You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .clabot
+1Lines changed: 1 addition & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -172,6 +172,7 @@
172
172
"chetanchoudhary-sumo",
173
173
"JamoCA",
174
174
"darshan-sumo"
175
+
"mahendrak-sumo"
175
176
],
176
177
"message": "Thank you for your contribution! As this is an open source project, we require contributors to sign our Contributor License Agreement and do not have yours on file. To proceed with your PR, please [sign your name here](https://forms.gle/YgLddrckeJaCdZYA6) and we will add you to our approved list of contributors.",
We're excited to introduce the new Trend Micro Vision One app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Trend Micro Vision One source that collects alert logs data from the Trend Micro Vision One platform. This app helps you can gain real-time visibility into security events and incidents within your organization's infrastructure, allowing them to detect and react to potential threats quickly. [Learn more](/docs/integrations/saas-cloud/trend-micro-vision-one/).
Copy file name to clipboardExpand all lines: docs/cse/administration/create-custom-threat-intel-source.md
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ This topic has information about setting up a *custom threat intelligence source
12
12
13
13
You can set up and populate custom threat intelligence sources interactively from the Cloud SIEM UI, by uploading a .csv file, or using Cloud SIEM APIs. You can populate the sources with IP addresses, hostnames, URLs, email addresses, and file hashes.
14
14
15
-
###How Cloud SIEM uses indicators
15
+
## How Cloud SIEM uses indicators
16
16
17
17
When Cloud SIEM encounters an indicator from your threat source in an incoming
18
18
record it adds relevant information to the record. Because threat intelligence
@@ -24,7 +24,7 @@ this way.
24
24
Rule authors can also write rules that look for threat intelligence information in records. To leverage the information in a rule, you can extend your custom rule expression, or add a Rule Tuning Expression to a built-in rule. For a more detailed explanation of how to use threat intelligence information in rules, see [Threat Intelligence](/docs/cse/rules/about-cse-rules/#threat-intelligence) in the
25
25
*About Cloud SIEM Rules* topic.
26
26
27
-
###Create a threat intelligence source from Cloud SIEM UI
27
+
## Create a threat intelligence source from Cloud SIEM UI
28
28
29
29
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Threat Intelligence**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**.
30
30
1. Click **Add Source** on the **Threat Intelligence** page.
@@ -34,6 +34,8 @@ Rule authors can also write rules that look for threat intelligence information
34
34
35
35
Your new source should now appear on the **Threat Intelligence** page.
36
36
37
+
## Add threat indicators
38
+
37
39
### Enter indicators manually
38
40
39
41
1. On the **Threat Intelligence** page, click the name of the source you want to update.
You can use Cloud SIEM threat intelligence APIs to create and manage indicators and custom threat sources. For information about Cloud SIEM APIs and how to access the API documentation, see [Cloud SIEM APIs](/docs/cse/administration/cse-apis/).
91
-
92
+
You can use Cloud SIEM threat intelligence APIs to create and manage indicators and custom threat sources. For information about Cloud SIEM APIs and how to access the API documentation, see [Cloud SIEM APIs](/docs/cse/administration/cse-apis/).
93
+
94
+
## Search indicators
95
+
96
+
To search threat indicators, click the **Search All Indicators** button at the top of the **Threat Intelligence** page.
97
+
98
+
You can search using the same functionality available for other Cloud SIEM searches, including regular expressions. For more information, see [Filter and Search Cloud SIEM List Pages](/docs/cse/administration/filter-search).
Copy file name to clipboardExpand all lines: docs/cse/administration/filter-search.md
+12-10Lines changed: 12 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,18 +11,20 @@ keywords:
11
11
12
12
import useBaseUrl from '@docusaurus/useBaseUrl';
13
13
14
-
You can filter and search the list pages in Cloud SIEM—**Insights**, **Signals**, **Entities**, **Records**, **Rules**, and **Network Blocks**—using the **Filters** bar near the top of the page.
14
+
## Search in Cloud SIEM
15
15
16
-
<img src={useBaseUrl('img/cse/list-page-search.png')} alt="Filters box at the top of the page " width="500" />
16
+
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Cloud SIEM**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Search Cloud SIEM**. You can also click the **Go To...** menu at the top of the screen and select **Search Cloud SIEM**.
17
+
1. Click in the **Find Insights, Signals, Entities and more...** search bar at the top of the page.<br/><img src={useBaseUrl('img/cse/list-page-search.png')} alt="Search box at the top of the page" width="400" />
18
+
1. Enter text to search.
19
+
1. To filter, click the filter icon <img src={useBaseUrl('img/cse/filter-icon.png')} alt="Filter icon" width="20" /> on the right side of the search box.
20
+
1. Select a source to filter on. <br/><img src={useBaseUrl('img/cse/search-sources.png')} alt="Search sources" width="250" />
21
+
1. A dropdown list of filters appears for that source. Select a field to filter on, or pick a suggestion.<br/><img src={useBaseUrl('img/cse/filter-options.png')} alt="List of fields to filter on" width="400"/>
22
+
1. Continue to select options to filter on from the options presented.
17
23
18
-
## Filter items
19
-
When you click in the **Filters** bar, a dropdown list of filters appears. After you select a filter you’ll be presented with a dialog so you can specify your filtering criteria.
24
+
## Search using regular expressions
20
25
21
-
<img src={useBaseUrl('img/cse/filter-options.png')} alt="List of fields to filter on" width="250"/>
26
+
You also enter a search string or regex in the search bar, and press Return to run a search. Note that Cloud SIEM's regular expression engine will return items that contain text matching the complete string. The engine implicitly adds anchors (`^` and `$`) to the beginning and end of your regex.
22
27
23
-
## Search items
24
-
You also enter a search string or regex in the **Filter** bar, and press Return to run a search. Note that Cloud SIEM's regular expression engine will return items that contain text matching the complete string. The engine implicitly adds anchors (`^` and `$`) to the beginning and end of your regex.
28
+
Cloud SIEM search uses Elasticsearch. For regular expressions allowed for use in Cloud SIEM search, see [Regular expression syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html) in the Elastic documentation.
25
29
26
-
You can use `not` to search for items that do not contain a particular keyword, for example:
27
-
28
-
`not:Initial Access`
30
+
You can use `not` to search for items that do not contain a particular keyword, for example: `not:Initial Access`
Copy file name to clipboardExpand all lines: docs/cse/match-lists-suppressed-lists/suppressed-lists.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,15 +52,17 @@ Match lists are for when you want to use the existence or absence of an indicato
52
52
53
53
Cloud SIEM uses suppressed lists similar to how it uses [match lists](#suppressed-list-or-match-list). When Cloud SIEM processes an incoming record, it compares the entries in each suppressed list to record fields of the same type as the target column of the suppressed list. For example, given a suppressed list whose target column is **Domain**, Cloud SIEM will compare items on that list only to record fields that contain domains.
54
54
55
-
When a record contains a value that matches one or more suppressed lists, two fields in the record get populated:
55
+
Keep in mind:
56
+
* Suppression lists will suppress any signal where the suppressed indicator is present, regardless of the primary entity in the signal.
57
+
* Entity suppression will only suppress the signal if the suppressed entity is the primary signal.
58
+
* If any entities within the record match items listed in a suppressed list, suppressed signals will be generated for those entities across all rules. Consequently, these signals will not affect the entity's Activity Score or contribute to insight generation.
56
59
60
+
When a record contains a value that matches one or more suppressed lists, two fields in the record get populated:
57
61
*`listMatches`. Cloud SIEM adds the names of the suppressed lists that the record matched, and the column values of those lists. For example, if an IP address in a record matches the SourceIP address in the “vuln_scanners” suppressed list, the `listMatches` field would look like this: `listMatches: ['vuln_scanners', 'column:SourceIp']`
58
62
*`matchedItems`. Cloud SIEM adds the actual key-value pairs that were matched. For example, continuing the example above, if “vuln_scanners” match list contained an entry “5.6.7.8”, and the record’s SourceIp is also “5.6.7.8”, the assuming the SourceIP address in the “vuln_scanners” suppressed list, the `matchedItems` field would look like this: `matchedItems: [ { value: '5.6.7.8', …other metadata about list item } ]`
59
63
60
64
Because the information about list matches gets persisted within records, you can reference it downstream in both rules and search.
61
65
62
-
**If any entities within the record match items listed in a suppressed list, suppressed signals will be generated for those entities across all rules**. Consequently, these signals will not affect the entity's Activity Score or contribute to insight generation.
63
-
64
66
For more information about signal Suppression mechanisms, see [About Signal Suppression](/docs/cse/records-signals-entities-insights/about-signal-suppression/).
0 commit comments