Update field mapping documentation for Security Analytics #2422

cwillum · 2023-01-17T22:40:55Z

Signed-off-by: cwillum cwmmoore@amazon.com

Description

Field mappings steps for detection creation have been separated into two tables: pending and default field mappings. This needs to be updated in documentation and the functionality of this step needs to be updated and clarified in general.

Issues Resolved

This update better clarifies the purpose of this step and the configuration of field mappings. This also updates the documentation to cover the two types of fields: pending and default.

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum · 2023-01-17T22:46:08Z

I created this PR to address the requirement for 1.2 in issue #2400 (the other updates to docs are complete). I need to speak with an SME to understand the purpose of these mappings and get more context. @AWSHurneyt appears to be out today. The 2.5 release is slated for 1/19/23. If I can't find another SME for explanation, we can handle this update after the release.

Signed-off-by: cwillum <cwmmoore@amazon.com>

petardz · 2023-01-19T18:48:34Z

_security-analytics/sec-analytics-config/detectors-config.md

@@ -36,11 +36,12 @@ Defining a new detector involves naming the detector, selecting a data source an

 ## Step 2. Make field mappings

-Field mapping matches field names for the rule with field names from the log being used to provide data. The mappings are automatically applied once the detector is defined in previous steps. This page offers the user the option to map log-specific field names to the internal rule field names.
+The field mapping step matches field names for the rule with field names for the log index being used to provide data. Correctly mapping the log field names with rule field names allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.


nit: field names from the rules with field names from the log

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum · 2023-01-20T02:20:53Z

@AWSHurneyt @Naarcha-AWS
@petardz Thanks for taking a first stab at this update for field mappings. I returned to it and made changes based on our conversation yesterday. Could you have a look at what I've done here and add any comments if you see something that looks/sounds funny or may not be accurate. Thanks!
@opensearch-project/security-analytics Or anyone on the team, could someone have a look at this for technical accuracy? Thanks.

alicejw1 · 2023-01-20T17:32:36Z

_security-analytics/sec-analytics-config/detectors-config.md

    {: .tip }

 1. In the **Detector schedule** section, set how often the detector will run. Specify a unit of time and a corresponding number to set the interval.
 1. Select the **Next** button in the lower-right corner of the screen to continue. The Configure field mapping page appears.

 ## Step 2. Make field mappings

-Field mapping matches field names for the rule with field names from the log being used to provide data. The mappings are automatically applied once the detector is defined in previous steps. This page offers the user the option to map log-specific field names to the internal rule field names.
+The field mapping step matches field names from the rule with field names from the log index being used to provide data. Correctly mapping the log field names with rule field names allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.


suggestion:

To trigger alerts, the log event data needs to be mapped to the detector. The field mapping step maps the log field names from the index that provides the data with the rule field names to set up detectors to trigger alerts.

Agree with Alice. I would just change the second sentence to "Creating field mappings maps the log field names..."

Good. Thanks.

alicejw1 · 2023-01-20T17:35:28Z

_security-analytics/sec-analytics-config/detectors-config.md

+Once you navigate to the Configure field mapping page, the system attempts to automatically map fields between the two sources. Those field names that are not automatically mapped appear in the **Pending field mapping** table. In this table you can manually map rule fields to log fields.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/pending-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+This process requires that the user or administrator have some familiarity with the field names in the log index and an understanding of the data contained in those fields. Rule fields are named to promote their standardization and normalize them in the industry, and the names themselves are typically self explanatory. If a user has an understanding of the log data contained in a particular log field, the mapping is typically a simple and straightforward process.


maybe change "the user" to "you" ?
"If you have an understanding . . . "

Agree with Alice. Also,
This process requires you to have some familiarity...
Also, not sure what "promote their standardization and normalize them in the industry" means in this context. Can we say "Rule fields are named according to industry standards"?

Good suggestions. Thanks.

alicejw1

Nice work!

AWSHurneyt

These changes look good to me, thank you!

ariamarble

LGTM

kolchfa-aws

LGTM. Left some comments.

kolchfa-aws · 2023-01-20T18:16:33Z

_security-analytics/sec-analytics-config/detectors-config.md

@@ -28,21 +28,41 @@ Defining a new detector involves naming the detector, selecting a data source an
 * Use the **Log type**, **Rule severity**, and **Source** dropdown menus to filter the rules you want to select from. 
 * Use the **Search** bar to search for specific rules.

-    To quickly select one or more known rules and dismiss others, first deselect all rules by moving the **rule name** toggle to the left, then search for your target rule names and select each individually by moving its toggle to the right.
+    To quickly select one or more known rules and dismiss others, first deselect all rules by moving the **Rule name** toggle to the left, then search for your target rule names and select each individually by moving its toggle to the right.
    {: .tip }

 1. In the **Detector schedule** section, set how often the detector will run. Specify a unit of time and a corresponding number to set the interval.
 1. Select the **Next** button in the lower-right corner of the screen to continue. The Configure field mapping page appears.

 ## Step 2. Make field mappings


Maybe "Create field mappings"?

oh and remember our style change to use gerunds for all section headings? So could be
"Creating field mappings" then

I think it's ok without gerunds because it says "step 2".

Agree with Fanit: we are standardizing gerunds are for the TOC/nav pane.

thanks: create field mappings. and, yes, imperative voice for instruction: do this, do that.

kolchfa-aws · 2023-01-20T18:17:58Z

_security-analytics/sec-analytics-config/detectors-config.md

    {: .tip }

 1. In the **Detector schedule** section, set how often the detector will run. Specify a unit of time and a corresponding number to set the interval.
 1. Select the **Next** button in the lower-right corner of the screen to continue. The Configure field mapping page appears.

 ## Step 2. Make field mappings

-Field mapping matches field names for the rule with field names from the log being used to provide data. The mappings are automatically applied once the detector is defined in previous steps. This page offers the user the option to map log-specific field names to the internal rule field names.
+The field mapping step matches field names from the rule with field names from the log index being used to provide data. Correctly mapping the log field names with rule field names allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.


Agree with Alice. I would just change the second sentence to "Creating field mappings maps the log field names..."

kolchfa-aws · 2023-01-20T18:22:16Z

_security-analytics/sec-analytics-config/detectors-config.md

+Once you navigate to the Configure field mapping page, the system attempts to automatically map fields between the two sources. Those field names that are not automatically mapped appear in the **Pending field mapping** table. In this table you can manually map rule fields to log fields.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/pending-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+This process requires that the user or administrator have some familiarity with the field names in the log index and an understanding of the data contained in those fields. Rule fields are named to promote their standardization and normalize them in the industry, and the names themselves are typically self explanatory. If a user has an understanding of the log data contained in a particular log field, the mapping is typically a simple and straightforward process.


Agree with Alice. Also,
This process requires you to have some familiarity...
Also, not sure what "promote their standardization and normalize them in the industry" means in this context. Can we say "Rule fields are named according to industry standards"?

kolchfa-aws · 2023-01-20T18:22:42Z

_security-analytics/sec-analytics-config/detectors-config.md

+{: .note }
+
+* The Rule field name column lists field names based on the selected log type and the rules that have been assigned to the detector.
+* The log field name column includes a dropdown menu for each of the rule fields. Each dropdown menu contains a list of field names extracted from the log index.


Our style guide says "dropdown list"

Suggested change

* The log field name column includes a dropdown menu for each of the rule fields. Each dropdown menu contains a list of field names extracted from the log index.

* The log field name column includes a dropdown list for each of the rule fields. Each dropdown list contains a list of field names extracted from the log index.

kolchfa-aws · 2023-01-20T18:29:31Z

_security-analytics/sec-analytics-config/detectors-config.md

+
+* The Rule field name column lists field names based on the selected log type and the rules that have been assigned to the detector.
+* The log field name column includes a dropdown menu for each of the rule fields. Each dropdown menu contains a list of field names extracted from the log index.
+* Use the dropdown arrow to open the list of log fields and select the log field name that corresponds to the rule field name directly to the left in the Rule field name column. You can enter text in the **Select a mapping field** box at the top of the menu to search for names in the log field list. 


To map a rule field name to a log field name, use the dropdown arrow to open the list of log fields and select the log field name from the list. To search for names in the log field list, enter text in the Select a mapping field box.

kolchfa-aws · 2023-01-20T18:32:21Z

_security-analytics/sec-analytics-config/detectors-config.md

+* The log field name column includes a dropdown menu for each of the rule fields. Each dropdown menu contains a list of field names extracted from the log index.
+* Use the dropdown arrow to open the list of log fields and select the log field name that corresponds to the rule field name directly to the left in the Rule field name column. You can enter text in the **Select a mapping field** box at the top of the menu to search for names in the log field list. 
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/log-field.png" alt="Field mapping example for pending mappings" width="600">
+* Once the log field name is selected and mapped to the rule field name, the icon in the Status colum to the right changes to a green check mark.


Suggested change

* Once the log field name is selected and mapped to the rule field name, the icon in the Status colum to the right changes to a green check mark.

* Once the log field name is selected and mapped to the rule field name, the icon in the Status column to the right changes to a green check mark.

kolchfa-aws · 2023-01-20T18:34:34Z

_security-analytics/sec-analytics-config/detectors-config.md

+The **Default mapped fields** table contains mappings that the system made automatically after defining the detector. As shown in the image that follows, when the field names are similar to one another the system can successfully match the two.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/default-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+Nevertheless, it's a good idea to review the mappings and verify that they are matched as expected and correct. If you find a mapping that doesn't appear to be accurate, you can use the dropdown menu as described in the **Pending field mappings** section above to correct the field mapping.  


Suggested change

Nevertheless, it's a good idea to review the mappings and verify that they are matched as expected and correct. If you find a mapping that doesn't appear to be accurate, you can use the dropdown menu as described in the **Pending field mappings** section above to correct the field mapping.

Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section to correct the field mapping.

kolchfa-aws · 2023-01-20T18:35:03Z

_security-analytics/sec-analytics-config/detectors-config.md

+
+Nevertheless, it's a good idea to review the mappings and verify that they are matched as expected and correct. If you find a mapping that doesn't appear to be accurate, you can use the dropdown menu as described in the **Pending field mappings** section above to correct the field mapping.  
+
+After completing the mappings, select the **Next** button in the lower-right corner of the screen. The Set up alerts page appears and displays settings for an alert trigger.


Suggested change

After completing the mappings, select the **Next** button in the lower-right corner of the screen. The Set up alerts page appears and displays settings for an alert trigger.

After completing the mappings, select the **Next** button in the lower-right corner of the screen. The **Set up alerts** page appears and displays settings for an alert trigger.

OK, but we need to have a team talk on what we bold face in docs.

I say bold all UI elements

petardz · 2023-01-20T18:46:00Z

_security-analytics/sec-analytics-config/detectors-config.md

+This process requires that the user or administrator have some familiarity with the field names in the log index and an understanding of the data contained in those fields. Rule fields are named to promote their standardization and normalize them in the industry, and the names themselves are typically self explanatory. If a user has an understanding of the log data contained in a particular log field, the mapping is typically a simple and straightforward process.
+{: .note }
+
+* The Rule field name column lists field names based on the selected log type and the rules that have been assigned to the detector.


To be 100% factually correct here: these rule fields are coming from ALL pre-packaged rules of selected log type/category (rule category == log type)

Changed to:
"The Rule field name column lists field names based on all of the pre-packaged rules associated with the selected log type."

That is perfect! Thank you!

Signed-off-by: cwillum <cwmmoore@amazon.com>

natebower

@cwillum Please see my comments and changes and let me know if you have any questions. Thanks!

natebower · 2023-01-23T16:07:01Z

_security-analytics/sec-analytics-config/detectors-config.md


-Field mapping matches field names for the rule with field names from the log being used to provide data. The mappings are automatically applied once the detector is defined in previous steps. This page offers the user the option to map log-specific field names to the internal rule field names.
+The field mapping step matches field names from the rule with field names from the log index being used to provide data. Creating field mappings allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.


Suggested change

The field mapping step matches field names from the rule with field names from the log index being used to provide data. Creating field mappings allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.

The field mapping step matches field names from the rule with field names from the log index being used to provide data. Creating field mappings allows the system to accurately convey event data from the log to the detector and then use the data to trigger alerts.

_security-analytics/sec-analytics-config/detectors-config.md

natebower · 2023-01-23T16:21:13Z

_security-analytics/sec-analytics-config/detectors-config.md

+* The Rule field name column lists field names based on all of the pre-packaged rules associated with the selected log type.
+* The log field name column includes a dropdown list for each of the rule fields. Each dropdown list contains field names extracted from the log index.
+* To map a rule field name to a log field name, use the dropdown arrow to open the list of log fields and select the log field name from the list. To search for names in the log field list, enter text in the **Select a mapping field** box.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/log-field.png" alt="Field mapping example for pending mappings" width="600">


Reference the image in the text that precedes it. ", as shown in the following image." usually works.

natebower · 2023-01-23T16:22:41Z

_security-analytics/sec-analytics-config/detectors-config.md

+Once you navigate to the Configure field mapping page, the system attempts to automatically map fields between the two sources. Those field names that are not automatically mapped appear in the **Pending field mapping** table. In this table you can manually map rule fields to log fields.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/pending-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+* The Rule field name column lists field names based on all of the pre-packaged rules associated with the selected log type.


The bulleted list should ideally be introduced by a brief sentence ending in a colon.

Added ...
"While mapping fields, consider the following:"

_security-analytics/sec-analytics-config/detectors-config.md

natebower · 2023-01-23T16:25:29Z

_security-analytics/sec-analytics-config/detectors-config.md

+The **Default mapped fields** table contains mappings that the system made automatically after defining the detector. As shown in the image that follows, when the field names are similar to one another the system can successfully match the two.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/default-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section above to correct the field mapping.  


Suggested change

Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section above to correct the field mapping.

Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section to correct the field mapping.

Can we use something simpler than "Nevertheless"? It may not be understood by Global English speakers.

I added this ...
"Although these automatic matches are normally dependable, it's still a good idea to review the mappings ..."

…ch-project/documentation-website into fix#2400-field-mappings Resolves merge conflict without fast forward.

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum

Thanks, Nathan. I incorporated all changes.

cwillum · 2023-01-23T18:06:12Z

_security-analytics/sec-analytics-config/detectors-config.md

+Once you navigate to the Configure field mapping page, the system attempts to automatically map fields between the two sources. Those field names that are not automatically mapped appear in the **Pending field mapping** table. In this table you can manually map rule fields to log fields.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/pending-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+* The Rule field name column lists field names based on all of the pre-packaged rules associated with the selected log type.


Added ...
"While mapping fields, consider the following:"

cwillum · 2023-01-23T18:09:17Z

_security-analytics/sec-analytics-config/detectors-config.md

+The **Default mapped fields** table contains mappings that the system made automatically after defining the detector. As shown in the image that follows, when the field names are similar to one another the system can successfully match the two.
+<br><img src="{{site.url}}{{site.baseurl}}/images/Security/default-mappings.png" alt="Field mapping example for pending mappings" width="900">
+
+Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section above to correct the field mapping.  


I added this ...
"Although these automatic matches are normally dependable, it's still a good idea to review the mappings ..."

Signed-off-by: cwillum <cwmmoore@amazon.com>

* fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: cwillum <cwmmoore@amazon.com>

)" This reverts commit e58ad65.

* fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> * fix#2400-field-mappings Signed-off-by: cwillum <cwmmoore@amazon.com> Signed-off-by: cwillum <cwmmoore@amazon.com>

)" This reverts commit 3955777.

fix#2400-field-mappings

8919145

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum added 1 - Backlog Issue: The issue is unassigned or assigned but not started v2.5.0 'Issues and PRs related to version v2.5.0' Needs SME Waiting on input from subject matter expert labels Jan 17, 2023

cwillum added this to the v2.5.x milestone Jan 17, 2023

cwillum self-assigned this Jan 17, 2023

cwillum requested a review from a team as a code owner January 17, 2023 22:40

fix#2400-field-mappings

d1fb758

Signed-off-by: cwillum <cwmmoore@amazon.com>

petardz reviewed Jan 19, 2023

View reviewed changes

cwillum added 3 commits January 19, 2023 18:10

fix#2400-field-mappings

ea27388

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#2400-field-mappings

322ad47

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#2400-field-mappings

be82052

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum added 3 - Tech review PR: Tech review in progress and removed 2 - In progress Issue/PR: The issue or PR is in progress. labels Jan 20, 2023

cwillum added the 4 - Doc review PR: Doc review in progress label Jan 20, 2023

alicejw1 reviewed Jan 20, 2023

View reviewed changes

alicejw1 approved these changes Jan 20, 2023

View reviewed changes

AWSHurneyt approved these changes Jan 20, 2023

View reviewed changes

ariamarble approved these changes Jan 20, 2023

View reviewed changes

kolchfa-aws approved these changes Jan 20, 2023

View reviewed changes

petardz reviewed Jan 20, 2023

View reviewed changes

cwillum and others added 3 commits January 20, 2023 15:09

fix#2400-field-mappings

80f0d1a

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#2400-field-mappings

c4ac64a

Signed-off-by: cwillum <cwmmoore@amazon.com>

Merge branch 'main' into fix#2400-field-mappings

c9c0dec

AWSHurneyt approved these changes Jan 20, 2023

View reviewed changes

fix#2400-field-mappings

6ae1125

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum added 5 - Editorial review PR: Editorial review in progress and removed 3 - Tech review PR: Tech review in progress 4 - Doc review PR: Doc review in progress labels Jan 21, 2023

natebower reviewed Jan 23, 2023

View reviewed changes

natebower removed the 5 - Editorial review PR: Editorial review in progress label Jan 23, 2023

cwillum added 3 commits January 23, 2023 09:41

merge branch 'fix#2400-field-mappings' of https://github.com/opensear…

86910c5

…ch-project/documentation-website into fix#2400-field-mappings Resolves merge conflict without fast forward.

fix#2400-field-mappings

5abffb6

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#2400-field-mappings

33a4c8a

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum commented Jan 23, 2023

View reviewed changes

cwillum added 2 commits January 23, 2023 10:16

fix#2400-field-mappings

3e5e39a

Signed-off-by: cwillum <cwmmoore@amazon.com>

fix#2400-field-mappings

6a3838e

Signed-off-by: cwillum <cwmmoore@amazon.com>

cwillum merged commit e98ee6d into main Jan 23, 2023

cwillum mentioned this pull request Jan 23, 2023

[DOC] Updates for Security Analytics plugin 2.5 documentation #2400

Closed

4 tasks

cwillum added the release-notes PR: Include this PR in the automated release notes label Jan 23, 2023

vagimeli added a commit that referenced this pull request Jan 26, 2023

Revert "Update field mapping documentation for Security Analytics (#2422

574d924

)" This reverts commit e58ad65.

vagimeli added a commit that referenced this pull request Jan 30, 2023

Revert "Update field mapping documentation for Security Analytics (#2422

54011dc

)" This reverts commit 3955777.

hdhalter deleted the fix#2400-field-mappings branch March 28, 2024 21:42

	* The log field name column includes a dropdown menu for each of the rule fields. Each dropdown menu contains a list of field names extracted from the log index.
	* The log field name column includes a dropdown list for each of the rule fields. Each dropdown list contains a list of field names extracted from the log index.

	* Once the log field name is selected and mapped to the rule field name, the icon in the Status colum to the right changes to a green check mark.
	* Once the log field name is selected and mapped to the rule field name, the icon in the Status column to the right changes to a green check mark.

	Nevertheless, it's a good idea to review the mappings and verify that they are matched as expected and correct. If you find a mapping that doesn't appear to be accurate, you can use the dropdown menu as described in the Pending field mappings section above to correct the field mapping.
	Nevertheless, it's a good idea to review the mappings and verify that they are correct and matched as expected. If you find a mapping that doesn't appear to be accurate, you can use the dropdown list as described in the [Pending field mappings](#pending-field-mappings) section to correct the field mapping.


		Nevertheless, it's a good idea to review the mappings and verify that they are matched as expected and correct. If you find a mapping that doesn't appear to be accurate, you can use the dropdown menu as described in the Pending field mappings section above to correct the field mapping.

		After completing the mappings, select the Next button in the lower-right corner of the screen. The Set up alerts page appears and displays settings for an alert trigger.


		Field mapping matches field names for the rule with field names from the log being used to provide data. The mappings are automatically applied once the detector is defined in previous steps. This page offers the user the option to map log-specific field names to the internal rule field names.
		The field mapping step matches field names from the rule with field names from the log index being used to provide data. Creating field mappings allows the system to accurately convey event data from the log to the detector and then use the data for triggering alerts.

Update field mapping documentation for Security Analytics #2422

Update field mapping documentation for Security Analytics #2422

Conversation

cwillum commented Jan 17, 2023 • edited Loading

Description

Issues Resolved

Checklist

cwillum commented Jan 17, 2023

Choose a reason for hiding this comment

cwillum commented Jan 20, 2023 • edited Loading

alicejw1 Jan 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alicejw1 left a comment

Choose a reason for hiding this comment

AWSHurneyt left a comment

Choose a reason for hiding this comment

ariamarble left a comment

Choose a reason for hiding this comment

kolchfa-aws left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

petardz Jan 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

natebower left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cwillum commented Jan 17, 2023 •

edited

Loading

cwillum commented Jan 20, 2023 •

edited

Loading

alicejw1 Jan 20, 2023 •

edited

Loading

petardz Jan 20, 2023 •

edited

Loading