Skip to content

Commit 10f1349

Browse files
kimsaucehimanshu219
kimsauce
authored and
himanshu219
committed
Copilot GA (wave 1) (#4761)
* Copilot GA * add article ref * Edits per BA * edits per BA * expand on glossary * add more best practices * minor fix * Update docs/search/copilot.md * Delete blog-service/2024-12-02-search-copilot.md * Update docs/search/copilot.md * sidebar * add back preview
1 parent 0da940b commit 10f1349

File tree

4 files changed

+76
-42
lines changed

4 files changed

+76
-42
lines changed

‎docs/search/copilot.md‎

Lines changed: 75 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
id: copilot
33
title: Sumo Logic Copilot - Feature Preview
4+
sidebar_label: Copilot - Preview
45
description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant designed to simplify log analysis by allowing you to ask questions in plain English and providing search suggestions without the need to write log queries.
56
keywords:
67
- copilot
@@ -10,17 +11,13 @@ keywords:
1011
- ml
1112
---
1213

13-
<head>
14-
<meta name="robots" content="noindex" />
15-
</head>
16-
1714
import Iframe from 'react-iframe';
1815
import useBaseUrl from '@docusaurus/useBaseUrl';
1916

2017
<p><a href="/docs/beta"><span className="beta">Preview Release</span></a></p>
2118
This is a Preview release. To learn more, contact your Sumo Logic account executive.
2219

23-
Sumo Logic Copilot is an AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster.
20+
Sumo Logic Copilot is our AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster.
2421

2522
With its intuitive interface, Copilot automatically generates log searches from natural language queries, helping you quickly investigate performance issues, anomalies, and security threats. It also guides you through investigations step-by-step with AI-driven suggestions to refine your results for faster, more accurate resolutions. Overall, Copilot enhances incident resolution with expert level insights.
2623

@@ -38,25 +35,27 @@ With its intuitive interface, Copilot automatically generates log searches from
3835

3936
### Key features
4037

41-
Copilot reduces manual effort by combining prebuilt insights with natural language query analysis.
38+
Copilot accelerates incident response by combining prebuilt contextual insights with natural language queries and enhancing time to insights for users across your organization. With sub-3-second response times with over 90% translation accuracy for most queries, Copilot ensures fast and dependable results for supported log sources.
4239

43-
* **Natural language queries**. Ask questions in plain English—no need to enter query syntax.
44-
* **Contextual suggestions**. Automated suggestions to accelerate your workflow.
45-
* **Conversation history**. Save and resume any troubleshooting session without losing context.
46-
* **Auto-visualize**. Copilot renders charts based on search results automatically. These charts can be added to dashboards from within Copilot.
40+
* **Natural language queries**. Ask questions in plain English.
41+
* **Contextual suggestions**. Get suggestions relevant to your troubleshooting and investigations context.
42+
* **Conversation history**. Save and resume troubleshooting or investigation sessions without losing context.
43+
* **Auto-visualize**. Copilot automatically generates charts from search results, which you can add directly to dashboards.
44+
* **Log compatibility**. Copilot supports structured logs, semi-structured logs (partial JSON), and unstructured logs (e.g., Palo Alto Firewall) when Field Extraction Rules (FERs) are applied. This ensures valuable insights across a variety of log formats.
45+
* **Enhanced query experience**. Auto-complete to streamline natural language queries.
4746

48-
## Security compliance and legal
47+
## Security and compliance
4948

5049
Copilot leverages foundational models available through Amazon Bedrock. As a result, our Copilot compliance and security posture are inherited from Amazon Bedrock. For detailed information, refer to the following Amazon Bedrock security and compliance resources:
5150

5251
* [Security in Amazon Bedrock](https://docs.aws.amazon.com/bedrock/latest/userguide/security.html)
5352
* [Amazon Bedrock Security and Privacy](https://aws.amazon.com/bedrock/security-compliance/)
5453

55-
Additionally, all aspects of our service, including Copilot, adhere to the security and compliance requirements outlined in our [service agreement](https://www.sumologic.com/service-agreement) or in individually negotiated contracts.
54+
Additionally, all aspects of our service, including Copilot, adhere to the security and compliance requirements outlined in our [service agreement](https://www.sumologic.com/service-agreement) or in individually negotiated contracts.
5655

5756
### Who benefits from Copilot?
5857

59-
Copilot is ideal for:
58+
Copilot is ideal for users of all skill levels:
6059

6160
* **On-call engineers**. Accelerate time to resolution by surfacing key troubleshooting insights.
6261
* **Security engineers**. Obtain security insights rapidly for faster security incident resolution.
@@ -69,38 +68,66 @@ In this section, you'll learn the recommended workflow for using Copilot effecti
6968

7069
To start using Copilot:
7170

72-
From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), navigate to the **Copilot** tab on the Sumo Logic home page.<br/><img src={useBaseUrl('img/search/copilot/copilot-tab.png')} alt="Copilot tab" style={{border: '1px solid gray'}} width="200" />
71+
From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), navigate to the **Copilot** tab.<br/><img src={useBaseUrl('img/search/copilot/copilot-tab.png')} alt="Copilot tab" style={{border: '1px solid gray'}} width="200" />
7372

74-
From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Copilot** in the left nav.<br/><img src={useBaseUrl('img/search/copilot/copilot-tab-new.png')} alt="Copilot tab" style={{border: '1px solid gray'}} width="150" />
73+
From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Copilot** in the left nav.<br/><img src={useBaseUrl('img/search/copilot/copilot-tab-new.png')} alt="Copilot tab" style={{border: '1px solid gray'}} width="200" />
7574

7675
### Step 2: Review the auto-selected source
7776

78-
Review the auto-selected **Source Category** and adjust it if needed. The source category is selected based on Copilot’s assessment of user intent. You can also type a source expression in the box. In either approach, you are defining the scope of your exploration. In this example, we'll select a source for AWS WAF.
77+
Review the auto-selected **Source Category** and adjust it if needed. The source category is selected based on Copilot’s assessment of user intent. You can also type a source expression in the box. In either approach, you are defining the scope of your exploration. In this example, we'll select a source for AWS WAF. For indexes, type `_index=<index name>`.
7978

8079
<img src={useBaseUrl('img/search/copilot/source-category.png')} alt="Copilot source category" style={{border: '1px solid gray'}} width="600" />
8180

8281
### Step 3: Execute a Suggestion
8382

84-
Click on any of the prebuilt **Suggestions** prompts to launch your investigation. These AI-curated natural language insights are tailored to the specific data source you've chosen.
83+
Click on any of the prebuilt **Suggestions** prompts to launch your investigation. These AI-curated natural language insights are tailored to the specific source you've chosen.
8584

8685
In this example, we'll click `Count the number of log entries by the collector ID`. This translates the insight to a log query and renders results.
8786

8887
<img src={useBaseUrl('img/search/copilot/suggestions.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="600" />
8988

90-
<br/><br/>
89+
#### Ask a question
9190

92-
<details>
93-
<summary>Manual entry (not recommended)</summary>
91+
In the **Ask Something...** field, you can manually enter a natural language prompt similar to the prebuilt ones under **Suggestions**. In addition, use autocompletions if appropriate. Type a work in the search bar to trigger completions based on the keyword.
9492

95-
In the **Ask Something...** field, you can manually enter a natural language prompt similar to the prebuilt ones under **Suggestions**.
93+
<!-- TO DO BA to upload to YouTube DEMO: https://drive.google.com/file/d/10XUn4DQD3K91V3Qf5heCizkHJneTaBJ7/view?usp=sharing
94+
-->
9695

9796
<img src={useBaseUrl('img/search/copilot/manual-entry.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="600" />
9897

9998
Broad questions may not yield accurate results. For best outcomes, frame your queries around a small, well-defined problem. If Copilot is unable to translate your prompt into a query, it will display "Failed translation".
10099

101-
Break your questions into smaller, specific prompts to help Copilot provide more accurate answers.<br/><img src={useBaseUrl('img/search/copilot/copilot-periods.gif')} alt="Copilot time period" style={{border: '1px solid gray'}} width="700" />
102-
</details>
100+
Break your questions into smaller, specific requirements to help Copilot provide more accurate answers.<br/><img src={useBaseUrl('img/search/copilot/copilot-periods.gif')} alt="Copilot time period" style={{border: '1px solid gray'}} width="700" />
101+
102+
<!-- TO DO
103+
##### Autocompletion for natural language
104+
see https://drive.google.com/file/d/10XUn4DQD3K91V3Qf5heCizkHJneTaBJ7/view?usp=sharing
105+
--->
106+
107+
Copilot is built on [Sumo Logic search query language](/docs/search/search-query-language). Below are key functions you can call using natural language prompts:
108+
109+
* `Count logs by` [field(s)]
110+
* `Group logs by` [field(s)]
111+
* `Sort by` [field(s)] [in descending order]
112+
* `Percentage breakdown in` [field] `values`
113+
* `Find` [stat] `for` [field] (max, min, standard deviation, etc.)
114+
* `Filter by` [field] `contains` [keyword]
115+
:::note
116+
Keyword searches are case-sensitive
117+
:::
118+
* `Apply logreduce to logs`
119+
120+
Additional prompts can trigger more advanced activities (e.g., mapping network activity against CrowdStrike):
121+
122+
* `Analyze risk and severity of network activity`
123+
* `Identify top application categories accessed`
103124

125+
##### Tips and tricks
126+
127+
* **Start with a broad query**. Begin with a query like `Show me the most recent logs` to understand the structure and available fields in your logs.
128+
* **Clarify field names**. If fields have similar names and cause confusion, explicitly specify the field (e.g., `<field_name>`) to improve accuracy.
129+
* **Experiment with phrasing**. Try multiple variations of a query to provide context and receive more relevant suggestions.
130+
* **Include time for timeslicing**. When timeslicing data, include the term `time` in your query. For example: `Count requests, every 1m, different code challenges and user used during login attempts by time`.
104131

105132
#### Time range
106133

@@ -119,9 +146,9 @@ The following rules are used to deduce chart type:
119146
* If both latitude and longitude fields exist, it returns a MAP chart type.
120147
* If there is only one field and one record, it returns an SVP chart type. Example query: `(_sourceCategory=ic/linux/gcp) | count by %"_sourcename" | count`
121148
* If a `sort` operator is present and there are string fields, it returns a TABLE. Given that there is a `sort` operator, probably the user is interested in `count`. Query: `(_sourceCategory=ic/linux/gcp) | count by %"_sourcename" | sort by _count`
122-
* If there is a `_timeslice` field, it returns LINE chart type if there are numeric fields or a TABLE chart type if there are string fields.
149+
* If there is a `_timeslice` field, it returns a LINE chart type if there are numeric fields or a TABLE chart type if there are string fields.
123150
* If there is one string field, one numeric field, and record count is less than 6, it returns a PIE chart type. Query: `(_sourceCategory=ic/linux/gcp) | count by %"_sourcename"`.
124-
* If there is one string field, less than 3 numeric field, and record count is less than 20, it returns a LINE chart.
151+
* If there is one string field, less than 3 numeric fields, and record count is less than 20, it returns a LINE chart.
125152
* If none of the above conditions are met, it defaults to returning a TABLE chart type.
126153

127154
If required, select your preferred chart type, such as **Table**, **Bar**, **Column**, or **Line** view to visualize your results. You can also click **Add to Dashboard** to export an AI-generated dashboard for root cause analysis.
@@ -132,27 +159,29 @@ If required, select your preferred chart type, such as **Table**, **Bar**, **Col
132159

133160
You can manually edit your log search query code if needed.
134161

135-
<details>
136-
<summary>JSON Syntax Rules</summary>
137-
138-
* Copilot supports querying JSON logs only. It cannot be used to query unstructured data, metrics, or traces. To retrieve a list of `_sourceCategories` with JSON data, use the following query:
139-
```sql
140-
_sourceCategory=* "{" "}"
141-
| limit 10000 | logreduce keys noaggregate
142-
| count by _sourceCategory, _schema
143-
| where _schema != "unknown"
144-
| sum(_count) by _sourceCategory
145-
```
146-
* If your log query contains a mix of JSON and non-JSON formatting (i.e., a log file is partially JSON), you can isolate the JSON portion by adding `{` to the source expression to trigger **Suggestions**.<br/><img src={useBaseUrl('img/search/copilot/copilot-json.png')} alt="Copilot JSON formatting" style={{border: '1px solid gray'}} width="350" />
147-
</details>
148-
149162
1. Click in the code editor field and edit your search. Not familiar with Sumo Logic query language? See [Search Query Language](/docs/search/search-query-language) to learn more.<br/><img src={useBaseUrl('img/search/copilot/code-editor.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="500" />
150163
1. When you're done, press Enter or click the search button.<br/><img src={useBaseUrl('img/search/copilot/play.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="500" />
151164

152165
:::tip
153166
To save space, you can use the **Hide Log Query** icon to collapse the log query code.<br/><img src={useBaseUrl('img/search/copilot/show-hide-query.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="500" />
154167
:::
155168

169+
#### Compatible Log Formats
170+
171+
Copilot querying is compatible with JSON logs, partial JSON logs, and unstructured logs with Field Extraction Rules. It cannot be used to query metrics or trace telemetry.
172+
173+
To retrieve a list of `_sourceCategories` with JSON data, use the following query:
174+
175+
```sql
176+
_sourceCategory=* "{" "}"
177+
| limit 10000 | logreduce keys noaggregate
178+
| count by _sourceCategory, _schema
179+
| where _schema != "unknown"
180+
| sum(_count) by _sourceCategory
181+
```
182+
183+
If your log query contains a mix of JSON and non-JSON formatting (i.e., a log file is partially JSON), you can isolate the JSON portion by adding `{` to the source expression to trigger **Suggestions**.<br/><img src={useBaseUrl('img/search/copilot/copilot-json.png')} alt="Copilot JSON formatting" style={{border: '1px solid gray'}} width="350" />
184+
156185
#### History
157186

158187
Often, users work on multiple incidents at the same time. To view Copilot interactions related to these incidents, click **History**.<br/><img src={useBaseUrl('img/search/copilot/history.png')} alt="Copilot History" style={{border: '1px solid gray'}} width="700" />
@@ -165,7 +194,7 @@ Second, you can resume from a specific query in a conversation by clicking on th
165194

166195
#### New Conversation
167196

168-
To start a new exploration, click **New Conversation**. <br/><img src={useBaseUrl('img/search/copilot/new-conversation.png')} alt="Copilot new conversation" style={{border: '1px solid gray'}} width="700" />
197+
To start a fresh exploration, click **New Conversation**. This clears your current session and allows you to begin with a clean slate.<br/><img src={useBaseUrl('img/search/copilot/new-conversation.png')} alt="Copilot new conversation" style={{border: '1px solid gray'}} width="700" />
169198

170199

171200
### Step 4: Open in Log Search
@@ -204,7 +233,7 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
204233

205234
1. In Copilot, you type the source for Cloud SIEM network records:
206235
```
207-
* _index=sec_record_network
236+
_index=sec_record_network
208237
```
209238
1. You know what you are looking for. So, you ask:
210239
```
@@ -216,7 +245,7 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
216245
Count logs by action. Sort the results. versus the previous 1h
217246
```
218247
Notice the system translated the suggestion to a log query and rendered results as a bar graph with no user input. <br/><img src={useBaseUrl('img/search/copilot/copilot-cloud-siem-2.png')} alt="Copilot tab" style={{border: '1px solid gray'}} width="800" />
219-
1. Switching to table view, you notice “Malicious” in the search results. So, you add in `Filter results by action contains Malicious` to the query:
248+
1. Switching to table view, you notice "Malicious” in the search results. So, you add in `Filter results by action contains Malicious` to the query:
220249
```
221250
Count logs by action. Sort the results. Filter results by action contains Malicious.
222251
```
@@ -233,6 +262,10 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
233262

234263
To summarize, you conclude there is malicious activity originating from certain users who need to be investigated further.
235264

265+
## Role Based Access Control
266+
267+
Role Based Access Control is not supported for contextual suggestions and autocompletions. It is possible for a user who is blocked by [log search RBAC](/docs/manage/users-roles/roles/construct-search-filter-for-role/) to view suggestions or completions for unpermitted source expressions. However, they will not be executed by the search and will see the error: `""`.
268+
236269
## Feedback
237270

238271
We want your feedback! Let us know what you think by clicking the thumbs up or thumbs down icon and entering the context of your query.

‎sidebars.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1324,6 +1324,7 @@ module.exports = {
13241324
},
13251325
],
13261326
},
1327+
'search/copilot',
13271328
{
13281329
type: 'category',
13291330
label: 'Search Query Language',

‎static/img/search/copilot/copilot-tab-new.png‎

7.03 KB
Loading

‎static/img/search/copilot/copilot-tab.png‎

1.85 KB
Loading

0 commit comments

Comments
 (0)