Skip to content

Commit 8d3e2bc

Browse files
authored
DOCS-1048 - Add rules list page and details page information (#5730)
* Add rules info * Fix spelling error
1 parent d074f22 commit 8d3e2bc

File tree

3 files changed

+38
-4
lines changed

3 files changed

+38
-4
lines changed

docs/cse/rules/about-cse-rules.md

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
99
import Iframe from 'react-iframe'; 
1010

1111
A Cloud SIEM rule is logic that fires based on information in incoming records. When a rule fires, it creates a signal.
12-
13-
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view rules, in the top menu select **Content > Rules**.
14-
15-
[**New UI**](/docs/get-started/sumo-logic-ui). To view rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**.
1612

1713
:::tip
1814
For a complete list of out-of-the-box rules, see [Rules](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md) in the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md).
@@ -36,6 +32,44 @@ Watch this micro lesson to learn more about rules.
3632

3733
:::
3834

35+
## Rules list view
36+
37+
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view rules, in the top menu select **Content > Rules**.
38+
39+
[**New UI**](/docs/get-started/sumo-logic-ui). To view rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**.
40+
41+
<img src={useBaseUrl('img/cse/rules-list-page.png')} alt="Rules list page" style={{border: '1px solid gray'}} width="800" />
42+
43+
| Letter | Description |
44+
|:--|:--|
45+
| a | **Rules count**. The total number of rules in the list. |
46+
| b | **Filters**. Filter the list of rules by different parameters, such as name, type, severity, and so on. |
47+
| c | **Sort**. Sort rules by name, enabled, severity, created, updated, or signal count updated the past 7 days or 24 hours.  |
48+
| d | **Updated**. When the rule was last updated. |
49+
| e | **Status - Type**. The [rule status](/docs/cse/rules/rules-status/) and [rule type](/docs/cse/rules/about-cse-rules/#rule-types)|
50+
| f | **Severity**. The rule's severity, an estimate of the criticality of the detected activity, from 1 (lowest) to 10 (highest). |
51+
| g | **Signals Fired**. The number of signals that the rule fired in the last 24 hours as well as 7 days. |
52+
| h | **Export as JSON**. Export the rule information as a JSON file. |
53+
| i | **Tags**. Metadata [tags](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules/) that add context for the rule. Click a tag to see rules with that tag. |
54+
55+
## Rules details view
56+
57+
When you click a rule on the **Rules** page, a details page for the rule appears.
58+
59+
<img src={useBaseUrl('img/cse/rule-details.png')} alt="Rules details page" style={{border: '1px solid gray'}} width="800" />
60+
61+
| Letter | Description |
62+
|:--|:--|
63+
| a | **Rule ID**. The ID for the rule. |
64+
| b | **Rule name**. The name of the rule. |
65+
| c | **Dates**. When the rule was created, updated, and fired its most recent signal.  |
66+
| d | [**Status**](/docs/cse/rules/rules-status/), [**Rule Type**](/docs/cse/rules/about-cse-rules/#rule-types), **Severity**, and number of [**Tuning Expressions**](#about-tuning-expressions). |
67+
| e | **Signal Suppression**. When [signal suppression](/docs/cse/records-signals-entities-insights/about-signal-suppression/) occurred. Click a square on the calendar to see the number of signals suppressed on that day. |
68+
| f | **Rule Editor**. Click in fields to edit the rule. For information about the fields, see articles for the [rule types](#rule-types)|
69+
| g | **Prototype Rule**. Select the checkbox to [save the rule a prototype](/docs/cse/rules/write-chain-rule/#save-as-prototype). |
70+
| h | **History**. Change events for the rule, including who made the change and the type of change event. |
71+
| i | **Insights**. The [insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/) that resulted from the rule's firing. |
72+
3973
## About rule expressions
4074

4175
The key element of a Cloud SIEM rule is a *rule expression*. A rule expression defines what conditions the rule will look for. A rule expression includes one or more equality statements, each of which evaluates a field value in incoming records, typically comparing it to a constant value, for example `description = 'CMS Domain Match'`. A simple rule expression might be a single equality expression, or multiple expressions combined with logical operators. A rule expression evaluates to a boolean value. When a rule’s conditions are met, it creates a signal. 

static/img/cse/rule-details.png

652 KB
Loading

static/img/cse/rules-list-page.png

344 KB
Loading

0 commit comments

Comments
 (0)