Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Docs][SIEM]Threat hunting ehancements #1039

Merged
merged 4 commits into from
May 11, 2020
Merged

[Docs][SIEM]Threat hunting ehancements #1039

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
151cebd
threat hunting ehancements
May 6, 2020
bba5d54
fixes typo
May 6, 2020
7bc1751
minor edits
May 6, 2020
9d583b8
corrections
May 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/en/siem/images/siem-click-swipe.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/en/siem/images/siem-field-highlight.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
42 changes: 32 additions & 10 deletions docs/en/siem/siem-ui.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,31 @@ environment, and you can use the interactive UI to drill down into areas of
interest.

The *{kibana-ref}/kuery-query.html[{kib} Query Language (KQL)]* bar is available
throughout the {siem-app} for searching and filtering.
throughout the {siem-app} for searching and filtering. You can also click and
swipe histograms, which updates the global time filter.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can also click and swipe histograms, which updates the global time filter.

Would you be willing to consider describing this behavior ("brush selection" is the obscure technical term for it), like the following suggestion?

When histograms contain peaks or a time range containing interesting data, click on the chart, and while holding down the mouse or trackpad button, drag over the time range to select it, which updates the global time filter.

brush-selection-still

Consider including a still screenshot like the one above to illustrate the selection process.

Do we support animated gifs in docs? If so, perhaps we could include something like the following?

brush-selection-animated

Copy link
Contributor Author

@benskelker benskelker May 10, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the text to describe what to do instead of how to do it, and the screenshot. I think it's ok now.
Technically, we can add gif animations. I need to check with other writers if it's ok to do so. Personally, I find them a bit distracting in docs.


[role="screenshot"]
image::images/siem-click-swipe.png[]

TIP: All {siem-soln} histograms and graphs contain an **Inspect** button, so
you can examine data sources throughout the app.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so you can examine data sources throughout the app.

Consider replacing "data sources" with "queries", e.g.:

so you can view the Elasticsearch queries that provide data for graphs throughout the app.


Chart legends and many grid fields are interactive. Fields that can be dragged
to <<timelines-ui, Timeline>> are indicated with two dotted vertical lines, and
are highlighted when you hover over a grid's row:

[role="screenshot"]
image::images/siem-field-highlight.png[]

When a popup menu appears while hovering over a field, you can perform these
actions:

* Filter for value: adds the field to the filter bar
* Filter out value: adds the field with a `NOT` operator to the filter bar
* Add to Timeline investigation: adds the field to Timeline
* Show top <field name>: displays a histogram of the top field values
* Copy to clipboard: copies the field and its value to your clipboard, using
KQL syntax

NOTE: The default index glob patterns defined for {siem-soln} events are
`endgame-*`, `auditbeat-*`, `winlogbeat-*`, `filebeat-*`, `packetbeat-*`,
Expand All @@ -23,9 +47,6 @@ Management -> Advanced Settings -> `siem:defaultIndex`.
The Overview page provides a high-level view of security events available
for analysis, and can help surface problems with data ingestion.

TIP: All histograms and graphs on the overview page contain an **Inspect** button so users may better understand that data surfaced through the {siem-app}.


[discrete]
[[search-overview]]
==== Search
Expand Down Expand Up @@ -214,12 +235,13 @@ image::images/cases-ui-home.png[]
[[timelines-ui]]
== Timelines

Use timelines as your workspace for alert investigations or threat hunting.
Data from multiple indices can be added to a timeline, which enables investigating
complex threats, such as lateral movement of malware across hosts in your network.
Use Timeline as your workspace for alert investigations or threat hunting.
Data from multiple indices can be added to a timeline, which enables
investigating complex threats, such as lateral movement of malware across hosts
in your network.

You can drag objects of interest into the Timeline Event Viewer to create
exactly the query filter you need to get to the bottom of an alert. You can drag
You can drag objects of interest into Timeline to create exactly the query
filter you need to get to the bottom of an alert. You can drag
items from table widgets within Hosts and Network pages, or even from within
Timeline itself.

Expand All @@ -233,7 +255,7 @@ image::images/timeline-ui.png[]

Add notes for your own use and to communicate your workflow and findings to
others. You can share a timeline, or pass it off to another person or team. You
can link to timelines from a ticketing system.
can also link to timelines from Cases and external ticketing systems.


[discrete]
Expand Down