[Docs]7.7 SIEM doc updates #63951

benskelker · 2020-04-20T10:37:29Z

Summary

Updates the SIEM section of the Kibana docs for 7.7.

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials. This is the docs.

[skip-ci]

benskelker · 2020-04-20T10:40:56Z

@andrew-goldstein can you review the advanced settings update? Thanks

gchaps · 2020-04-20T14:06:25Z

docs/management/advanced-options.asciidoc

@@ -217,6 +217,9 @@ might increase the search time. This setting is off by default. Users must opt-i
 [horizontal]
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
+`siem:ipReputationLinks`:: A JSON array containing links for verifying an IP
+address’s reputation. The links are displayed on


IP address's reputation > the reputation of an IP address?

gchaps · 2020-04-20T14:13:49Z

docs/siem/siem-ui.asciidoc

@@ -50,6 +50,22 @@ or the Detections API.
 [role="screenshot"]
 image::siem/images/detections-ui.png[]

+[float]
+[[cases-ui]]
+=== Cases (Beta)


suggest removing Beta from the title and using this in the first line:

beta:[] Cases are used to open...

That way, you will get a definition of what it means for a feature to be in beta. If you do that, you'll also have to make the change for Detections earlier in the page.

If you keep beta in the title, we use beta (lower case b)

gchaps · 2020-04-20T14:17:47Z

docs/siem/siem-ui.asciidoc

+[[cases-ui]]
+=== Cases (Beta)
+
+Cases are used to open and track security issues directly in the {siem-app}. 


We try to avoid using the word app in the Kibana docs and use the name alone, in this case, SIEM.

gchaps · 2020-04-20T14:18:26Z

docs/siem/siem-ui.asciidoc

+=== Cases (Beta)
+
+Cases are used to open and track security issues directly in the {siem-app}. 
+They list the original reporter and all users who contribute to a case


They > Cases ?

gchaps · 2020-04-20T14:19:22Z

docs/siem/siem-ui.asciidoc

+
+Cases are used to open and track security issues directly in the {siem-app}. 
+They list the original reporter and all users who contribute to a case
+(`participants`). Case comments support markdown syntax, and allow linking to


markdown > Markdown

benskelker · 2020-04-20T15:11:00Z

@gchaps
thanks - corrected

gchaps

A few minor nits. Otherwise, LGTM.

gchaps · 2020-04-20T15:32:03Z

docs/siem/siem-ui.asciidoc

+[[cases-ui]]
+=== Cases (beta)
+
+Cases are used to open and track security issues directly in the SIEM. 


the SIEM > SIEM.

gchaps · 2020-04-20T15:34:04Z

docs/siem/siem-ui.asciidoc

+[[cases-ui]]
+=== Cases (beta)
+
+Cases are used to open and track security issues directly in the SIEM. 


the SIEM > SIEM

gchaps · 2020-04-20T15:34:32Z

docs/siem/siem-ui.asciidoc

+Cases list the original reporter and all users who contribute to a case
+(`participants`). Case comments support Markdown syntax, and allow linking to
+saved Timelines. Additionally, you can send cases to external systems from
+within the {siem-app} (currently ServiceNow).


should also replace {siem-app} here with SIEM.

KOTungseth

LGTM

andrew-goldstein

Thanks for these additions @benskelker!
LGTM 🚀

* SIEM section doc updates * corrections * more corrections

* master: (29 commits) [Dashboard] Deangularize navbar, attempt nr. 2 (elastic#61611) refactor action filter creation utils (elastic#62969) Refresh index pattern list before redirecting (elastic#63329) [APM]fixing custom link unit tests (elastic#64045) [Ingest] EPM & Fleet are enabled when Ingest is enabled (elastic#64103) [Alerting] Fixed bug with no possibility to edit the index name after adding (elastic#64033) [Maps] Map settings: min and max zoom (elastic#63714) [kbn-storybook] Use raw loader for text files (elastic#64108) [EPM] /packages/{package} endpoint to support upgrades (elastic#63629) [SIEM] New Platform Saved Objects Registration (elastic#64029) [Endpoint] Hook to handle events needing navigation via Router (elastic#63863) Fixed small issue in clone functionality (elastic#64085) [Endpoint]EMT-146: use ingest agent for status info (elastic#63921) [SIEM] Server NP Followup (elastic#64010) Register uiSettings on New Platform (elastic#64015) [Reporting] Integration polling config with client code (elastic#63754) [Docs]7.7 SIEM doc updates (elastic#63951) [SIEM] [Cases] Tags suggestions (elastic#63878) Include datasource UUID in agent config yaml, adjust overflow height of yaml view (elastic#64027) [DOCS] Add file size setting for Data Visualizer (elastic#64006) ...

…ana into task-manager/cancel-logging * 'task-manager/cancel-logging' of github.com:gmmorris/kibana: (28 commits) [Dashboard] Deangularize navbar, attempt nr. 2 (elastic#61611) refactor action filter creation utils (elastic#62969) Refresh index pattern list before redirecting (elastic#63329) [APM]fixing custom link unit tests (elastic#64045) [Ingest] EPM & Fleet are enabled when Ingest is enabled (elastic#64103) [Alerting] Fixed bug with no possibility to edit the index name after adding (elastic#64033) [Maps] Map settings: min and max zoom (elastic#63714) [kbn-storybook] Use raw loader for text files (elastic#64108) [EPM] /packages/{package} endpoint to support upgrades (elastic#63629) [SIEM] New Platform Saved Objects Registration (elastic#64029) [Endpoint] Hook to handle events needing navigation via Router (elastic#63863) Fixed small issue in clone functionality (elastic#64085) [Endpoint]EMT-146: use ingest agent for status info (elastic#63921) [SIEM] Server NP Followup (elastic#64010) Register uiSettings on New Platform (elastic#64015) [Reporting] Integration polling config with client code (elastic#63754) [Docs]7.7 SIEM doc updates (elastic#63951) [SIEM] [Cases] Tags suggestions (elastic#63878) Include datasource UUID in agent config yaml, adjust overflow height of yaml view (elastic#64027) [DOCS] Add file size setting for Data Visualizer (elastic#64006) ...

SIEM section doc updates

0c6e334

benskelker added release_note:skip Skip the PR/issue when compiling release notes v7.7.0 labels Apr 20, 2020

benskelker requested review from gchaps, KOTungseth and andrew-goldstein April 20, 2020 10:38

benskelker mentioned this pull request Apr 20, 2020

7.7 Doc updates elastic/stack-docs#968

Closed

10 tasks

gchaps reviewed Apr 20, 2020

View reviewed changes

corrections

95c0f26

gchaps approved these changes Apr 20, 2020

View reviewed changes

more corrections

7ffdd31

KOTungseth approved these changes Apr 20, 2020

View reviewed changes

andrew-goldstein approved these changes Apr 21, 2020

View reviewed changes

benskelker merged commit b7aab69 into elastic:master Apr 21, 2020

benskelker deleted the 7.7_siem_doc_updates branch April 21, 2020 17:14

This was referenced Apr 21, 2020

[7.x] [Docs]7.7 SIEM doc updates (#63951) #64089

Merged

[7.7] [Docs]7.7 SIEM doc updates (#63951) #64090

Merged

benskelker added a commit to benskelker/kibana that referenced this pull request Apr 21, 2020

[Docs]7.7 SIEM doc updates (elastic#63951)

5178f88

* SIEM section doc updates * corrections * more corrections

benskelker added a commit to benskelker/kibana that referenced this pull request Apr 21, 2020

[Docs]7.7 SIEM doc updates (elastic#63951)

bda39f3

* SIEM section doc updates * corrections * more corrections

benskelker added a commit that referenced this pull request Apr 21, 2020

[Docs]7.7 SIEM doc updates (#63951) (#64089)

ee4fa9f

* SIEM section doc updates * corrections * more corrections

benskelker added a commit that referenced this pull request Apr 21, 2020

[Docs]7.7 SIEM doc updates (#63951) (#64090)

2dfeb77

* SIEM section doc updates * corrections * more corrections

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Docs]7.7 SIEM doc updates #63951

[Docs]7.7 SIEM doc updates #63951

benskelker commented Apr 20, 2020

benskelker commented Apr 20, 2020 •

edited

Loading

gchaps Apr 20, 2020

gchaps Apr 20, 2020

gchaps Apr 20, 2020

gchaps Apr 20, 2020

gchaps Apr 20, 2020

benskelker commented Apr 20, 2020

gchaps left a comment

gchaps Apr 20, 2020

gchaps Apr 20, 2020

gchaps Apr 20, 2020

KOTungseth left a comment

andrew-goldstein left a comment

[Docs]7.7 SIEM doc updates #63951

[Docs]7.7 SIEM doc updates #63951

Conversation

benskelker commented Apr 20, 2020

Summary

Checklist

benskelker commented Apr 20, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

benskelker commented Apr 20, 2020

gchaps left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

KOTungseth left a comment

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

benskelker commented Apr 20, 2020 •

edited

Loading