From fc4eaef3b6663632cd65d6a68d2a5918b02a4389 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 22 Apr 2025 13:25:55 -0500 Subject: [PATCH 1/2] Rough draft --- .../create-custom-threat-intel-source.md | 2 +- .../configuring-threatq-source-in-cse.md | 2 +- .../integrate-cse-with-taxii-feed.md | 2 +- docs/cse/rules/about-cse-rules.md | 2 +- docs/cse/rules/cse-rules-syntax.md | 10 ++- .../about-threat-intelligence.md | 90 ++++++++++--------- .../threat-intelligence/find-threats.md | 2 +- docs/security/threat-intelligence/index.md | 8 +- .../threat-indicators-in-cloud-siem.md | 4 +- .../threat-intelligence-indicators.md | 12 +-- .../threat-intelligence/upload-formats.md | 4 +- sidebars.ts | 4 +- 12 files changed, 77 insertions(+), 65 deletions(-) diff --git a/docs/cse/administration/create-custom-threat-intel-source.md b/docs/cse/administration/create-custom-threat-intel-source.md index 0c439e7e08..101f0bb7fd 100644 --- a/docs/cse/administration/create-custom-threat-intel-source.md +++ b/docs/cse/administration/create-custom-threat-intel-source.md @@ -31,7 +31,7 @@ You can search using the same functionality available for other Cloud SIEM searc When Cloud SIEM encounters an indicator from a threat source in an incoming record, it adds relevant information to the record. Because threat intelligence information is persisted within records, you can reference it downstream in both rules and search. The built-in rules that come with Cloud SIEM automatically create a signal for records that have been enriched in this way. -Rule authors can also write rules that look for threat intelligence information in records. To leverage the information in a rule, you can extend your custom rule expression, or add a rule tuning expression to a built-in rule. For a more detailed explanation of how to use threat intelligence information in rules, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). +Rule authors can also write rules that look for threat intelligence information in records. To leverage the information in a rule, you can extend your custom rule expression, or add a rule tuning expression to a built-in rule. For a more detailed explanation of how to use threat intelligence information in rules, see [Find Threats with Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). ### Target fields for threat indicators diff --git a/docs/cse/integrations/configuring-threatq-source-in-cse.md b/docs/cse/integrations/configuring-threatq-source-in-cse.md index 6202d4c8dc..fcb67c0e6e 100644 --- a/docs/cse/integrations/configuring-threatq-source-in-cse.md +++ b/docs/cse/integrations/configuring-threatq-source-in-cse.md @@ -15,7 +15,7 @@ To do so, [ingest threat intelligence indicators](/docs/security/threat-intellig ## Looking for ThreatQ indicators using Cloud SIEM rules -Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). +Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Find Threats with Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). --> This topic has information about configuring a ThreatQ source in Cloud SIEM. diff --git a/docs/cse/integrations/integrate-cse-with-taxii-feed.md b/docs/cse/integrations/integrate-cse-with-taxii-feed.md index 854aca1dde..dd19039a51 100644 --- a/docs/cse/integrations/integrate-cse-with-taxii-feed.md +++ b/docs/cse/integrations/integrate-cse-with-taxii-feed.md @@ -37,7 +37,7 @@ Threat intelligence indicators allow you to enrich incoming records with threat Because the threat intel information is persisted within records, you can reference it downstream in both rules and search. The built-in rules that come with Cloud SIEM will also automatically create a signal for any record with a match from your threat feed. -For more information, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). +For more information, see [Find Threats with Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). --> diff --git a/docs/cse/rules/about-cse-rules.md b/docs/cse/rules/about-cse-rules.md index cfbfe5519e..49920aeb6d 100644 --- a/docs/cse/rules/about-cse-rules.md +++ b/docs/cse/rules/about-cse-rules.md @@ -183,7 +183,7 @@ This example below checks a record for a field named `listMatches` that contains Threat Intelligence sources contain values that, when encountered in a record, are clear indicators of compromise. To create a new source of Threat Intelligence, see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators). -Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). +Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Find Threats with Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). ## Additional resources diff --git a/docs/cse/rules/cse-rules-syntax.md b/docs/cse/rules/cse-rules-syntax.md index 2445019607..b07141a35c 100644 --- a/docs/cse/rules/cse-rules-syntax.md +++ b/docs/cse/rules/cse-rules-syntax.md @@ -626,10 +626,14 @@ The following expression returns "10.10.1.0": ### hasThreatMatch -The `hasThreatMatch` Cloud SIEM rules function matches incoming records in Cloud SIEM to [threat intelligence indicators](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#hasthreatmatch-cloud-siem-rules-language-function). It can also match values in [custom threat intelligence sources in Cloud SIEM](/docs/cse/administration/create-custom-threat-intel-source/). +Use the `hasThreatMatch` Cloud SIEM rules function to match incoming records in Cloud SIEM to [threat intelligence sources](/docs/security/threat-intelligence/about-threat-intelligence/). The function matches all sources in the **Threat Intelligence** tab, unless you specify a specific source. `hasThreatMatch` can also match values in [custom threat intelligence sources in Cloud SIEM](/docs/cse/administration/create-custom-threat-intel-source/). When an entity is processed by a rule using the `hasThreatMatch` function and is a match, the entity is associated with a known indicator that has a threat type attribute. The entity can be associated with either `threatType` (in normalized JSON format and CSV format), or `indicator_types` (in STIX format). +:::tip +To see standard rules that use the `hasThreatMatch` function, refer to the [Rules page in our Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md) and search for rules with "Threat Intel" in the name. +::: + **Syntax** `hasThreatMatch([], , )` @@ -663,6 +667,10 @@ Parameters: * `hasThreatMatch([srcDevice_ip], expired_indicators)` * `hasThreatMatch([srcDevice_ip], confidence > 50, all_indicators)` +:::note +Malicious confidence scores from different sources are normalized and mapped to a 0-100 numerical value in the `confidence` attribute. +::: + #### Best practice As a best practice, always include filtering to narrow your match to just the types desired (that is, `type=`). This will ensure that your match expressions are not overly broad. diff --git a/docs/security/threat-intelligence/about-threat-intelligence.md b/docs/security/threat-intelligence/about-threat-intelligence.md index 059af1c4ce..48d76e7c65 100644 --- a/docs/security/threat-intelligence/about-threat-intelligence.md +++ b/docs/security/threat-intelligence/about-threat-intelligence.md @@ -13,49 +13,46 @@ Threat intelligence, often abbreviated as *threat intel*, is information that he Threat intelligence indicators can help security analysts leverage a large body of information to surface potential threats. For example, say that a threat intelligence database has an indicator that correlates a certain IP address with known malicious activity. Because of this correlation, analysts can assume log messages with that IP address are more likely to be part of a real cyber attack. -In Sumo Logic, threat intelligence indicators are supplied by sources listed on the **Threat Intelligence** tab. -* [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). To access the **Threat Intelligence** tab, in the main Sumo Logic menu, select **Manage Data > Logs > Threat Intelligence**. -* [**New UI**](/docs/get-started/sumo-logic-ui/). To access the **Threat Intelligence** tab, in the top menu select **Configuration**, and then under **Logs** select **Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**.
Threat Intelligence tab - -The sources on the **Threat Intelligence** tab include: -* **Sumo Logic sources**. Out-of-the-box default sources of threat indicators supplied by third party intel vendors and maintained by Sumo Logic. You cannot edit these sources. See [Sumo Logic threat intelligence sources](#sumo-logic-threat-intelligence-sources) below. -* **Other sources**. The other sources on the tab are imported by Cloud SIEM administrators so that Cloud SIEM analysts can use them to find threats. See [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators) to learn how to add other sources. - -Cloud SIEM analysts can use any of these sources to find threats (see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/)). In addition, all Sumo Logic users can run queries against the indicators in the Sumo Logic threat intelligence source to uncover threats (see [Find Threats with Log Queries](/docs/security/threat-intelligence/find-threats/)). - - +:::tip +Cybersecurity professionals often use multiple threat intelligence feeds to supply them with indicators. Having a wide net allows them to catch more threats. See our blog [Threat intelligence feeds: essential arsenal in cybersecurity](https://www.sumologic.com/blog/threat-intelligence-feeds-cybersecurity/). +::: - -## Prerequisites +## Threat intelligence sources -### Role capabilities +In Sumo Logic, threat intelligence indicators are supplied by sources listed on the **Threat Intelligence** tab. +* [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). To access the **Threat Intelligence** tab, in the main Sumo Logic menu, select **Manage Data > Logs > Threat Intelligence**. +* [**New UI**](/docs/get-started/sumo-logic-ui/). To access the **Threat Intelligence** tab, in the top menu select **Configuration**, and then under **Logs** select **Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**.
Threat Intelligence tab -To view and manage threat intelligence indicators on the [Threat Intelligence tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab), a Cloud SIEM administrator must have the correct [role capabilities](/docs/manage/users-roles/roles/role-capabilities/#threat-intel). +Cloud SIEM analysts can use all sources shown in the **Threat Intelligence** tab to find threats (see [Find Threats with Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/)). In addition, all Sumo Logic users can run queries against the indicators in the Sumo Logic threat intelligence sources to uncover threats (see [Find Threats with Log Queries](/docs/security/threat-intelligence/find-threats/)). -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). In the main Sumo Logic menu, select **Administration > Users and Roles**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu select **Administration**, and then under **Users and Roles** select **Roles**. You can also click the **Go To...** menu at the top of the screen and select **Roles**. -1. Click the **Roles** tab. -1. Click **Add Role** to create a new role. Alternatively, you can select an existing role in the **Roles** tab and click **Edit**. -Add the following capabilities: - * **Threat Intel** - * **View Threat Intel Data Store** - * **Manage Threat Intel Data Store** + -You do not need to be assigned these role capabilities to [find threats with log queries](/docs/security/threat-intelligence/find-threats/). +The sources on the **Threat Intelligence** tab include: +* **Sumo Logic sources**. Out-of-the-box default sources of threat indicators supplied by third party intel vendors and maintained by Sumo Logic. You cannot edit these sources. See [Sumo Logic threat intelligence sources](#sumo-logic-threat-intelligence-sources) below. +* **Other sources**. The other sources on the tab are imported by Cloud SIEM administrators so that Cloud SIEM analysts can use them to find threats. See [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators) to learn how to add other sources. + +### Sumo Logic threat intelligence sources + +Sumo Logic provides the following out-of-the-box default sources of threat indicators supplied by third party intel vendors and maintained by Sumo Logic. You cannot edit these sources: +* **SumoLogic_ThreatIntel**. This source incorporates threat indicators supplied by [Intel 471](https://intel471.com/). +* **_sumo_global_feed_cs**. This is a source of threat indicators supplied by [CrowdStrike](https://www.crowdstrike.com/en-us/). ### Ingest threat intelligence indicators @@ -70,7 +67,7 @@ A Cloud SIEM administrator must first ingest the indicators before they can be u * **The API**. See the following APIs in the [Threat Intel Ingest Management](https://api.sumologic.com/docs/#tag/threatIntelIngest) API resource: * [uploadNormalizedIndicators API](https://api.sumologic.com/docs/#operation/uploadNormalizedIndicators) * [uploadStixIndicators API](https://api.sumologic.com/docs/#operation/uploadStixIndicators) -* **The Threat Intelligence tab**. Use this tab to upload your own indicators. See [Add indicators in the Threat Intelligence tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-in-the-threat-intelligence-tab). See [Upload formats](/docs/security/threat-intelligence/upload-formats/) for the format to use when uploading indicators using this tab or APIs. +* **The Threat Intelligence tab**. Use this tab to upload your own indicators. See [Add indicators in the Threat Intelligence tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-button). See [Upload formats](/docs/security/threat-intelligence/upload-formats/) for the format to use when uploading indicators using this tab or APIs. After threat indicator sources are ingested, they appear on the **Threat Intelligence** tab and are ready to be used in [Cloud SIEM rules](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#hasthreatmatch-cloud-siem-rules-language-function). @@ -82,12 +79,28 @@ After threat indicator sources are ingested, they appear on the **Threat Intelli * When you add indicators, the event is recorded in the Audit Event Index. See [Audit logging for threat intelligence](#audit-logging-for-threat-intelligence). ::: +## Prerequisites + +### Role capabilities + +To view and manage threat intelligence indicators on the [Threat Intelligence tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab), a Cloud SIEM administrator must have the correct [role capabilities](/docs/manage/users-roles/roles/role-capabilities/#threat-intel). + +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). In the main Sumo Logic menu, select **Administration > Users and Roles**.
[**New UI**](/docs/get-started/sumo-logic-ui/). In the top menu select **Administration**, and then under **Users and Roles** select **Roles**. You can also click the **Go To...** menu at the top of the screen and select **Roles**. +1. Click the **Roles** tab. +1. Click **Add Role** to create a new role. Alternatively, you can select an existing role in the **Roles** tab and click **Edit**. +Add the following capabilities: + * **Threat Intel** + * **View Threat Intel Data Store** + * **Manage Threat Intel Data Store** + +You do not need to be assigned these role capabilities to [find threats with log queries](/docs/security/threat-intelligence/find-threats/). + ## Typical workflow Here is the typical workflow to set up and use threat intelligence indicators: -1. A system administrator [ingests threat intelligence indicators](#ingest-threat-intelligence-indicators) and adds them to the threat intelligence data store. For example, install a collector such as the [STIX/TAXII 2 Client Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/stix-taxii-2-client-source), and set up the collector to obtain indicators from Federal, vendor, or open services. Ingested indicators appear on the [**Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#threat-intelligence-tab). You can manually add more indicators as needed, such as your own private indicators, using the **Threat Intelligence** tab or the [Threat Intel Ingest Management](https://api.sumologic.com/docs/#tag/threatIntelIngest) APIs. -1. Analysts use the threat indicators data to uncover threats using [Cloud SIEM rules](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#hasthreatmatch-cloud-siem-rules-language-function). +1. A system administrator [ingests threat intelligence indicators](#ingest-threat-intelligence-indicators) and adds them to the threat intelligence data store. For example, install a collector such as the [STIX/TAXII 2 Client Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/stix-taxii-2-client-source), and set up the collector to obtain indicators from Federal, vendor, or open services. Ingested indicators appear on the **Threat Intelligence** tab. You can manually add more indicators as needed, such as your own private indicators, using the **Threat Intelligence** tab or the [Threat Intel Ingest Management](https://api.sumologic.com/docs/#tag/threatIntelIngest) APIs. +1. Analysts use the threat indicators data to uncover threats using [Cloud SIEM rules](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). 1. A system administrator occasionally checks to see why a connector isn’t ingesting data, or to see how much storage all the indicators are using. They may examine their indicators, and then if needed, [delete indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/#delete-threat-intelligence-indicators). ## Audit logging for threat intelligence @@ -100,8 +113,3 @@ Use a search like the following: _index=sumologic_audit_events _sourceCategory=threatIntelligence ``` -## Sumo Logic threat intelligence sources - -Sumo Logic provides the following out-of-the-box default sources of threat indicators supplied by third party intel vendors and maintained by Sumo Logic. You cannot edit these sources: -* **SumoLogic_ThreatIntel**. This source incorporates threat indicators supplied by [Intel 471](https://intel471.com/). -* **_sumo_global_feed_cs**. This is a source of threat indicators supplied by [CrowdStrike](https://www.crowdstrike.com/en-us/). diff --git a/docs/security/threat-intelligence/find-threats.md b/docs/security/threat-intelligence/find-threats.md index ef31dafe1a..61127829b9 100644 --- a/docs/security/threat-intelligence/find-threats.md +++ b/docs/security/threat-intelligence/find-threats.md @@ -7,7 +7,7 @@ description: Perform searches to find matches to data in threat intelligence ind import useBaseUrl from '@docusaurus/useBaseUrl'; -## Use a Sumo Logic source in a log search +## Use the lookup search operator The [Sumo Logic threat intelligence sources](/docs/security/threat-intelligence/about-threat-intelligence/#sumo-logic-threat-intelligence-sources) in the threat intelligence datastore contain threat indicators supplied by third party intel vendors and maintained by Sumo Logic:
Global feed in the Threat Intelligence tab diff --git a/docs/security/threat-intelligence/index.md b/docs/security/threat-intelligence/index.md index a916d2db0f..230f28ee22 100644 --- a/docs/security/threat-intelligence/index.md +++ b/docs/security/threat-intelligence/index.md @@ -20,8 +20,8 @@ See the following articles to learn about Sumo Logic's threat intelligence capab
- icon

Manage Threat Intelligence Indicators

 -

Learn how to add and manage indicators from threat intelligence sources.

+ icon

Find Threats with Cloud SIEM

 +

Learn how to use threat indicators in Cloud SIEM.

@@ -32,8 +32,8 @@ See the following articles to learn about Sumo Logic's threat intelligence capab
- icon

Threat Indicators in Cloud SIEM

 -

Learn how to use threat indicators in Cloud SIEM.

+ icon

Manage Threat Intelligence Indicators

 +

Learn how to add and manage indicators from threat intelligence sources.

diff --git a/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md b/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md index 0c663ca69e..922c0b48ae 100644 --- a/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md +++ b/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md @@ -1,7 +1,7 @@ --- slug: /security/threat-intelligence/threat-indicators-in-cloud-siem -title: Threat Intelligence Indicators in Cloud SIEM -sidebar_label: Indicators in Cloud SIEM +title: Find Threats with Cloud SIEM +sidebar_label: Find Threats with Cloud SIEM description: Learn how to use threat intelligence indicators in Cloud SIEM. --- diff --git a/docs/security/threat-intelligence/threat-intelligence-indicators.md b/docs/security/threat-intelligence/threat-intelligence-indicators.md index 0eedeaa941..c730d11928 100644 --- a/docs/security/threat-intelligence/threat-intelligence-indicators.md +++ b/docs/security/threat-intelligence/threat-intelligence-indicators.md @@ -8,11 +8,7 @@ description: Learn how to add and manage indicators from threat intelligence sou import useBaseUrl from '@docusaurus/useBaseUrl'; import CloudSIEMThreatIntelNote from '../../reuse/cloud-siem-threat-intelligence-note.md'; -The **Threat Intelligence** tab shows the indicators that have been added to your threat intelligence datastore. Use this tab to add and manage your threat intelligence indicators. You can add indicators from a number of sources. Threat intelligence indicators imported to Sumo Logic not only integrate with your existing core Sumo Logic deployment, but also Cloud SIEM and Cloud SOAR. - -:::tip -You can also add threat intelligence indicators using a collector or the API. See [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators). -::: +The **Threat Intelligence** tab shows the indicators that have been added to your threat intelligence datastore. Use this tab to add and manage your threat intelligence indicators. You can add indicators from a number of sources (see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators)). Threat intelligence indicators imported to Sumo Logic not only integrate with your existing core Sumo Logic deployment, but also Cloud SIEM and Cloud SOAR. ## Threat Intelligence tab @@ -22,7 +18,7 @@ You can also add threat intelligence indicators using a collector or the API. Se Threat Intelligence tab -1. **+ Add Indicators**. Click to upload files that [add threat intelligence indicators](#add-indicators-in-the-threat-intelligence-tab). +1. [**+ Add Indicators**](#add-indicators-button). Click to upload files that add threat intelligence indicators. 1. **Actions**. Select to perform additional actions: * **Edit Retention Period**. Enter the length of time in days to retain expired threat intelligence indicator files. The maximum number of days is 180. See [Change the retention period for expired indicators](#change-the-retention-period-for-expired-indicators). 1. **Status**. The current status of the indicator source (**Enabled** or **Disabled**). @@ -35,9 +31,9 @@ You can also add threat intelligence indicators using a collector or the API. Se * The default storage limit is 10 million total indicators (not including any indicators provided by Sumo Logic such as in the `SumoLogic_ThreatIntel` and `_sumo_global_feed_cs` sources). ::: -## Add indicators in the Threat Intelligence tab +## Add Indicators button -You can add threat intelligence indicators using a collector, API, or the **Threat Intelligence** tab. This section describes how to add indicators in the **Threat Intelligence** tab. For information on the other methods, see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators). +You can add threat intelligence indicators with the **Add Indicators** button in the **Threat Intelligence** tab. For information on the other methods, see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators). diff --git a/docs/security/threat-intelligence/upload-formats.md b/docs/security/threat-intelligence/upload-formats.md index 63ea9e4a7e..ac80eec04e 100644 --- a/docs/security/threat-intelligence/upload-formats.md +++ b/docs/security/threat-intelligence/upload-formats.md @@ -7,7 +7,7 @@ description: Learn how to format upload files containing threat intelligence ind import useBaseUrl from '@docusaurus/useBaseUrl'; -Use the following formats for threat intelligence indicator files when you [add indicators in the **Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-in-the-threat-intelligence-tab) or when you use the upload APIs with the [Threat Intel Ingest Management API](/docs/api/threat-intel-ingest/) resource: +Use the following formats for threat intelligence indicator files when you [add indicators in the **Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-button) or when you use the upload APIs with the [Threat Intel Ingest Management API](/docs/api/threat-intel-ingest/) resource: * [Normalized JSON format](#normalized-json-format) * [CSV format](#csv-format) @@ -165,7 +165,7 @@ Columns for the following attributes are required in the upload file: ## STIX 2.x JSON format :::note -Use this format only with the [STIX 2.x JSON upload API](https://api.sumologic.com/docs/#operation/uploadStixIndicators) in the [Threat Intel Ingest Management API](/docs/api/threat-intel-ingest/) resource. You cannot [add indicators in the **Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-in-the-threat-intelligence-tab) using this format. +Use this format only with the [STIX 2.x JSON upload API](https://api.sumologic.com/docs/#operation/uploadStixIndicators) in the [Threat Intel Ingest Management API](/docs/api/threat-intel-ingest/) resource. You cannot [add indicators in the **Threat Intelligence** tab](/docs/security/threat-intelligence/threat-intelligence-indicators/#add-indicators-button) using this format. ::: STIX 2.x JSON format is a method to present JSON data according to the STIX 2.x specification. diff --git a/sidebars.ts b/sidebars.ts index 8ef4ab6857..1725ca192f 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -3030,9 +3030,9 @@ integrations: [ link: {type: 'doc', id: 'security/threat-intelligence/index'}, items: [ 'security/threat-intelligence/about-threat-intelligence', - 'security/threat-intelligence/threat-intelligence-indicators', - 'security/threat-intelligence/find-threats', 'security/threat-intelligence/threat-indicators-in-cloud-siem', + 'security/threat-intelligence/find-threats', + 'security/threat-intelligence/threat-intelligence-indicators', 'security/threat-intelligence/upload-formats', ], }, From 6b9ee71ebf87bb4bc771f839843744558c0cbead Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Thu, 24 Apr 2025 11:53:25 -0500 Subject: [PATCH 2/2] Remove changes to hasThreatMatch article --- docs/cse/rules/cse-rules-syntax.md | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/docs/cse/rules/cse-rules-syntax.md b/docs/cse/rules/cse-rules-syntax.md index b07141a35c..2445019607 100644 --- a/docs/cse/rules/cse-rules-syntax.md +++ b/docs/cse/rules/cse-rules-syntax.md @@ -626,14 +626,10 @@ The following expression returns "10.10.1.0": ### hasThreatMatch -Use the `hasThreatMatch` Cloud SIEM rules function to match incoming records in Cloud SIEM to [threat intelligence sources](/docs/security/threat-intelligence/about-threat-intelligence/). The function matches all sources in the **Threat Intelligence** tab, unless you specify a specific source. `hasThreatMatch` can also match values in [custom threat intelligence sources in Cloud SIEM](/docs/cse/administration/create-custom-threat-intel-source/). +The `hasThreatMatch` Cloud SIEM rules function matches incoming records in Cloud SIEM to [threat intelligence indicators](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#hasthreatmatch-cloud-siem-rules-language-function). It can also match values in [custom threat intelligence sources in Cloud SIEM](/docs/cse/administration/create-custom-threat-intel-source/). When an entity is processed by a rule using the `hasThreatMatch` function and is a match, the entity is associated with a known indicator that has a threat type attribute. The entity can be associated with either `threatType` (in normalized JSON format and CSV format), or `indicator_types` (in STIX format). -:::tip -To see standard rules that use the `hasThreatMatch` function, refer to the [Rules page in our Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md) and search for rules with "Threat Intel" in the name. -::: - **Syntax** `hasThreatMatch([], , )` @@ -667,10 +663,6 @@ Parameters: * `hasThreatMatch([srcDevice_ip], expired_indicators)` * `hasThreatMatch([srcDevice_ip], confidence > 50, all_indicators)` -:::note -Malicious confidence scores from different sources are normalized and mapped to a 0-100 numerical value in the `confidence` attribute. -::: - #### Best practice As a best practice, always include filtering to narrow your match to just the types desired (that is, `type=`). This will ensure that your match expressions are not overly broad.