Skip to content

Commit 6a7043d

Browse files
authored
Remove copilot video (#4663)
1 parent b4bf5dc commit 6a7043d

File tree

1 file changed

+0
-60
lines changed

1 file changed

+0
-60
lines changed

docs/search/copilot.md

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -44,66 +44,6 @@ Copilot combines pre-built insights with the ability to ask questions of your lo
4444
* **Find root causes faster**. Use AI to quickly pinpoint issues.
4545
* **Enhance efficiency**. Streamline the log analysis process.
4646

47-
48-
## Sample Copilot queries
49-
50-
<!-- add micro lesson video when published-->
51-
<!-- replace with https://www.youtube.com/watch?v=QrRvN2Bg4NY ? -->
52-
53-
In the scenario depicted in the video, Copilot is leveraged to investigate a security issue where it appears AWS CloudTrail access keys were leaked outside an organization.
54-
55-
<Iframe url="https://player.vimeo.com/video/939372059?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479"
56-
width="854px"
57-
height="480px"
58-
title="Copilot Demo"
59-
id="myId"
60-
className="video-container"
61-
display="initial"
62-
position="relative"
63-
allow="accelerometer; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
64-
allowfullscreen
65-
/>
66-
67-
To recap the steps taken:
68-
69-
1. First, the data source is selected for AWS CloudTrail audit logs.
70-
1. Launch the log investigation by clicking the AI-suggested insight `Count logs by eventname`, which translates the insight to a log query and renders results.
71-
1. The query is refined by applying the suggestion `Count logs by eventname, access key and sourceIp`.
72-
1. The filter is applied for Create and Authorize events; attackers often create new resources during a breach. You'll then see an anomaly with `AuthoritySecurityGroupIngress` events.
73-
1. Feedback is provided back to Sumo Logic to enhance the AI's accuracy stating that the queries have been accurate so far.
74-
1. The security `groupid` is added to the prompt to tabulate events containing that data.
75-
1. Focus on a specific access key, `ABCDEFGOYCM3PIKNOVRA`, noting `PutRolePolicy` events indicating permission elevation. Multiple AWS accounts are impacted.
76-
77-
You can conclude that the access key was used to modify permissions, providing the attacker with a potential network entry point. Remediation would involve disabling the key, blocking the source IP, and further log analysis.
78-
79-
<!--
80-
### Security example
81-
82-
This video demonstrates how to use Copilot to analyze AWS CloudTrail data by reviewing AI-curated suggestions, refining searches with natural language prompts, and launching an AI-generated dashboard for root cause analysis and sharing.
83-
84-
<Iframe url="https://www.youtube.com/embed/QrRvN2Bg4NY?si=Bsc2mRbqMPq8bsqg"
85-
width="854px"
86-
height="480px"
87-
title="Copilot Demo"
88-
id="myId"
89-
className="video-container"
90-
display="initial"
91-
position="relative"
92-
allow="accelerometer; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
93-
allowfullscreen
94-
/>
95-
96-
Here's a recap:
97-
98-
1. **Select AWS CloudTrail**. Start by selecting AWS CloudTrail as the data source.
99-
1. **Review Suggestions**. Look at the **Suggestions** section where AI-curated natural language insights are provided, customized for the specific AWS CloudTrail data.
100-
1. **Select a Suggestion**. Choose the suggestion `Count logs by eventname`.
101-
1. **Refine Search**. Enhance your search for log anomalies by adding `access key and sourceIp` to the prompt. No need to edit the query code.
102-
1. **Filter Results**. Narrow down the results by adding `eventname contains Create` to the prompt.
103-
1. **Review Recommendations**. Quickly review AI-driven recommendations to identify attacker TTPs (Tactics, Techniques, and Procedures).
104-
1. **Launch Dashboard**. Launch an AI-generated dashboard directly from the UI for root cause analysis.
105-
-->
106-
10747
## How to use Copilot
10848

10949
In this section, you'll learn the recommended workflow for using Copilot effectively, along with best practices to maximize its benefits.

0 commit comments

Comments
 (0)