@ -35,10 +35,10 @@ The classic UI is the traditional way to navigate in Sumo Logic. For more inform This menu appears at the top of the Cloud SIEM screen:
Top menu bar Use the top menu to access: -* Insights menu icon [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View Insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. -* Signals menu icon [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Signals, indicators for events of interest that fire when rule conditions are met. -* Entities menu icon [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View Entities, unique actors encountered in incoming messages, such as a user, IP address, or host. -* Records menu icon [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Records, collections of normalized data created from a message. +* Insights menu icon [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. +* Signals menu icon [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View signals, indicators for events of interest that fire when rule conditions are met. +* Entities menu icon [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View entities, unique actors encountered in incoming messages, such as a user, IP address, or host. +* Records menu icon [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View records, collections of normalized data created from a message. * Content menu icon [**Content**](#content-menu). Create Cloud SIEM content, such as rules. * Configuration menu icon [**Configuration**](#configuration-menu). Configure Cloud SIEM. * Help menu icon **Help**. Access feature guides, documentation, release notes, and system status. @@ -55,9 +55,9 @@ Use the **Content** menu to access: * [**Threat Intelligence**](/docs/cse/administration/create-custom-threat-intel-source/). Manage sources of threat intelligence indicators, individual data points about threats that are gathered from external sources. * [**Match Lists**](/docs/cse/match-lists-suppressed-lists/create-match-list/). Manage match lists, lists of important indicators and identifiers that you want to be addressed by rules. * [**File Analysis**](/docs/cse/rules/import-yara-rules/). Manage sources for YARA rules. -* [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom Insights, methods to generate Insights on some basis other than Entity Activity Scores. +* [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom insights, methods to generate insights on some basis other than entity Activity Scores. * [**Network Blocks**](/docs/cse/administration/create-use-network-blocks/). Manage network blocks, groups of IP addresses that you can use in rules. -* [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress Signal generation. +* [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress signal generation. * [**MITRE ATT&CK Coverage**](/docs/cse/administration/mitre-coverage/). View the MITRE ATT&CK Threat Coverage Explorer, a screen that shows the MITRE ATT&CK adversary tactics, techniques, and procedures that are covered by rules in your system. #### Configuration menu @@ -66,20 +66,20 @@ The **Configuration** menu allows you to configure Cloud SIEM. To access this me Use the **Configuration** menu to access: * **Incoming Data** - * [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a Record from the key-value pairs extracted from messages. + * [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a record from the key-value pairs extracted from messages. * **Entities** - * [**Groups**](/docs/cse/records-signals-entities-insights/create-an-entity-group/). Manage groupings of Entities that can be used in rules. - * [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in Records during the parsing and mapping process. + * [**Groups**](/docs/cse/records-signals-entities-insights/create-an-entity-group/). Manage groupings of entities that can be used in rules. + * [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in records during the parsing and mapping process. * [**Custom Types**](/docs/cse/records-signals-entities-insights/create-custom-entity-type/). Manage custom types to more precisely categorize entities. - * [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of Signals for specific Entities based on some risk factor or other consideration. + * [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of signals for specific entities based on some risk factor or other consideration. * **Workflow** - * [**Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the Insight detection threshold. - * [**Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom Insight statuses. - * [**Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom Insight resolutions. - * [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to Insights, Signals, Entities, and Rules. + * [**Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the insight detection threshold. + * [**Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom insight statuses. + * [**Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom insight resolutions. + * [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to insights, signals, entities, and rules. * **Integrations** - * [**Sumo Logic**](/docs/cse/ingestion/sumo-logic-ingest-mapping/). Configure mapping of message fields to Record attributes. - * [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an Entity, IOC, or data encountered in a Record. + * [**Sumo Logic**](/docs/cse/ingestion/sumo-logic-ingest-mapping/). Configure mapping of message fields to record attributes. + * [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an entity, IOC, or data encountered in a record. * [**Actions**](/docs/cse/administration/create-cse-actions/). Create actions to issue a notification to another service when certain events occur in Cloud SIEM. * [**Enrichment**](/docs/cse/integrations/enrichments-and-indicators/). Manage elements that enrich data in Cloud SIEM. * [**Automation**](/docs/cse/automation/). Create smart actions that trigger automatically when certain events occur in Cloud SIEM. @@ -93,22 +93,22 @@ The new UI provides a streamlined way to navigate in Sumo Logic. For more inform Click **Cloud SIEM** in the main Sumo Logic menu to open the sidebar menu.
Cloud SIEM sidebar menu Use the **Cloud SIEM** sidebar menu to access: -* **Search Cloud SIEM**. Search for [Insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/), [Signals](/docs/cse/records-signals-entities-insights/view-records-signal/), [Entities](/docs/cse/records-signals-entities-insights/view-manage-entities/), and [Records](/docs/cse/records-signals-entities-insights/view-records-signal/). When you click in the search bar, you're prompted to select one of those types. Once you select a type, you're presented with a list of fields to filter on. +* **Search Cloud SIEM**. Search for [insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/), [signals](/docs/cse/records-signals-entities-insights/view-records-signal/), [entities](/docs/cse/records-signals-entities-insights/view-manage-entities/), and [records](/docs/cse/records-signals-entities-insights/view-records-signal/). When you click in the search bar, you're prompted to select one of those types. Once you select a type, you're presented with a list of fields to filter on. * **Security Events** * [**SIEM Overview**](/docs/cse/get-started-with-cloud-siem/cse-heads-up-display/). View the Cloud SIEM Heads Up Display. - * [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View Insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. - * [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Signals, indicators for events of interest that fire when rule conditions are met. - * [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View Entities, unique actors encountered in incoming messages, such as a user, IP address, or host. - * [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Records, collections of normalized data created from a message. + * [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. + * [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View signals, indicators for events of interest that fire when rule conditions are met. + * [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View entities, unique actors encountered in incoming messages, such as a user, IP address, or host. + * [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View records, collections of normalized data created from a message. * **Security Detection** * [**Rules**](/docs/cse/rules/). Manage rules, sets of logic that create signals based on information in incoming records. * [**Rule Tuning**](/docs/cse/rules/rule-tuning-expressions/). Manage rule tuning expressions, which are extensions to rules. * [**Threat Intelligence**](/docs/cse/administration/create-custom-threat-intel-source/). Manage sources of threat intelligence indicators, individual data points about threats that are gathered from external sources. * [**Match List**](/docs/cse/match-lists-suppressed-lists/create-match-list/). Manage match lists, lists of important indicators and identifiers that you want to be addressed by rules. * [**File Analysis**](/docs/cse/rules/import-yara-rules/). Manage sources for YARA rules. - * [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom Insights, methods to generate Insights on some basis other than Entity Activity Scores. + * [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom insights, methods to generate insights on some basis other than entity Activity Scores. * [**Network Blocks**](/docs/cse/administration/create-use-network-blocks/). Manage network blocks, groups of IP addresses that you can use in rules - * [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress Signal generation. + * [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress signal generation. * [**MITRE ATT&CK Coverage**](/docs/cse/administration/mitre-coverage/). View the MITRE ATT&CK Threat Coverage Explorer, a screen that shows the MITRE ATT&CK adversary tactics, techniques, and procedures that are covered by rules in your system. #### Top menu @@ -128,31 +128,31 @@ The **Go To...** menu allows you to launch Sumo Logic features, including for Cl Use the **Go To...** menu to access these Cloud SIEM features: * [**Actions**](/docs/cse/administration/create-cse-actions/). Create actions to issue a notification to another service when certain events occur in Cloud SIEM. -* [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an Entity, IOC, or data encountered in a Record. -* [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of Signals for specific Entities based on some risk factor or other consideration. -* [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom Insights, methods to generate Insights on some basis other than Entity Activity Scores. +* [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an entity, IOC, or data encountered in a record. +* [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of signals for specific entities based on some risk factor or other consideration. +* [**Custom Insights**](/docs/cse/records-signals-entities-insights/configure-custom-insight/). Manage custom insights, methods to generate insights on some basis other than entity Activity Scores. * [**Custom Types**](/docs/cse/records-signals-entities-insights/create-custom-entity-type/). Manage custom types to more precisely categorize entities. * [**Enrichment**](/docs/cse/integrations/enrichments-and-indicators/). Manage elements that enrich data in Cloud SIEM. -* [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View Entities, unique actors encountered in incoming messages, such as a user, IP address, or host. +* [**Entities**](/docs/cse/records-signals-entities-insights/view-manage-entities/). View entities, unique actors encountered in incoming messages, such as a user, IP address, or host. * [**File Analysis**](/docs/cse/rules/import-yara-rules/). Manage sources for YARA rules. * [**Ingest Mappings**](/docs/cse/ingestion/sumo-logic-ingest-mapping/). Manage the mapping for data ingestion from a data source to Cloud SIEM. -* [**Insight Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the Insight detection threshold. -* [**Insight Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom Insight resolutions. -* [**Insight Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom Insight statuses. -* [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View Insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. -* [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a Record from the key-value pairs extracted from messages. +* [**Insight Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the insight detection threshold. +* [**Insight Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom insight resolutions. +* [**Insight Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom insight statuses. +* [**Insights**](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/). View insights, clusters of events that require investigation. An insight is created when a high level of suspicious activity is detected for a single entity, such as a user, IP address, host, or domain. +* [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a record from the key-value pairs extracted from messages. * [**Match Lists**](/docs/cse/match-lists-suppressed-lists/create-match-list/). Manage match lists, lists of important indicators and identifiers that you want to be addressed by rules. * [**MITRE ATT&CK Coverage**](/docs/cse/administration/mitre-coverage/). View the MITRE ATT&CK Threat Coverage Explorer, a screen that shows the MITRE ATT&CK adversary tactics, techniques, and procedures that are covered by rules in your system. * [**Network Blocks**](/docs/cse/administration/create-use-network-blocks/). Manage network blocks, groups of IP addresses that you can use in rules. -* [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in Records during the parsing and mapping process. -* [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Records, collections of normalized data created from a message. +* [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in records during the parsing and mapping process. +* [**Records**](/docs/cse/records-signals-entities-insights/view-records-signal/). View records, collections of normalized data created from a message. * [**Rule Tuning**](/docs/cse/rules/rule-tuning-expressions/). Manage rule tuning expressions, which are extensions to rules. * [**Rules**](/docs/cse/rules/). Manage rules, sets of logic that create signals based on information in incoming records. -* **Search Cloud SIEM**. Search for [Insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/), [Signals](/docs/cse/records-signals-entities-insights/view-records-signal/), [Entities](/docs/cse/records-signals-entities-insights/view-manage-entities/), and [Records](/docs/cse/records-signals-entities-insights/view-records-signal/). When you click in the search bar, you're prompted to select one of those types. Once you select a type, you're presented with a list of fields to filter on. +* **Search Cloud SIEM**. Search for [insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/), [signals](/docs/cse/records-signals-entities-insights/view-records-signal/), [entities](/docs/cse/records-signals-entities-insights/view-manage-entities/), and [records](/docs/cse/records-signals-entities-insights/view-records-signal/). When you click in the search bar, you're prompted to select one of those types. Once you select a type, you're presented with a list of fields to filter on. * [**SIEM Overview**](/docs/cse/get-started-with-cloud-siem/cse-heads-up-display/). View the Cloud SIEM Heads Up Display. -* [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View Signals, indicators for events of interest that fire when rule conditions are met. -* [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress Signal generation. -* [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to Insights, Signals, Entities, and Rules. +* [**Signals**](/docs/cse/records-signals-entities-insights/view-records-signal/). View signals, indicators for events of interest that fire when rule conditions are met. +* [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/). Manage suppressed lists, lists of indicators that can suppress signal generation. +* [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to insights, signals, entities, and rules. * [**Threat Intelligence**](/docs/cse/administration/create-custom-threat-intel-source/). Manage sources of threat intelligence indicators, individual data points about threats that are gathered from external sources. #### Configuration menu @@ -163,18 +163,18 @@ Use the **Configuration** menu to access: * **Cloud SIEM Integrations** * [**Ingest Mappings**](/docs/cse/ingestion/sumo-logic-ingest-mapping/). Manage the mapping for data ingestion from a data source to Cloud SIEM. - * [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a Record from the key-value pairs extracted from messages. - * [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an Entity, IOC, or data encountered in a Record. + * [**Log Mappings**](/docs/cse/schema/create-structured-log-mapping/). Manage log mappings, maps that tell Cloud SIEM how to build a record from the key-value pairs extracted from messages. + * [**Context Actions**](/docs/cse/administration/create-cse-context-actions/). Create actions that a Cloud SIEM analyst can use to query an external system for information about an entity, IOC, or data encountered in a record. * [**Actions**](/docs/cse/administration/create-cse-actions/). Create actions to issue a notification to another service when certain events occur in Cloud SIEM. * [**Enrichment**](/docs/cse/integrations/enrichments-and-indicators/). Manage elements that enrich data in Cloud SIEM. * [**Automation**](/docs/cse/automation/). Create smart actions that trigger automatically when certain events occur in Cloud SIEM. * **Cloud SIEM Entities** - * [**Groups**](/docs/cse/records-signals-entities-insights/create-an-entity-group/). Manage groupings of Entities that can be used in rules. - * [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in Records during the parsing and mapping process. + * [**Groups**](/docs/cse/records-signals-entities-insights/create-an-entity-group/). Manage groupings of entities that can be used in rules. + * [**Normalization**](/docs/cse/schema/username-and-hostname-normalization/). Manage normalizing usernames and hostnames in records during the parsing and mapping process. * [**Custom Types**](/docs/cse/records-signals-entities-insights/create-custom-entity-type/). Manage custom types to more precisely categorize entities. - * [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of Signals for specific Entities based on some risk factor or other consideration. + * [**Criticality**](/docs/cse/records-signals-entities-insights/entity-criticality/). Adjust the severity of signals for specific entities based on some risk factor or other consideration. * **Cloud SIEM Workflow** - * [**Insight Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the Insight detection threshold. - * [**Insight Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom Insight statuses. - * [**Insight Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom Insight resolutions. - * [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to Insights, Signals, Entities, and Rules. \ No newline at end of file + * [**Insight Detection**](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/). Set the insight detection threshold. + * [**Insight Statuses**](/docs/cse/administration/manage-custom-insight-statuses/). Manage custom insight statuses. + * [**Insight Resolutions**](/docs/cse/administration/manage-custom-insight-resolutions/). Manage custom insight resolutions. + * [**Tag Schemas**](/docs/cse/administration/create-a-custom-tag-schema/). Manage schemas for tags, metadata you can attach to insights, signals, entities, and rules. \ No newline at end of file diff --git a/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md b/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md index 33266444db..7e45967d58 100644 --- a/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md +++ b/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md @@ -1,28 +1,28 @@ --- id: cse-heads-up-display title: Cloud SIEM Heads Up Display -description: Learn about Cloud SIEM's Heads Up Display (HUD), a UI that provides an at-a-glance overview of Insight status and activity. +description: Learn about Cloud SIEM's Heads Up Display (HUD), a UI that provides an at-a-glance overview of insight status and activity. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This topic describes Cloud SIEM *Heads Up Display (HUD)*, the landing page for the Cloud SIEM UI. The HUD provides an at-a-glance overview of Insight status and activity. +This topic describes Cloud SIEM *Heads Up Display (HUD)*, the landing page for the Cloud SIEM UI. The HUD provides an at-a-glance overview of insight status and activity. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM**. [**New UI**](/docs/get-started/sumo-logic-ui). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM > SIEM Overview**. You can also click **Go To...** at the top of the screen and select **SIEM Overview**. :::note -Data on the HUD is generated by internal searches that may result in slightly different results than a [log search query](/docs/search/) for the same time period, because of the way each method calculates time periods. But these differences cancel out over time. So while there may be a small variance between numbers of Records, Signals, and Insights in a given time frame, the effect is only noticeable when viewing very small time slices, for example, under 30 minutes. If you need to get exact tracking for reporting or other use cases, use dashboards in apps like the [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/) app. +Data on the HUD is generated by internal searches that may result in slightly different results than a [log search query](/docs/search/) for the same time period, because of the way each method calculates time periods. But these differences cancel out over time. So while there may be a small variance between numbers of records, signals, and insights in a given time frame, the effect is only noticeable when viewing very small time slices, for example, under 30 minutes. If you need to get exact tracking for reporting or other use cases, use dashboards in apps like the [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/) app. ::: ## HUD overview -The left side of the HUD is a compact view of Insight activity and status in your environment. You can see the volume of Records being processed and how many Signals and Insights those Records result in. The HUD tells you how long it’s taking your team to spot, respond, and close Insights. You can see how many Insights are open, in progress, and closed. You can adjust the time range of the display depending on your interest.  +The left side of the HUD is a compact view of insight activity and status in your environment. You can see the volume of records being processed and how many signals and insights those records result in. The HUD tells you how long it’s taking your team to spot, respond, and close insights. You can see how many insights are open, in progress, and closed. You can adjust the time range of the display depending on your interest.  -The middle part of the HUD—the radar—visualizes the Record, Signal, and Insight volumes that are summarized on the left side of the page. It’s a circular timeline. The outer blue ring shows Record volume. Just inside the ring of Records is a histogram-like view of Signal volume. Nearest to the center are triangles that represent Insights. As you mouse around the radar, small popups provide a count of the Records, Signals, or Insights in that timeslice, depending on your focus. +The middle part of the HUD—the radar—visualizes the record, signal, and insight volumes that are summarized on the left side of the page. It’s a circular timeline. The outer blue ring shows record volume. Just inside the ring of records is a histogram-like view of signal volume. Nearest to the center are triangles that represent insights. As you mouse around the radar, small popups provide a count of the records, signals, or insights in that timeslice, depending on your focus. -The right side of the HUD contains a list of recent Insight activity. The card above the list shows key information about the latest new Insight with the highest severity.  +The right side of the HUD contains a list of recent insight activity. The card above the list shows key information about the latest new insight with the highest severity.  See the sections below for more details on each element of the HUD. @@ -31,7 +31,7 @@ See the sections below for more details on each element of the HUD. ## 1. Records / Signals / Insights -This section shows the count of Records ingested, Signals fired, and Insights generated during the currently selected time range, along with the percentage change compared to the previous time period. For example, if the currently selected time range is 24 hours, the percentage change is compared to the counts for the 24 hours previous to that. +This section shows the count of records ingested, signals fired, and insights generated during the currently selected time range, along with the percentage change compared to the previous time period. For example, if the currently selected time range is 24 hours, the percentage change is compared to the counts for the 24 hours previous to that. The default time range is 24 hours. You can change the time range using the dropdown to the right of the currently selected time range; the options range from 4 hours to 7 days. When you change the time range, the counts and metrics in the left and middle columns of the HUD update accordingly. @@ -39,45 +39,45 @@ The default time range is 24 hours. You can change the time range using the drop The **Insight Metrics** section displays the following metrics for the currently selected time range: -* **Detection**. The average period of time between when the first event happened (when the first Record in the Insight occurred) and when the Insight was generated, in days. (This differs from "dwell time", which is the time between when the first Record and the last Record occurred in an Insight.) -* **Response**. The average response time, which is the average time between when an Insight was generated and when its status was set to **In Progress**, in seconds.  -* **Remediation**. The average remediation time, which is the average time between when the Insight was created and when its status was set to **Closed**, in seconds.  +* **Detection**. The average period of time between when the first event happened (when the first record in the insight occurred) and when the insight was generated, in days. (This differs from "dwell time", which is the time between when the first record and the last record occurred in an insight.) +* **Response**. The average response time, which is the average time between when an insight was generated and when its status was set to **In Progress**, in seconds.  +* **Remediation**. The average remediation time, which is the average time between when the insight was created and when its status was set to **Closed**, in seconds.  -If you use an [HTTP POST V2 Action](/docs/cse/administration/create-cse-actions/) to send Insights to the Sumo Logic platform or another system, the Insight metrics are included in the Insight JSON object. The fields are `timeToDetection`, `timeToResponse` , and `timeToRemediation`.  +If you use an [HTTP POST V2 Action](/docs/cse/administration/create-cse-actions/) to send insights to the Sumo Logic platform or another system, the insight metrics are included in the insight JSON object. The fields are `timeToDetection`, `timeToResponse` , and `timeToRemediation`.  ## 3. Insights by Status  -The **Insights by Status** section provides a quick view of what analysts are working on. The counts are a breakdown by current status of the Insights created during the currently selected time range. To create new statuses, see [Managing Custom Insight Statuses](/docs/cse/administration/manage-custom-insight-statuses/). +The **Insights by Status** section provides a quick view of what analysts are working on. The counts are a breakdown by current status of the insights created during the currently selected time range. To create new statuses, see [Managing Custom Insight Statuses](/docs/cse/administration/manage-custom-insight-statuses/). ## 4. Insights created and closed -This section contains a stacked bar chart that shows the count of Insights opened and closed over time during the time range. When you hover over a bar, you’ll see the breakdown. +This section contains a stacked bar chart that shows the count of insights opened and closed over time during the time range. When you hover over a bar, you’ll see the breakdown. -## 5. Insight Radar +## 5. Insight radar -In the middle of the display is the *Insight Radar*, the HUD’s key feature. The radar visualizes the volume of Records, Signals, and Insights over time in a bulls eye-like view. Like the panels on the left side of the HUD, the radar updates when you select a different time range. The radar automatically refreshes every 60 seconds. +In the middle of the display is the *insight radar*, the HUD’s key feature. The radar visualizes the volume of records, signals, and insights over time in a bulls eye-like view. Like the panels on the left side of the HUD, the radar updates when you select a different time range. The radar automatically refreshes every 60 seconds. -In the circular visualization the three outermost rings represent Records, Signals, and Insights. +In the circular visualization the three outermost rings represent records, signals, and insights. -The blue ring around the outside of the Radar represents Records. The selected time range is broken down into intervals, and as you hover over the outer border of the ring, traversing the time range, the count of Records created during each interval is displayed.  +The blue ring around the outside of the radar represents records. The selected time range is broken down into intervals, and as you hover over the outer border of the ring, traversing the time range, the count of records created during each interval is displayed.  -Within the blue ring is another ring that contains light blue bars, each of which represents the Signals that fired during a time interval. The height of a column corresponds to the number of Signals that fired. If no Signals fired during an interval, no column appears. As you hover over an interval, the count of Signals that fired is displayed. If you click a column, the **Signals** page appears, and displays the corresponding Signals. +Within the blue ring is another ring that contains light blue bars, each of which represents the signals that fired during a time interval. The height of a column corresponds to the number of signals that fired. If no signals fired during an interval, no column appears. As you hover over an interval, the count of signals that fired is displayed. If you click a column, the **Signals** page appears, and displays the corresponding signals. -The third ring contains triangles, each of which represents one or more Insights. As you hover over an interval, the count of Insights that fired is displayed. If you click a triangle, the Insights page appears, and displays the corresponding Insights. +The third ring contains triangles, each of which represents one or more insights. As you hover over an interval, the count of insights that fired is displayed. If you click a triangle, the insights page appears, and displays the corresponding insights. ## 6. Recent Activity -The Recent Activity pane shows recently created Insights and recent Insight activity. +The **Recent Activity** pane shows recently created insights and recent insight activity. -The card at the top of the pane provides key information about the latest new Insight with the highest severity. The card provides the following information: +The card at the top of the pane provides key information about the latest new insight with the highest severity. The card provides the following information: -* The Insight ID and name, separated by a dash character. The name is typically formed from the MITRE stage(s) associated with the Signals in the Insight. In the case of a custom Insight, the name is the one supplied when the Insight was configured.   -* The Insight description, typically formed from the MITRE stage(s) associated with the Signals in the Insight. In the case of a custom Insight, the description is the one supplied when the Insight was configured. -* The Entity the Insight fired on. You can click on the Entity to view its details. Note that there is a six-button context menu that has options for searching for the Entity in other Insights and in Signals and Records. It also has the built-in **Add to Match List** and **Add to Suppressed List** actions, along with any custom [Context Actions](/docs/cse/administration/create-cse-context-actions/) defined in your environment. -* The analyst assigned to the Insight, if the Insight has been assigned to one. -* **Detection Time**. The time between the moment of first activity observation (when the oldest Signal in the Insight was fired) and when the Insight was created. (This differs from "dwell time", which is the time between when the first Record and the last Record occurred in an Insight.) -* **Signals**. The number of Signals in the Insight. -* **Severity**. The [severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity) of the Insight. -* **Global Confidence**. [Global Confidence](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/) for the Insight, if available. -* **Most Active Entities**. [Entities](/docs/cse/records-signals-entities-insights/view-manage-entities/) that are currently appearing the most in activity. Hover your mouse over an Entity and click **View Timeline** to see the [Entity timeline](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entity-timeline-tab). -* **Today**. Shows changes made today, such as Insights created, status changes, and comments. Items are listed in chronological order, with the newest first. +* The insight ID and name, separated by a dash character. The name is typically formed from the MITRE stage(s) associated with the signals in the insight. In the case of a custom insight, the name is the one supplied when the insight was configured.   +* The insight description, typically formed from the MITRE stage(s) associated with the signals in the insight. In the case of a custom insight, the description is the one supplied when the insight was configured. +* The entity the insight fired on. You can click on the entity to view its details. Note that there is a six-button context menu that has options for searching for the entity in other insights and in signals and records. It also has the built-in **Add to Match List** and **Add to Suppressed List** actions, along with any custom [Context Actions](/docs/cse/administration/create-cse-context-actions/) defined in your environment. +* The analyst assigned to the insight, if the insight has been assigned to one. +* **Detection Time**. The time between the moment of first activity observation (when the oldest signal in the insight was fired) and when the insight was created. (This differs from "dwell time", which is the time between when the first record and the last record occurred in an insight.) +* **Signals**. The number of signals in the insight. +* **Severity**. The [severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity) of the insight. +* **Global Confidence**. [Global Confidence](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/) for the insight, if available. +* **Most Active Entities**. [Entities](/docs/cse/records-signals-entities-insights/view-manage-entities/) that are currently appearing the most in activity. Hover your mouse over an entity and click **View Timeline** to see the [entity timeline](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entity-timeline-tab). +* **Today**. Shows changes made today, such as insights created, status changes, and comments. Items are listed in chronological order, with the newest first. diff --git a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md index a52913ea2e..cedd0ef53e 100644 --- a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md +++ b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md @@ -2,16 +2,16 @@ id: insight-generation-process title: Insight Generation Process sidebar_label: Insight Generation -description: Learn how Cloud SIEM correlates Signals by entity to create Insights. +description: Learn how Cloud SIEM correlates signals by entity to create insights. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This page explains Cloud SIEM's Insight generation process.  +This page explains Cloud SIEM's insight generation process.  -The concept of an *entity* is central to the process Cloud SIEM uses to correlate Signals and create Insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about Entities and Entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). +The concept of an *entity* is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). -Watch this micro lesson to learn how Insights are created. +Watch this micro lesson to learn how insights are created.