DOCS-523 - Strict signal custom insights (#5108)

* First draft

* Add release note

* Fix typo

* Update docs/cse/records-signals-entities-insights/configure-custom-insight.md

Co-authored-by: Kim (Sumo Logic) <[email protected]>

* Update docs/cse/records-signals-entities-insights/configure-custom-insight.md

Co-authored-by: Kim (Sumo Logic) <[email protected]>

* Update docs/cse/records-signals-entities-insights/configure-custom-insight.md

Co-authored-by: Kim (Sumo Logic) <[email protected]>

* Update docs/cse/records-signals-entities-insights/configure-custom-insight.md

Co-authored-by: Kim (Sumo Logic) <[email protected]>

* Update docs/cse/records-signals-entities-insights/configure-custom-insight.md

---------

Co-authored-by: Kim (Sumo Logic) <[email protected]>

Author: jpipkin1

blog-cse/2025-03-10-application.md

@@ -0,0 +1,20 @@
+---
+title: March 10, 2025 - Application Update
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - custom insights
+  - insights
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-cse/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+### Strict signal configuration
+
+We're happy to announce that now when you create custom insights, you can select an option to generate insights only on those signals defined in your custom insight. Any additional signals related to the applicable entity are excluded. This allows you to generate insights for an immediate and targeted response. 
+
+[Learn more](/docs/cse/records-signals-entities-insights/configure-custom-insight/#for-only-signals-defined-in-the-custom-insight).
+
+<img src={useBaseUrl('img/cse/strict-signal-configuration-checkbox.png')} alt="Strict Signal Configuration checkbox" style={{border: '1px solid gray'}} width="400"/>

docs/cse/records-signals-entities-insights/configure-custom-insight.md

@@ -16,39 +16,58 @@ This topic has instructions for defining a custom insight, which is a configura
 
 ## Ways to define a custom insight
 
-There are two ways you can define a custom insight. You can specify that the insight should be generated each time:
+When you create a custom insight, the following field appears on the creation dialog: 
+
+<img src={useBaseUrl('img/cse/ways-to-define-custom-insight.png')} alt="Ways to define a custom insight" style={{border: '1px solid gray'}} width="300"/>
+
+This lets you choose how you want to define a custom insight. You can specify that the insight should be generated each time:
 
-* One or more selected rules fire a signal.
 * Signals whose name matches a specified wildcard expression are fired. 
+* One or more selected rules fire a signal.
+
+Which method should you use? The difference is whether you’re going to create an insight based on the name of the signal that was fired, or based on the name of the rule that fired the signal. 
+
+Typically, signals that a rule generates have the same name as the rule. That is not the case with Cloud SIEM’s normalized rules. That’s because normalized rules, for example [normalized threat rules](/docs/cse/rules/normalized-threat-rules/), are written to work with multiple data sources. The names of the signals that a normalized rule fires vary by data source. So, if you want your custom insight configuration to generate insights for signals fired by normalized rules, you should base it on signal names, rather than rule names.
+
+## When are custom insights generated?
+
+### For each involved entity
+
+By default, when the conditions of a custom insight configuration are met during the currently configured [detection window](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/), an insight is generated for *each entity* involved. In other words, if each of the signals in a custom insight configuration fire on different entities, a separate insight is created for each entity. The generated insights will include both the signals that triggered them and any related signals.
+
+### For only signals defined in the custom insight
+
+The default way of generating an insight for each entity may result in custom insights containing more signals than you want. Rather than the summation of all signals attached to entities, perhaps you'd like to have those signals trigger insights directly for an immediate and targeted response.
 
-Which method should you use? The difference is whether you’re going to create an insight based on the name of the rule that fired the signal, or based on the name of the signal that was fired. Typically, signals that a rule generates have the same name as the rule. That is not the case with Cloud SIEM’s normalized rules. That’s because normalized rules, for example [normalized threat rules](/docs/cse/rules/normalized-threat-rules/), are written to work with multiple data sources. The names of the signals that a normalized rule fires vary by data source. So, if you want your custom insight configuration to generate insights for signals fired by normalized rules, you should base it on signal names, rather than rule names.
+In that case, under **Strict Signal Configuration**, select **Only include the signals defined in this custom insight**. This generates insights only on those signals defined in your custom insight. Any additional signals related to the applicable entity are excluded. 
 
-When the conditions of a custom insight configuration are met during the currently configured [detection window](/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold/), an insight will be generated for each entity involved. In other words, if each of the signals in a custom insight configuration fired on a different entity, an insight will be created on each of those entities. The generated insights will include not only the signals that it fired on, but also any related signals. 
+<img src={useBaseUrl('img/cse/strict-signal-configuration-checkbox.png')} alt="Strict Signal Configuration checkbox" style={{border: '1px solid gray'}} width="400"/>
 
 ## Create a custom insight
 
 To create a custom insight:
 
 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu, select **Content > Custom Insights**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Custom Insights**. You can also click the **Go To...** menu at the top of the screen and select **Custom Insights**.  
-2. Click **Add Custom Insight** on the **Custom Insights** page.
-3. The **Configure the Custom Insight** popup appears. <br/><img src={useBaseUrl('img/cse/custom-insight.png')} alt="Configure an insight" style={{border: '1px solid gray'}} width="600"/>
-4. In the **Name** field, enter a name for the custom insight.
-5. If you want the custom insight to be generated based on one or more rules firing signals, jump to step 6, below. Otherwise: 
-   1. Leave the **When Signals are created from the following...** clause set to **Signal names**.
+1. Click **Add Custom Insight** on the **Custom Insights** page.
+1. The **Configure the Custom Insight** popup appears. <br/><img src={useBaseUrl('img/cse/custom-insight.png')} alt="Configure an insight" style={{border: '1px solid gray'}} width="600"/>
+1. In the **Name** field, enter a name for the custom insight.
+1. If you want the custom insight to be generated based on one or more rules firing signals, jump to step 6, below. Otherwise: 
+   1. Leave the **When Signals are created with the following...** clause set to **Signal names**.
    2. Enter an expression that matches the name(s) of the signals of interest. For example: `Critical Severity Intrusion Signature *`
    3. Click **Add**.
    4. If you want to, you can enter one or more additional signal expressions.
    5. If you’ve configured more than one signal expression, use the **in ... order** clause to specify whether the signals must occur in **exact** order, or whether the signals can occur in **any** order. 
-6. If you want the custom insight to be generated based on one or more rules firing signals:
-   1. Change the **When Signals are created from the following...** clause to **rule**. 
+1. If you want the custom insight to be generated based on one or more rules firing signals:
+   1. Change the **When Signals are created with the following...** clause to **rule**. 
    2. In the **Type to add a Rule** area, enter a string that the ID of the desired rule contains.
    3. In the list of rules that appears, scroll to the desired rule and click it.
    4. If you want to, you can search for and select one or more additional rules.
    5. If you’ve configured more than one rule, use the **in ... order** clause to specify whether the rules must fire signals in exact order, or in any order. 
-7. In the **Then Create an Insight** section on the right side of the popup, enter a name for the insight.
-8. Enter a description of the insight, as desired.
-9. For severity, you can choose between a constant severity, or a dynamic severity that is based on the severity of the signals that trigger the insight. If you want to configure dynamic severity, skip to the next step. To configure constant severity, select one of: Low, Medium, High, or Critical. 
-10. To configure dynamic severity for the custom insight:
+1. Under **Strict Signal Configuration**, select **Only include the signals defined in this custom insight** to generate insights only on those signals defined in your custom insight. Any additional signals related to the applicable entity are excluded.
+1. In the **Then Create an Insight** section on the right side of the popup, enter a name for the insight.
+1. Enter a description of the insight, as desired.
+1. For severity, you can choose between a constant severity, or a dynamic severity that is based on the severity of the signals that trigger the insight. If you want to configure dynamic severity, skip to the next step. To configure constant severity, select one of: Low, Medium, High, or Critical. 
+1. To configure dynamic severity for the custom insight:
     1. Choose **dynamic** severity.
           :::note
           You can define dynamic severity for record fields on [Match rules](/docs/cse/rules/write-match-rule#configure-then-create-a-signal-settings) and [Aggregation rules](/docs/cse/rules/write-aggregation-rule/#configure-then-create-a-signal-settings). 
@@ -60,5 +79,5 @@ To create a custom insight:
        * If the highest signal severity was at least 5, severity is Medium.
        * If the highest signal severity was at least 7, severity is Critical.
       <br/><img src={useBaseUrl('img/cse/example-dynamic.png')} alt="Example dynamic severity" style={{border: '1px solid gray'}} width="300"/>
-11. If desired, select [Tags](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules/) that you want assigned to the custom insight. 
-12. Click **Submit** to save your custom insight configuration.
+1. If desired, select [Tags](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules/) that you want assigned to the custom insight. 
+1. Click **Submit** to save your custom insight configuration.