You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/copilot.md
-60Lines changed: 0 additions & 60 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,66 +44,6 @@ Copilot combines pre-built insights with the ability to ask questions of your lo
44
44
***Find root causes faster**. Use AI to quickly pinpoint issues.
45
45
***Enhance efficiency**. Streamline the log analysis process.
46
46
47
-
48
-
## Sample Copilot queries
49
-
50
-
<!-- add micro lesson video when published-->
51
-
<!-- replace with https://www.youtube.com/watch?v=QrRvN2Bg4NY ? -->
52
-
53
-
In the scenario depicted in the video, Copilot is leveraged to investigate a security issue where it appears AWS CloudTrail access keys were leaked outside an organization.
1. First, the data source is selected for AWS CloudTrail audit logs.
70
-
1. Launch the log investigation by clicking the AI-suggested insight `Count logs by eventname`, which translates the insight to a log query and renders results.
71
-
1. The query is refined by applying the suggestion `Count logs by eventname, access key and sourceIp`.
72
-
1. The filter is applied for Create and Authorize events; attackers often create new resources during a breach. You'll then see an anomaly with `AuthoritySecurityGroupIngress` events.
73
-
1. Feedback is provided back to Sumo Logic to enhance the AI's accuracy stating that the queries have been accurate so far.
74
-
1. The security `groupid` is added to the prompt to tabulate events containing that data.
75
-
1. Focus on a specific access key, `ABCDEFGOYCM3PIKNOVRA`, noting `PutRolePolicy` events indicating permission elevation. Multiple AWS accounts are impacted.
76
-
77
-
You can conclude that the access key was used to modify permissions, providing the attacker with a potential network entry point. Remediation would involve disabling the key, blocking the source IP, and further log analysis.
78
-
79
-
<!--
80
-
### Security example
81
-
82
-
This video demonstrates how to use Copilot to analyze AWS CloudTrail data by reviewing AI-curated suggestions, refining searches with natural language prompts, and launching an AI-generated dashboard for root cause analysis and sharing.
1. **Select AWS CloudTrail**. Start by selecting AWS CloudTrail as the data source.
99
-
1. **Review Suggestions**. Look at the **Suggestions** section where AI-curated natural language insights are provided, customized for the specific AWS CloudTrail data.
100
-
1. **Select a Suggestion**. Choose the suggestion `Count logs by eventname`.
101
-
1. **Refine Search**. Enhance your search for log anomalies by adding `access key and sourceIp` to the prompt. No need to edit the query code.
102
-
1. **Filter Results**. Narrow down the results by adding `eventname contains Create` to the prompt.
103
-
1. **Review Recommendations**. Quickly review AI-driven recommendations to identify attacker TTPs (Tactics, Techniques, and Procedures).
104
-
1. **Launch Dashboard**. Launch an AI-generated dashboard directly from the UI for root cause analysis.
105
-
-->
106
-
107
47
## How to use Copilot
108
48
109
49
In this section, you'll learn the recommended workflow for using Copilot effectively, along with best practices to maximize its benefits.
0 commit comments