You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cse/administration/manage-custom-insight-resolutions.md
+5-4Lines changed: 5 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,13 +23,14 @@ You can define custom *sub-resolutions* for any of the built-in resolutions. Thi
23
23
## Create a custom sub-resolution
24
24
25
25
1.[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Resolutions**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Resolutions**. You can also click the **Go To...** menu at the top of the screen and select **Insight Resolutions**.
26
-
1. On the **Insight Resolutions**page, click **Create**.
27
-
1. The **Create Insight Resolution**page appears.
26
+
1. On the **Insight Resolutions**tab, click **+ Add Resolution**.
27
+
1. The **Add Insight Resolution**popup appears.
28
28
1.**Name**. Enter a meaningful name for the new resolution.
29
29
1.**Parent Resolution**. Display the dropdown list and select a built-in resolution.
30
30
1.**Description**. (Optional) Enter a description that will help other users understand when to use the new resolution.
Copy file name to clipboardExpand all lines: docs/cse/administration/manage-custom-insight-statuses.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ This page has information about creating and managing custom Insight statuses.
14
14
To view Insight statuses:
15
15
16
16
1.[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**.
17
-
1. This screenshot of the **Statuses**page shows the three Insight statuses that are preconfigured:
17
+
1. This screenshot of the **Insight Statuses**tab shows the three Insight statuses that are preconfigured:
18
18
***New**. Insights that have not been worked on yet.
19
19
***In Progress**. Insights that are being investigated. If you want to create custom statuses to represent different types of "in progress" states, you can click the **Enabled** toggle to disable the default **In Progress** status to reduce confusion.
@@ -26,28 +26,28 @@ Preconfigured Insight statuses cannot be edited or deleted. You can however crea
26
26
To create a custom Insight status:
27
27
28
28
1.[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**.
29
-
1. On the **Statuses**page, click **Create Status**.
30
-
1. On the **New Status** popup, enter a name and description for the status.
29
+
1. On the **Insight Statuses**tab, click **+ Add Status**.
30
+
1. On the **Add Insight Status** popup, enter a name and description for the status.
31
31
1. Click **Color** to select a color for the status. The color will appear on the status on the [Heads Up Display](/docs/cse/get-started-with-cloud-siem/cse-heads-up-display).
32
32
33
33
## Change the order of Insight statuses
34
34
35
-
You can change the status of an Insight on the **Details** pane of the page for the Insight. Note that the items in the **Status** dropdown appear in the same order as they do on the **Statuses**page.
35
+
You can change the status of an Insight on the **Details** pane of the page for the Insight. Note that the items in the **Status** dropdown appear in the same order as they do on the **Insight Statuses**tab.
To change the order that the statuses appear in the **Status** dropdown, you can reorder them on the **Statuses**page, except for **New** and **Closed**. **New** must always be the first status, and **Closed** must always be the last.
39
+
To change the order that the statuses appear in the **Status** dropdown, you can reorder them on the **Insight Statuses**tab, except for **New** and **Closed**. **New** must always be the first status, and **Closed** must always be the last.
40
40
41
41
To change the order of Insight statuses:
42
42
43
43
44
44
1.[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**.
45
-
1. On the **Statuses**page, each status that can be moved has a handle to the left of its name. <br/><img src={useBaseUrl('img/cse/reorder-icons.png')} alt="Reorder icons" style={{border: '1px solid gray'}} width="200"/>
45
+
1. On the **Insight Statuses**tab, each status that can be moved has a handle to the left of its name. <br/><img src={useBaseUrl('img/cse/reorder-icons.png')} alt="Reorder icons" style={{border: '1px solid gray'}} width="600"/>
46
46
1. To move a status to a different location on the list, use your mouse to drag it to the desired location.
47
47
48
48
## Edit or delete a custom Insight status
49
49
50
-
On the **Statuses**page, you can edit or delete any of the custom Insight statuses that have been created.
50
+
On the **Insight Statuses**tab, you can edit or delete any of the custom Insight statuses that have been created.
51
51
52
52
The edit and delete icons are only available for custom statuses.
Copy file name to clipboardExpand all lines: docs/cse/records-signals-entities-insights/entity-criticality.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,11 +31,11 @@ You can configure both the detection window and the threshold Activity Score for
31
31
## Define a Criticality
32
32
33
33
1.[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Criticality**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Criticality**. You can also click the **Go To...** menu at the top of the screen and select **Criticality**.
34
-
1. On the **Entity Criticality**page, click **Create**.
3.**Severity Expression**. Enter a formula for adjusting a severity value. You can use a plus sign (+), minus sign (-), an asterisk (\*), or a forward slash (/). Enter the formula in this format: `severity+2 `
0 commit comments