Skip to content

Commit 733f1d8

Browse files
jpipkin1kimsauce
andauthored
Update docs/cse/get-started-with-cloud-siem/intro-for-analysts.md
Co-authored-by: Kim (Sumo Logic) <[email protected]>
1 parent 078a2d1 commit 733f1d8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/cse/get-started-with-cloud-siem/intro-for-analysts.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ The insight page shows everything you need to start unravelling the security eve
186186

187187
When signals cluster together, Cloud SIEM uses their tactics and techniques to name the insights they generate. The insight's name can point you to how the event occurred, or why the adversary is behaving that way. For example, a tactic name like discovery or persistence shows the reasons the adversary has. Similarly, tactic names like initial access or execution can tell you a little about the methods the adversary used. These names are just starting points, however, and you may need to revise your hypotheses as you continue your investigations.
188188

189-
Example: An insight is named "Discovery with Execution"." Why did the event occur? Probably so the adversary could discover your information. How did the event occur? By using an executable file or a similar technique.
189+
Example: An insight is named "Discovery with Execution". Why did the event occur? Probably so the adversary could discover your information. How did the event occur? By using an executable file or a similar technique.
190190

191191
The timeline can tell you when the event occurred. You can see whether each signal was triggered at the same time, or sequentially, as well as whether everything happened over minutes, hours, or days. By default, insights are related signals that cluster together within the last 14 days.
192192

0 commit comments

Comments
 (0)