Skip to content

Commit 46e8285

Browse files
committed
Change terms to lowercase in 'Records, Signals, Entities, and Insights' section
1 parent a9c714d commit 46e8285

14 files changed

+330
-332
lines changed

docs/cse/get-started-with-cloud-siem/index.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,19 @@ This guide helps you get started using Cloud SIEM for threat hunting.
3535
<div className="box smallbox card">
3636
<div className="container">
3737
<a href="/docs/cse/get-started-with-cloud-siem/insight-generation-process"><img src={useBaseUrl('img/icons/security/siem-challenges.png')} alt="Shield on a workflow icon" width="40"/><h4>Insight Generation</h4></a>
38-
<p>Learn how Cloud SIEM correlates Signals by entity to create Insights.</p>
38+
<p>Learn how Cloud SIEM correlates signals by entity to create insights.</p>
3939
</div>
4040
</div>
4141
<div className="box smallbox card">
4242
<div className="container">
4343
<a href="/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui"><img src={useBaseUrl('img/icons/security/siem-challenges.png')} alt="Shield on a workflow icon" width="40"/><h4>Cloud SIEM Insight UI</h4></a>
44-
<p>Learn about the contents of the Insights UI in Cloud SIEM.</p>
44+
<p>Learn about the contents of the insights UI in Cloud SIEM.</p>
4545
</div>
4646
</div>
4747
<div className="box smallbox card">
4848
<div className="container">
4949
<a href="/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog"><img src={useBaseUrl('img/icons/security/compliance.png')} alt="Checklist icon" width="40"/><h4>Cloud SIEM Content Catalog</h4></a>
50-
<p>See the out-of-the-box Rules, Schema, Mappings, and Parsers for Cloud SIEM.</p>
50+
<p>See the out-of-the-box rules, schema, mappings, and parsers for Cloud SIEM.</p>
5151
</div>
5252
</div>
5353
<div className="box smallbox card">

docs/cse/records-signals-entities-insights/about-signal-suppression.md

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
id: about-signal-suppression
33
title: About Signal Suppression
44
sidebar_label: Signal Suppression
5-
description: Learn about the ways that Cloud SIEM Signals can be suppressed, and so excluded from the Insight generation process.
5+
description: Learn about the ways that Cloud SIEM signals can be suppressed, and so excluded from the insight generation process.
66
keywords:
77
- Cloud SIEM
88
- entity
@@ -11,57 +11,57 @@ keywords:
1111

1212
import useBaseUrl from '@docusaurus/useBaseUrl';
1313

14-
This topic describes the various ways that Signals can get suppressed.
14+
This topic describes the various ways that signals can get suppressed.
1515

16-
In Cloud SIEM, a *suppressed Signal* is a Signal that Cloud SIEM's Insight algorithm will exclude from the Insight generation process. In other words, a suppressed Signal does not contribute to or become a part of an Insight. By default, Signals are automatically suppressed for 72 hours.
16+
In Cloud SIEM, a *suppressed signal* is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours.
1717

18-
Signal suppression can occur for a variety of reasons, including [Entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant Signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, Signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the Signal ID of an identical Signal that caused subsequent redundant Signals to be suppressed, or it may contain the name of the network block with suppression enabled.
18+
Signal suppression can occur for a variety of reasons, including [entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the signal ID of an identical signal that caused subsequent redundant signals to be suppressed, or it may contain the name of the network block with suppression enabled.
1919

20-
## Set the global Signal suppression value
20+
## Set the global signal suppression value
2121

22-
By default, Signals are automatically suppressed for 72 hours. You can change this value to anywhere from 24 hours to 72 hours with the **Global Signal Suppression** setting on the **Insight Detection** page. See [Set Insight Generation Window and Threshold](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/).
22+
By default, signals are automatically suppressed for 72 hours. You can change this value to anywhere from 24 hours to 72 hours with the **Global Signal Suppression** setting on the **Insight Detection** page. See [Set Insight Generation Window and Threshold](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/).
2323

2424
<img src={useBaseUrl('img/cse/detection-threshold-global-signal-suppression.png')} alt="Detection threshold settings" style={{border: '1px solid gray'}} width="600"/>
2525

26-
### Override global Signal suppression
26+
### Override global signal suppression
2727

28-
You can override the [global Signal suppression](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/) in any rule. This allows the rule to generate Signals in a shorter time frame than the 72-hour default. This can be helpful, for example, when you want the rule to generate Signals for time-sensitive issues that cannot wait for 72 hours before generating a Signal.<br/><img src={useBaseUrl('img/cse/override-global-signal-suppression.png')} alt="Override Global Signal Suppression" style={{border: '1px solid gray'}} width="500"/>
28+
You can override the [global signal suppression](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/) in any rule. This allows the rule to generate signals in a shorter time frame than the 72-hour default. This can be helpful, for example, when you want the rule to generate signals for time-sensitive issues that cannot wait for 72 hours before generating a signal.<br/><img src={useBaseUrl('img/cse/override-global-signal-suppression.png')} alt="Override Global Signal Suppression" style={{border: '1px solid gray'}} width="500"/>
2929

30-
To override global Signal suppression in a rule:
30+
To override global signal suppression in a rule:
3131
1. Create or edit a [rule](/docs/cse/rules/).
3232
1. Click **Show Advanced** on the **Then Create a Signal** tab.
3333
1. Select the **Override Global Signal Suppression** check box.
34-
1. Enter the hours and/or minutes to suppress Signal generation.
34+
1. Enter the hours and/or minutes to suppress signal generation.
3535

3636
For certain rule types (Threshold, Chain, or Aggregation), the minimum valid value you can enter is determined by the time value in the **If Triggered** tab. <br/><img src={useBaseUrl('img/cse/override-global-signal-suppression-grouped-by.png')} alt="Minimum valid value" style={{border: '1px solid gray'}} width="600"/>
3737

38-
## Suppress by Entity
38+
## Suppress by entity
3939

40-
You can suppress an Entity on its [details page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-details-page) in the Cloud SIEM UI using the suppression slider. 
40+
You can suppress an entity on its [details page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-details-page) in the Cloud SIEM UI using the suppression slider. 
4141

4242
<img src={useBaseUrl('img/cse/suppression-slider.png')} alt="Entity suppression slider" style={{border: '1px solid gray'}} width="300"/>
4343

44-
You can suppress multiple Entities at once on the [Entities list page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-list-page) in the Cloud SIEM UI. Note that in the screenshot below, the row for an Entity that is currently suppressed contains a **Suppressed** indicator.
44+
You can suppress multiple entities at once on the [entities list page](/docs/cse/records-signals-entities-insights/view-manage-entities#about-the-entities-list-page) in the Cloud SIEM UI. Note that in the screenshot below, the row for an Entity that is currently suppressed contains a **Suppressed** indicator.
4545

46-
<img src={useBaseUrl('img/cse/entity-page.png')} alt="Suppression on the Entities page" style={{border: '1px solid gray'}} width="800"/>
46+
<img src={useBaseUrl('img/cse/entity-page.png')} alt="Suppression on the entities page" style={{border: '1px solid gray'}} width="800"/>
4747

48-
When you checkmark one or more Entities, the **Update Suppression** button appears. When you click it you’re prompted to set the suppression state for the select Entities. You can also create a .csv file with your suppression changes, and use the **Import Metadata** button to upload it to Cloud SIEM. For details, see the [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities) topic.
48+
When you checkmark one or more entities, the **Update Suppression** button appears. When you click it you’re prompted to set the suppression state for the select entities. You can also create a .csv file with your suppression changes, and use the **Import Metadata** button to upload it to Cloud SIEM. For details, see the [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities) topic.
4949

50-
You can see what Entities are currently suppressed on the **Entities** page by filtering the list by **Suppressed**. <br/><img src={useBaseUrl('img/cse/suppressed-entities-page.png')} alt="Suppressed Entities" style={{border: '1px solid gray'}} width="300"/>
50+
You can see what entities are currently suppressed on the **Entities** page by filtering the list by **Suppressed**. <br/><img src={useBaseUrl('img/cse/suppressed-entities-page.png')} alt="Suppressed entities" style={{border: '1px solid gray'}} width="300"/>
5151

5252
## Suppress by indicator
5353

54-
Signals can be suppressed based on the presence of a suppressed indicator in any of the Records associated with a Signal. You create lists of indicators, which are things like IPs, hostnames, URLs, domains, and so. You can set a TTL (time to live) after which an indicator will be unsuppressed. You can create these lists on the [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/) page, available from the content menu. 
54+
Signals can be suppressed based on the presence of a suppressed indicator in any of the records associated with a signal. You create lists of indicators, which are things like IPs, hostnames, URLs, domains, and so. You can set a TTL (time to live) after which an indicator will be unsuppressed. You can create these lists on the [**Suppressed Lists**](/docs/cse/match-lists-suppressed-lists/suppressed-lists/) page, available from the content menu. 
5555

56-
<img src={useBaseUrl('img/cse/suppressed-lists.png')} alt="Suppress Entities by indicator" style={{border: '1px solid gray'}} width="800"/>
56+
<img src={useBaseUrl('img/cse/suppressed-lists.png')} alt="Suppress entities by indicator" style={{border: '1px solid gray'}} width="800"/>
5757

58-
## Suppress by Network Block
58+
## Suppress by network block
5959

60-
You can suppress Signals on all of the IP addresses in a Network Block. You can see on the Network Blocks page whether or not Signals are suppressed for IPs in the block. For more information, see [Create and Use Network Blocks](/docs/cse/administration/create-use-network-blocks/).
60+
You can suppress signals on all of the IP addresses in a network block. You can see on the network blocks page whether or not signals are suppressed for IPs in the block. For more information, see [Create and Use Network Blocks](/docs/cse/administration/create-use-network-blocks/).
6161

6262
<img src={useBaseUrl('img/cse/network-block-page.png')} alt="Suppress by network block" style={{border: '1px solid gray'}} width="800"/>
6363

64-
## Automatic suppression of redundant Signals
64+
## Automatic suppression of redundant signals
6565

66-
Cloud SIEM suppresses redundant Signals to prevent the generation of multiple, virtually identical Insights. For information about how this works, see [Redundant Signal suppression](/docs/cse/get-started-with-cloud-siem/insight-generation-process#redundant-signal-suppression).
66+
Cloud SIEM suppresses redundant signals to prevent the generation of multiple, virtually identical insights. For information about how this works, see [Redundant signal suppression](/docs/cse/get-started-with-cloud-siem/insight-generation-process#redundant-signal-suppression).
6767

0 commit comments

Comments
 (0)