-
Notifications
You must be signed in to change notification settings - Fork 503
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add documentation that supports custom log types (#4969)
* fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> * fix#4741 custom logtype updates Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]>
- Loading branch information
Showing
17 changed files
with
305 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,237 @@ | ||
| --- | ||
| layout: default | ||
| title: Log type APIs | ||
| parent: API tools | ||
| nav_order: 56 | ||
| --- | ||
|
|
||
| # Log type APIs | ||
|
|
||
| The log type APIs allow you to create a custom log type, search custom log types, update custom log types, and delete custom log types. | ||
|
|
||
|
|
||
| ## Create log type | ||
|
|
||
| Creating a new custom log type involves entering a name and a description and specifying the source as `Custom`. | ||
|
|
||
|
|
||
| ### Example request | ||
|
|
||
| ```json | ||
| POST /_plugins/_security_analytics/logtype | ||
| { | ||
| "description": "custom-log-type-desc", | ||
| "name": "custom-log-type4", | ||
| "source": "Custom" | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
|
|
||
| ### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "_id": "m98uk4kBlb9cbROIpEj2", | ||
| "_version": 1, | ||
| "logType": { | ||
| "name": "custom-log-type4", | ||
| "description": "custom-log-type-desc", | ||
| "source": "Custom", | ||
| "tags": { | ||
| "correlation_id": 27 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| ## Search custom log types | ||
|
|
||
| This API allows you to search log types in the system. | ||
|
|
||
|
|
||
| ### Example request | ||
|
|
||
| ```json | ||
| POST /_plugins/_security_analytics/logtype/_search | ||
| { | ||
| "query": { | ||
| "match_all": {} | ||
| } | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
|
|
||
| ### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "took": 3, | ||
| "timed_out": false, | ||
| "_shards": { | ||
| "total": 1, | ||
| "successful": 1, | ||
| "skipped": 0, | ||
| "failed": 0 | ||
| }, | ||
| "hits": { | ||
| "total": { | ||
| "value": 26, | ||
| "relation": "eq" | ||
| }, | ||
| "max_score": 2.0, | ||
| "hits": [ | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "s3", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "s3", | ||
| "description": "Windows logs", | ||
| "source": "Sigma", | ||
| "tags": { | ||
| "correlation_id": 21 | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "others_compliance", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "others_compliance", | ||
| "description": "Compliance logs", | ||
| "source": "Sigma", | ||
| "tags": { | ||
| "correlation_id": 4 | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "github", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "github", | ||
| "description": "Sys logs", | ||
| "source": "Sigma", | ||
| "tags": { | ||
| "correlation_id": 16 | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "others_application", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "others_application", | ||
| "description": "Application logs", | ||
| "source": "Sigma", | ||
| "tags": { | ||
| "correlation_id": 0 | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "dns", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "dns", | ||
| "description": "Compliance logs", | ||
| "source": "Sigma", | ||
| "tags": { | ||
| "correlation_id": 15 | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "_index": ".opensearch-sap-log-types-config", | ||
| "_id": "m98uk4kBlb9cbROIpEj2", | ||
| "_score": 2.0, | ||
| "_source": { | ||
| "name": "custom-log-type-updated4", | ||
| "description": "custom-log-type-updated-desc", | ||
| "source": "Custom", | ||
| "tags": null | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| ## Update custom log type | ||
|
|
||
| This API allows you to update existing custom log types. Use the log type's ID in the route to specify the log type, as shown in the following example: | ||
|
|
||
| ```json | ||
| PUT /_plugins/_security_analytics/logtype/<log_type_id> | ||
| ``` | ||
|
|
||
|
|
||
| ### Example request | ||
|
|
||
| ```json | ||
| PUT /_plugins/_security_analytics/logtype/m98uk4kBlb9cbROIpEj2 | ||
| { | ||
| "name": "custom-log-type4", | ||
| "description": "custom-log-type-updated-desc", | ||
| "source": "Custom" | ||
| } | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
|
|
||
| ### Example response | ||
|
|
||
| ```json | ||
| { | ||
| "_id": "m98uk4kBlb9cbROIpEj2", | ||
| "_version": 1, | ||
| "logType": { | ||
| "name": "custom-log-type4", | ||
| "description": "custom-log-type-updated-desc", | ||
| "source": "Custom", | ||
| "tags": { | ||
| "correlation_id": 27 | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| ## Delete custom log type | ||
|
|
||
| This API is used to delete a custom log type. Specify the log type's ID in the route to run the operation: | ||
|
|
||
| ```json | ||
| DELETE /_plugins/_security_analytics/logtype/<log_type_id> | ||
| ``` | ||
|
|
||
|
|
||
| ### Example request | ||
|
|
||
| ```json | ||
| DELETE /_plugins/_security_analytics/logtype/m98uk4kBlb9cbROIpEj2 | ||
| ``` | ||
| {% include copy-curl.html %} | ||
|
|
||
|
|
||
| ### Example response | ||
|
|
||
| ```json | ||
| 200 OK | ||
| { | ||
| "_id": "m98uk4kBlb9cbROIpEj2", | ||
| "_version": 1 | ||
| } | ||
| ``` | ||
|
|
||
| Only custom log types can be deleted. Trying to delete a standard OpenSearch-defined log type results in an error. | ||
| {: .note } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
_security-analytics/sec-analytics-config/custom-log-type.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| --- | ||
| layout: default | ||
| title: Creating custom log types | ||
| parent: Setting up Security Analytics | ||
| nav_order: 18 | ||
| --- | ||
|
|
||
|
|
||
| # Creating custom log types | ||
|
|
||
| Log types represent the different sources of data used for threat detection in Security Analytics. In addition to the standard log types supported by Security Analytics, you can create custom log types for your threat detectors. Follow the steps provided here to create a custom log type. | ||
|
|
||
|
|
||
| ## The Log types page | ||
|
|
||
| To navigate to the **Log types** page, select **Log types** under **Detectors** in the navigation menu. The following image shows the **Log types** landing page. | ||
|
|
||
| <img src="{{site.url}}{{site.baseurl}}/images/Security/c-log-type.png" alt="The Log types landing page." width="85%"> | ||
|
|
||
| The table that lists the log types provides the name of the log type, its description, and identifies whether it's a standard OpenSearch-defined log type or a custom log type. The following list describes the main features found on the **Log types** page and the actions you can take: | ||
|
|
||
| * Select the log type **Name** to open the log type's details page. The **Details** tab is shown by default. This tab includes the log type's ID. You can also select the **Detection rules** tab to show all detection rules associated with the log type. | ||
| * In the **Actions** column, you can select the trash can icon ({::nomarkdown}<img src="{{site.url}}{{site.baseurl}}/images/alerting/trash-can-icon.png" class="inline-icon" alt="trash can icon"/>{:/}) to delete a custom log type (you cannot delete a standard OpenSearch-defined log type). Follow the prompts to confirm and safely remove the custom log type. | ||
| * Select **Create log type** in the upper-right corner of the screen to begin creating a custom log type. The **Create log type** page opens. Continue with the steps in the section that follows to create a custom log type. | ||
|
|
||
|
|
||
| ## Creating a custom log type | ||
|
|
||
| After selecting **Create log type** on the **Log types** page, the **Create log type** page opens and provides the necessary fields for creating a new log type: | ||
|
|
||
| 1. Enter a name for the log type. | ||
|
|
||
| The log type name supports characters a--z (lowercase), 0--9, hyphens, and underscores. | ||
| {: .note } | ||
|
|
||
| 1. Enter a description for the log type. | ||
| 1. Select **Create log type** in the lower-right corner of the screen. The screen returns to the **Log types** page, and the new log type appears in the list of all log types. Note that the source for the new log type indicates **Custom**. | ||
|
|
||
|
|
||
| ## Log type API | ||
|
|
||
| To perform operations for custom log types using the REST API, see [Log type APIs]({{site.url}}{{site.baseurl}}/security-analytics/api-tools/log-type-api/). | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.