You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cse/get-started-with-cloud-siem/index.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,19 +35,19 @@ This guide helps you get started using Cloud SIEM for threat hunting.
35
35
<divclassName="box smallbox card">
36
36
<divclassName="container">
37
37
<ahref="/docs/cse/get-started-with-cloud-siem/insight-generation-process"><img src={useBaseUrl('img/icons/security/siem-challenges.png')} alt="Shield on a workflow icon" width="40"/><h4>Insight Generation</h4></a>
38
-
<p>Learn how Cloud SIEM correlates Signals by entity to create Insights.</p>
38
+
<p>Learn how Cloud SIEM correlates signals by entity to create insights.</p>
39
39
</div>
40
40
</div>
41
41
<divclassName="box smallbox card">
42
42
<divclassName="container">
43
43
<ahref="/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui"><img src={useBaseUrl('img/icons/security/siem-challenges.png')} alt="Shield on a workflow icon" width="40"/><h4>Cloud SIEM Insight UI</h4></a>
44
-
<p>Learn about the contents of the Insights UI in Cloud SIEM.</p>
44
+
<p>Learn about the contents of the insights UI in Cloud SIEM.</p>
Copy file name to clipboardExpand all lines: docs/cse/records-signals-entities-insights/about-signal-suppression.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
id: about-signal-suppression
3
3
title: About Signal Suppression
4
4
sidebar_label: Signal Suppression
5
-
description: Learn about the ways that Cloud SIEM Signals can be suppressed, and so excluded from the Insight generation process.
5
+
description: Learn about the ways that Cloud SIEM signals can be suppressed, and so excluded from the insight generation process.
6
6
keywords:
7
7
- Cloud SIEM
8
8
- entity
@@ -11,57 +11,57 @@ keywords:
11
11
12
12
import useBaseUrl from '@docusaurus/useBaseUrl';
13
13
14
-
This topic describes the various ways that Signals can get suppressed.
14
+
This topic describes the various ways that signals can get suppressed.
15
15
16
-
In Cloud SIEM, a *suppressed Signal* is a Signal that Cloud SIEM's Insight algorithm will exclude from the Insight generation process. In other words, a suppressed Signal does not contribute to or become a part of an Insight. By default, Signals are automatically suppressed for 72 hours.
16
+
In Cloud SIEM, a *suppressed signal* is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours.
17
17
18
-
Signal suppression can occur for a variety of reasons, including [Entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant Signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, Signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the Signal ID of an identical Signal that caused subsequent redundant Signals to be suppressed, or it may contain the name of the network block with suppression enabled.
18
+
Signal suppression can occur for a variety of reasons, including [entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the signal ID of an identical signal that caused subsequent redundant signals to be suppressed, or it may contain the name of the network block with suppression enabled.
19
19
20
-
## Set the global Signal suppression value
20
+
## Set the global signal suppression value
21
21
22
-
By default, Signals are automatically suppressed for 72 hours. You can change this value to anywhere from 24 hours to 72 hours with the **Global Signal Suppression** setting on the **Insight Detection** page. See [Set Insight Generation Window and Threshold](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/).
22
+
By default, signals are automatically suppressed for 72 hours. You can change this value to anywhere from 24 hours to 72 hours with the **Global Signal Suppression** setting on the **Insight Detection** page. See [Set Insight Generation Window and Threshold](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/).
You can override the [global Signal suppression](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/) in any rule. This allows the rule to generate Signals in a shorter time frame than the 72-hour default. This can be helpful, for example, when you want the rule to generate Signals for time-sensitive issues that cannot wait for 72 hours before generating a Signal.<br/><img src={useBaseUrl('img/cse/override-global-signal-suppression.png')} alt="Override Global Signal Suppression" style={{border: '1px solid gray'}} width="500"/>
28
+
You can override the [global signal suppression](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/) in any rule. This allows the rule to generate signals in a shorter time frame than the 72-hour default. This can be helpful, for example, when you want the rule to generate signals for time-sensitive issues that cannot wait for 72 hours before generating a signal.<br/><img src={useBaseUrl('img/cse/override-global-signal-suppression.png')} alt="Override Global Signal Suppression" style={{border: '1px solid gray'}} width="500"/>
29
29
30
-
To override global Signal suppression in a rule:
30
+
To override global signal suppression in a rule:
31
31
1. Create or edit a [rule](/docs/cse/rules/).
32
32
1. Click **Show Advanced** on the **Then Create a Signal** tab.
33
33
1. Select the **Override Global Signal Suppression** check box.
34
-
1. Enter the hours and/or minutes to suppress Signal generation.
34
+
1. Enter the hours and/or minutes to suppress signal generation.
35
35
36
36
For certain rule types (Threshold, Chain, or Aggregation), the minimum valid value you can enter is determined by the time value in the **If Triggered** tab. <br/><img src={useBaseUrl('img/cse/override-global-signal-suppression-grouped-by.png')} alt="Minimum valid value" style={{border: '1px solid gray'}} width="600"/>
37
37
38
-
## Suppress by Entity
38
+
## Suppress by entity
39
39
40
-
You can suppress an Entity on its [details page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-details-page) in the Cloud SIEM UI using the suppression slider.
40
+
You can suppress an entity on its [details page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-details-page) in the Cloud SIEM UI using the suppression slider.
You can suppress multiple Entities at once on the [Entities list page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-list-page) in the Cloud SIEM UI. Note that in the screenshot below, the row for an Entity that is currently suppressed contains a **Suppressed** indicator.
44
+
You can suppress multiple entities at once on the [entities list page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-list-page) in the Cloud SIEM UI. Note that in the screenshot below, the row for an Entity that is currently suppressed contains a **Suppressed** indicator.
45
45
46
-
<img src={useBaseUrl('img/cse/entity-page.png')} alt="Suppression on the Entities page" style={{border: '1px solid gray'}} width="800"/>
46
+
<img src={useBaseUrl('img/cse/entity-page.png')} alt="Suppression on the entities page" style={{border: '1px solid gray'}} width="800"/>
47
47
48
-
When you checkmark one or more Entities, the **Update Suppression** button appears. When you click it you’re prompted to set the suppression state for the select Entities. You can also create a .csv file with your suppression changes, and use the **Import Metadata** button to upload it to Cloud SIEM. For details, see the [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities) topic.
48
+
When you checkmark one or more entities, the **Update Suppression** button appears. When you click it you’re prompted to set the suppression state for the select entities. You can also create a .csv file with your suppression changes, and use the **Import Metadata** button to upload it to Cloud SIEM. For details, see the [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities) topic.
49
49
50
-
You can see what Entities are currently suppressed on the **Entities** page by filtering the list by **Suppressed**. <br/><img src={useBaseUrl('img/cse/suppressed-entities-page.png')} alt="Suppressed Entities" style={{border: '1px solid gray'}} width="300"/>
50
+
You can see what entities are currently suppressed on the **Entities** page by filtering the list by **Suppressed**. <br/><img src={useBaseUrl('img/cse/suppressed-entities-page.png')} alt="Suppressed entities" style={{border: '1px solid gray'}} width="300"/>
51
51
52
52
## Suppress by indicator
53
53
54
-
Signals can be suppressed based on the presence of a suppressed indicator in any of the Records associated with a Signal. You create lists of indicators, which are things like IPs, hostnames, URLs, domains, and so. You can set a TTL (time to live) after which an indicator will be unsuppressed. You can create these lists on the [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/) page, available from the content menu.
54
+
Signals can be suppressed based on the presence of a suppressed indicator in any of the records associated with a signal. You create lists of indicators, which are things like IPs, hostnames, URLs, domains, and so. You can set a TTL (time to live) after which an indicator will be unsuppressed. You can create these lists on the [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/) page, available from the content menu.
You can suppress Signals on all of the IP addresses in a Network Block. You can see on the Network Blocks page whether or not Signals are suppressed for IPs in the block. For more information, see [Create and Use Network Blocks](/docs/cse/administration/create-use-network-blocks/).
60
+
You can suppress signals on all of the IP addresses in a network block. You can see on the network blocks page whether or not signals are suppressed for IPs in the block. For more information, see [Create and Use Network Blocks](/docs/cse/administration/create-use-network-blocks/).
Cloud SIEM suppresses redundant Signals to prevent the generation of multiple, virtually identical Insights. For information about how this works, see [Redundant Signal suppression](/docs/cse/get-started-with-cloud-siem/insight-generation-process#redundant-signal-suppression).
66
+
Cloud SIEM suppresses redundant signals to prevent the generation of multiple, virtually identical insights. For information about how this works, see [Redundant signal suppression](/docs/cse/get-started-with-cloud-siem/insight-generation-process#redundant-signal-suppression).
0 commit comments