diff --git a/docs/cse/get-started-with-cloud-siem/intro-for-analysts.md b/docs/cse/get-started-with-cloud-siem/intro-for-analysts.md index 0918b81723..b59cc4d1c8 100644 --- a/docs/cse/get-started-with-cloud-siem/intro-for-analysts.md +++ b/docs/cse/get-started-with-cloud-siem/intro-for-analysts.md @@ -303,8 +303,8 @@ If you do decide to write a custom rule, insight, or rule tuning expression, the You're updating some of the firewalls in your system, and you don't want to trigger unnecessary alerts. Write a rule tuning expression that will allow yourself to bypass firewall-related rules. -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rule Tuning**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. -1. On the **Rule Tuning** page, click **Create**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Cloud SIEM**. Then in the top menu, select **Content > Rule Tuning**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. +1. On the **Rule Tuning** page, click **Add Rule Tuning Expression**. 1. Name your rule tuning expression. 1. **Tune selected Rules** should be selected by default. 1. Use the **Type to add a Rule** search bar to find rules to add your expression to. diff --git a/docs/cse/rules/about-cse-rules.md b/docs/cse/rules/about-cse-rules.md index 23d9dc8057..3ed69cf038 100644 --- a/docs/cse/rules/about-cse-rules.md +++ b/docs/cse/rules/about-cse-rules.md @@ -81,7 +81,7 @@ The tuning expression is AND’d with the rule expression—the rule will only g Rule tuning expressions allow you to tailor the logic of a built-in rule without replicating and modifying the rule. The benefit of using a tuning expression, over the copy and edit method, is that when Cloud SIEM updates built-in rules, your tuning expressions are preserved. This division of logic means that you don’t need to create as many custom rules. If you use tuning expressions in combination with multi-entity rules you’ll further reduce the need for custom rules.    -You create tuning expressions on the **Rule Tuning** page, which is available from the **Content** menu. When you create a tuning expression, you have the option of applying to all of your rules, or to selected rules. Or, you can apply tuning expressions when you create a rule. You can apply multiple tuning expressions to a rule. You can assign a tuning expression to selected rules, or to all of your rules. You can also create a tuning expression without immediately assigning it to any rules. For more information, see [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions). +You create tuning expressions on the **Rule Tuning** page. When you create a tuning expression, you have the option of applying to all of your rules, or to selected rules. Or, you can apply tuning expressions when you create a rule. You can apply multiple tuning expressions to a rule. You can assign a tuning expression to selected rules, or to all of your rules. You can also create a tuning expression without immediately assigning it to any rules. For more information, see [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions). ## "On Entity" configuration diff --git a/docs/cse/rules/rule-tuning-expressions.md b/docs/cse/rules/rule-tuning-expressions.md index 68d1323fb3..99d3044f4c 100644 --- a/docs/cse/rules/rule-tuning-expressions.md +++ b/docs/cse/rules/rule-tuning-expressions.md @@ -75,10 +75,10 @@ Watch this micro lesson to learn how to create a rule tuning expression. ## Create a tuning expression -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rule Tuning**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. -1. On the **Rule Tuning** page, click **Create**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Cloud SIEM**. Then in the top menu select **Content > Rule Tuning**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. +1. On the **Rule Tuning** page, click **Add Rule Tuning Expression**. 1. The **New Rule Tuning Expression** page appears. -
Annotated expression +
Empty screen to create a rule tuning expression 1. **Name**. Enter a name for the tuning expression.  1. **Description**. Enter a description of the tuning expression. 1. In the **Tune [selected|all] Rules** section: @@ -104,14 +104,11 @@ You can also create new tuning expression and apply existing tuning expressions When you create a tuning expression it is enabled by default. If you disable a tuning expression, rules that it is applied to will behave as if the tuning expression does not exist.  -You can toggle the enablement state of a tuning expression on the **Rule Tuning** page using the control to the left of the delete icon. +Enable on list page -Enable on list page - -You can also toggle the enablement state on the details page for a tuning expression. - -Enable on details page +You can toggle the enablement state on the details page for a tuning expression. +Enable on details page ## Testing tuning expressions diff --git a/static/img/cse/annotated-expression.png b/static/img/cse/annotated-expression.png index 0d9b9a2b87..ff75ad3934 100644 Binary files a/static/img/cse/annotated-expression.png and b/static/img/cse/annotated-expression.png differ diff --git a/static/img/cse/enable-on-details.png b/static/img/cse/enable-on-details.png index cbbcb2c459..88aea13836 100644 Binary files a/static/img/cse/enable-on-details.png and b/static/img/cse/enable-on-details.png differ diff --git a/static/img/cse/enable-on-list.png b/static/img/cse/enable-on-list.png index 1bf4cd8830..a83073f0af 100644 Binary files a/static/img/cse/enable-on-list.png and b/static/img/cse/enable-on-list.png differ