You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cse/rules/about-cse-rules.md
+38-4Lines changed: 38 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,10 +9,6 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
9
9
import Iframe from 'react-iframe';
10
10
11
11
A Cloud SIEM rule is logic that fires based on information in incoming records. When a rule fires, it creates a signal.
12
-
13
-
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view rules, in the top menu select **Content > Rules**.
14
-
15
-
[**New UI**](/docs/get-started/sumo-logic-ui). To view rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**.
16
12
17
13
:::tip
18
14
For a complete list of out-of-the-box rules, see [Rules](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md) in the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md).
@@ -36,6 +32,44 @@ Watch this micro lesson to learn more about rules.
36
32
37
33
:::
38
34
35
+
## Rules list view
36
+
37
+
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view rules, in the top menu select **Content > Rules**.
38
+
39
+
[**New UI**](/docs/get-started/sumo-logic-ui). To view rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**.
| a |**Rules count**. The total number of rules in the list. |
46
+
| b |**Filters**. Filter the list of rules by different parameters, such as name, type, severity, and so on. |
47
+
| c |**Sort**. Sort rules by name, enabled, severity, created, updated, or signal count updated the past 7 days or 24 hours. |
48
+
| d |**Updated**. When the rule was last updated. |
49
+
| e |**Status - Type**. The [rule status](/docs/cse/rules/rules-status/) and [rule type](/docs/cse/rules/about-cse-rules/#rule-types). |
50
+
| f |**Severity**. The rule's severity, an estimate of the criticality of the detected activity, from 1 (lowest) to 10 (highest). |
51
+
| g |**Signals Fired**. The number of signals that the rule fired in the last 24 hours as well as 7 days. |
52
+
| h |**Export as JSON**. Export the rule information as a JSON file. |
53
+
| i |**Tags**. Metadata [tags](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules/) that add context for the rule. Click a tag to see rules with that tag. |
54
+
55
+
## Rules details view
56
+
57
+
When you click a rule on the **Rules** page, a details page for the rule appears.
| c |**Dates**. When the rule was created, updated, and fired its most recent signal. |
66
+
| d |[**Status**](/docs/cse/rules/rules-status/), [**Rule Type**](/docs/cse/rules/about-cse-rules/#rule-types), **Severity**, and number of [**Tuning Expressions**](#about-tuning-expressions). |
67
+
| e |**Signal Suppression**. When [signal suppression](/docs/cse/records-signals-entities-insights/about-signal-suppression/) occurred. Click a square on the calendar to see the number of signals suppressed on that day. |
68
+
| f |**Rule Editor**. Click in fields to edit the rule. For information about the fields, see articles for the [rule types](#rule-types). |
69
+
| g |**Prototype Rule**. Select the checkbox to [save the rule a prototype](/docs/cse/rules/write-chain-rule/#save-as-prototype). |
70
+
| h |**History**. Change events for the rule, including who made the change and the type of change event. |
71
+
| i |**Insights**. The [insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/) that resulted from the rule's firing. |
72
+
39
73
## About rule expressions
40
74
41
75
The key element of a Cloud SIEM rule is a *rule expression*. A rule expression defines what conditions the rule will look for. A rule expression includes one or more equality statements, each of which evaluates a field value in incoming records, typically comparing it to a constant value, for example `description = 'CMS Domain Match'`. A simple rule expression might be a single equality expression, or multiple expressions combined with logical operators. A rule expression evaluates to a boolean value. When a rule’s conditions are met, it creates a signal.
0 commit comments