You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
***Threat Count.** Count of threats related to malicious domains, for the last 15 minutes.
69
-
***Threats by Malicious Confidence.** Qualifies domain threats into High, Medium, Low, Unverified, according to CrowdStrike's machine learning engine.
70
-
***Threats by Actor.** Count of threats related to malicious domains, broken by Actors, for the last 15 minutes. [Actors](https://www.crowdstrike.com/blog/meet-the-adversaries/) are identified individuals, groups or nation-states associated to threats.
71
-
***Threats by Sources.** Count of threats related to malicious domains, broken by Sources, for the last 15 minutes.
72
-
***Threats Over Time.** Trends of domain threats over time for the last 60 minutes.
73
-
***Threats Over Time by Sources.** Trends of domain threats over time, broken by Sources for the last 60 minutes.
74
-
***Threats Table.** Listing of all domain threats, including Malicious Confidence, Actors and Sources.
75
-
76
-
### Email
77
-
78
-
The **Email** dashboard displays the frequency of Email threats by Actor, Log Source, Malicious Confidence, and view trends over time.
***Threat Count.** Count of threats related to malicious emails addresses, for the last 15 minutes.
83
-
***Threats by Malicious Confidence.** Qualifies email address threats into High, Medium, Low, Unverified, according to CrowdStrike's machine learning engine.
84
-
***Threat Breakdown by Sources.** Count of threats related to malicious email addresses, broken by Sources, for the last 15 minutes.
85
-
***Threats Over Time.** Trends of email address threats over time for the last 60 minutes.
86
-
***Threats Over Time by Sources.** Trends of email address threats over time, broken by Sources for the last 60 minutes.
87
-
***Threats by Actor.** Count of threats related to malicious email addresses, broken by Actors, for the last 15 minutes. [Actors](https://www.crowdstrike.com/blog/meet-the-adversaries/) are identified individuals, groups or nation-states associated to threats.
88
-
***Threats Table.** Listing of all domain threats, including Malicious Confidence, Actors and Sources.
89
-
90
-
91
-
### IP
92
-
93
-
The **IP** dashboard displays the frequency of IP threats by Actor, Log Source, Malicious Confidence, and view trends over time.
***Threat Count.** Count of threats related to malicious IPs, for the last 15 minutes.
98
-
***Threats by Geo Location.** Count of threats related to malicious IPs, broken by geo location, for the last 15 minutes.
99
-
***Threat Breakdown by Sources.** Count of threats related to malicious IPs, broken by Sources, for the last 15 minutes.
100
-
***Threats by Malicious Confidence.** Qualifies IP threats into High, Medium, Low, Unverified, according to CrowdStrike's machine learning engine.
101
-
***Threats by Actors.** Count of threats related to malicious IPs, broken by Actors, for the last 15 minutes. [Actors](https://www.crowdstrike.com/blog/meet-the-adversaries/) are identified individuals, groups or nation-states associated to threats.
102
-
***Threats Over Time.** Trends of IP threats over time for the last 60 minutes.
103
-
***Threats Table.** Listing of all IP threats, including Malicious Confidence, Actors and Sources.
104
-
***Threats Over Time by Sources.** Trends of IP threats over time, broken by Sources for the last 60 minutes.
105
-
106
-
107
-
### URL
108
-
109
-
The **URL** dashboard displays the frequency of URL threats by Actor, Log Source, Malicious Confidence, and view trends over time.
***Threat Count.** Count of threats related to malicious URLs, for the last 15 minutes.
114
-
***Threats by Sources.** Count of threats related to malicious URLs, broken by Sources, for the last 15 minutes.
115
-
***Threats by Actors.** Count of threats related to malicious URLs, broken by Actors, for the last 15 minutes. [Actors](https://www.crowdstrike.com/blog/meet-the-adversaries/) are identified individuals, groups or nation-states associated to threats.
116
-
***Threats by Malicious Confidence.** Qualifies URLP threats into High, Medium, Low, Unverified, according to CrowdStrike's machine learning engine.
117
-
***Threats Over Time.** Trends of URL threats over time for the last 60 minutes.
118
-
***Threats Over Time by Sources.** Trends of URL threats over time, broken by Sources for the last 60 minutes.
119
-
***Threat Table.** Listing of threats identified by URL, including information on Malicious Confidence, Actors, Source, and count.
120
-
121
-
122
-
### Hash 256
123
-
124
-
The **Hash 256** dashboard displays the frequency of Hash 256 threats by Actor, Log Source, Malicious Confidence, and view trends over time.
***Threat Count.** Count of total Hash 256 threats over the last 15 minutes.
129
-
***Threats by Malicious Confidence.** Qualifies Hash 256 threats for the last 60 minutes into High, Medium, Low, Unverified, according to CrowdStrike's machine learning engine and displayed as a pie chart.
130
-
***Threat Breakdown by Sources.** Pie chart of Hash 256 threats over the last 60 minutes broken down by source.
131
-
***Threats Over Time.** Line chart of the number of Hash 256 threats over the last 60 minutes.
132
-
***Threat Breakdown by Source.** Line chart of the number of Hash 256 threats over the last 60 minutes, broken down by source.
133
-
***Threats by Actor.** Identifies Actors, if any, that can be attributed to Hash 256 threats over the last 15 minutes. [Actors](https://www.crowdstrike.com/blog/meet-the-adversaries/) are identified individuals, groups or nation-states associated to threats.
134
-
***Threat Table.** Aggregation Table of Hash 256 threats over the last 15 minutes.
135
-
136
28
## Threat Intel optimization
137
29
138
-
The Threat Intel Quick Analysis App provides baseline queries. You can further optimize and enhance these queries for the log and events types being scanned for threats. To see the queries, open a [dashboard in the app](#viewing-threat-intel-quick-analysis-dashboards), click the three-dot kebab in the upper-right corner of the dashboard panel, and select **Open in Log Search**.
30
+
The Threat Intel Quick Analysis app provides baseline queries. You can further optimize and enhance these queries for the log and events types being scanned for threats. To see the queries, open a [dashboard in the app](#viewing-threat-intel-quick-analysis-dashboards), click the three-dot kebab in the upper-right corner of the dashboard panel, and select **Open in Log Search**.
139
31
140
32
Use the following guidelines to customize your Threat Intel queries:
141
33
* Filter out unwanted logs before you use lookup operator
@@ -243,6 +135,37 @@ Use scheduled views with the threat lookup operator to find threats. Scheduled v
243
135
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name, city, country_name, raw
244
136
```
245
137
<!-- Per DOCS-643, replace the preceding code with the following after `sumo://threat/cs` is replaced by `threatlookup`:
138
+
2. Now, you can run your Threat Intel query on top of this view:
139
+
```sql
140
+
_view=cylance_threat
141
+
| count by src_ip
142
+
```
143
+
144
+
## Threat Intel FAQ
145
+
146
+
#### What is the CrowdStrike Integration for Sumo Logic?
147
+
148
+
Sumo Logic has expanded its security offerings by allowing customers to analyze their logs for potential threats and indicators of compromise. In partnership with CrowdStrike, Sumo Logic maintains an updated Threat Intelligence database that can be correlated with log data through queries. The Sumo Logic / CrowdStrike integration has two parts:
149
+
150
+
* Sumo Logic maintains an up-to-date copy of CrowdStrike’s threat database.
151
+
* Sumo customers can now use the CrowdStrike database in threat analysis queries over their logs (through a new lookup operator).
152
+
153
+
The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period. The Threat Intel lookup database is not available for Sumo Logic Free accounts.
154
+
155
+
156
+
#### What does the Threat Intel Quick Analysis App do?
157
+
158
+
This app scans all Sumo logs and parses (using regex) IP/Email/URL/Domain/File Name fields for comparison against the threat feed from CrowdStrike. Think of it as an Inner Join between parsed fields and the threat table.
159
+
160
+
This application can be slow to load depending on the volume of data you scan based on time, source category, etc. We **highly recommend** that you apply additional filter conditions as you screen your logs or run these types of searches on a schedule.
161
+
162
+
163
+
#### How often do you refresh the threat feed from CrowdStrike?
164
+
165
+
The database is updated once per day. We have implemented a multi-layer cache for performance enhancements rather than returning to the master database on each query.
166
+
167
+
=======
168
+
<!-- Replace the preceding code with the following after `sumo://threat/cs` is replaced by `threatlookup`:
246
169
```
247
170
_sourceCategory=cylance
248
171
| threatlookup singleIndicator src_ip
@@ -336,8 +259,7 @@ You can further investigate bad IP triggers by updating your query to check the
336
259
337
260
-->
338
261
339
-
## Viewing Threat Intel Quick Analysis dashboards
340
-
262
+
## JSON configuration object
341
263
342
264
#### `malicious_confidence`
343
265
@@ -483,6 +405,8 @@ Once an indicator has been marked with a malicious confidence level, it continue
483
405
</tbody>
484
406
</table>
485
407
408
+
## Viewing Threat Intel Quick Analysis dashboards
409
+
486
410
All dashboards include filters that you can use in Interactive Mode for further analysis of your Threat Intel Quick Analysis data. Because the Threat Intel Quick Analysis has the most bearing on recent threats, most panels are set to the 15 minute time range. You can adjust time ranges as needed.
487
411
488
412
Live mode and real-time queries are not supported for dashboards at this time.
@@ -573,3 +497,14 @@ See the frequency of SHA-256 threats by Actor, Log Source, Malicious Confidence,
573
497
* **Threats by Actor.** Identifies Actors, if any, that can be attributed to SHA-256 threats over the last 15 minutes. Actors are identified individuals, groups or nation-states associated to threats.
574
498
* **Threat Table.** Aggregation Table of SHA-256 threats over the last 15 minutes.
575
499
500
+
## Upgrading the Threat Intel Quick Analysis app (Optional)
501
+
502
+
import AppUpdate from '../../reuse/apps/app-update.md';
503
+
504
+
<AppUpdate/>
505
+
506
+
## Uninstalling the Threat Intel Quick Analysis app (optional)
507
+
508
+
import AppUninstall from '../../reuse/apps/app-uninstall.md';
0 commit comments