Skip to content

Commit e81c034

Browse files
authored
Revert "Update article (#4470)" (#4473)
This reverts commit 7734f47.
1 parent 7734f47 commit e81c034

File tree

2 files changed

+13
-12
lines changed

2 files changed

+13
-12
lines changed

docs/cse/records-signals-entities-insights/view-records-signal.md

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,19 @@ Cloud SIEM uses rules to evaluate incoming records, and when the conditions of
1010

1111
## View record details
1212

13-
1. <!--Kanso [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Kanso--> To view signals, click **Signals** at the top of the screen. <!--Kanso <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To view Signals, in the main Sumo Logic menu select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**. Kanso-->
14-
1. Select a signal. The signal's details display. <br/>When you view the details page for a signal that was triggered by a threshold, aggregation, or chain rule, you’ll see a section that displays records that matched the rules conditions. These records will continue to be associated with the signal as long as the signal is available.
15-
1. Click the plus sign (+) for a record to view its details.
16-
1. Use the following to work with the records:
17-
* **Timestamp**. Sort records by their timestamp.
18-
* **Open in Log Search**. Select one of the the following options to run a query for the signal's records in log search:
19-
* **Distinct Aggregated Records**. Exact records evaluated by the rule.
20-
* **All Related Records**. All records related to the signal.
21-
* **Export**. Export the records to a comma-separated value (CSV) or JSON file.<br/><img src={useBaseUrl('img/cse/attached-records.png')} alt="View attached records" style={{border: '1px solid gray'}} width="800"/>
22-
:::note
23-
Only a single record is attached to the signal itself. Any other involved records are retrieved via log search. If the records are past their retention period, they no longer appear in the UI. In the API and `sec_signal` index, only the single attached record is included, along with a list of any other entities that were seen on the involved records (in `involvedEntities`). You must select **Open in Log Search** to find the other involved records.
24-
:::
13+
<!--Kanso [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Kanso--> To view Signals, click **Signals** at the top of the screen.
14+
<!--Kanso
15+
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To view Signals, in the main Sumo Logic menu select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**.
16+
Kanso-->
17+
When you view the details page for a signal that was triggered by a threshold, aggregation, or chain rule, you’ll see a section that displays records that matched the rules conditions. These records will continue to be associated with the signal as long as the signal is available.
18+
19+
Click the plus sign (+) for a record to view its details. Click the **Timestamp** button to sort records by their timestamp.
20+
21+
<img src={useBaseUrl('img/cse/attached-records.png')} alt="View attached records" style={{border: '1px solid gray'}} width="800"/>
22+
23+
:::note
24+
Only a single record is attached to the signal itself. Any other involved records are retrieved via log search. If the records are past their retention period, they no longer appear in the UI. In the API and `sec_signal` index, only the single attached record is included, along with a list of any other entities that were seen on the involved records (in `involvedEntities`). You must [perform a log search](/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo/#partition-for-cloud-siem-signals) to find the other involved records.
25+
:::
2526

2627
## Select favorite fields
2728

-46.6 KB
Loading

0 commit comments

Comments
 (0)