diff --git a/hugo/config/_default/menus/main.en.yaml b/hugo/config/_default/menus/main.en.yaml index 10ec4da44dd..ff33c77b378 100644 --- a/hugo/config/_default/menus/main.en.yaml +++ b/hugo/config/_default/menus/main.en.yaml @@ -7891,9 +7891,9 @@ menu: identifier: cloud_siem_custom_detection_rules weight: 202 - name: Create Rule - url: security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule + url: security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule parent: cloud_siem_custom_detection_rules - identifier: cloud_siem_real_time_rule + identifier: cloud_siem_create_custom_detection_rule weight: 2021 - name: Anomaly url: security/cloud_siem/detect_and_monitor/custom_detection_rules/anomaly @@ -8987,11 +8987,21 @@ menu: parent: synthetics identifier: synthetics_test_suites weight: 6 + - name: Bits Testing + url: synthetics/bits_testing/ + parent: synthetics + identifier: synthetics_bits_testing + weight: 7 + - name: Goal-Based Testing + url: synthetics/goal_based_testing/ + parent: synthetics + identifier: synthetics_goal_based_testing + weight: 8 - name: Platform url: synthetics/platform/ parent: synthetics identifier: synthetics_platform - weight: 7 + weight: 9 - name: Dashboards url: synthetics/platform/dashboards parent: synthetics_platform @@ -9061,7 +9071,7 @@ menu: url: synthetics/explore/ parent: synthetics identifier: synthetics_explore - weight: 8 + weight: 10 - name: Saved Views url: synthetics/explore/saved_views parent: synthetics_explore @@ -9101,12 +9111,12 @@ menu: url: synthetics/guide/ parent: synthetics identifier: synthetics_guides - weight: 9 + weight: 11 - name: Notifications url: synthetics/notifications/ parent: synthetics identifier: synthetics_notifications - weight: 10 + weight: 12 - name: Template Variables url: synthetics/notifications/template_variables/ parent: synthetics_notifications @@ -9151,12 +9161,12 @@ menu: url: synthetics/troubleshooting/ parent: synthetics identifier: synthetics_troubleshooting - weight: 11 + weight: 13 - name: Data Security identifier: data_security_synthetics url: data_security/synthetics/ parent: synthetics - weight: 12 + weight: 14 - name: Continuous Testing url: continuous_testing/ pre: continuous-testing diff --git a/hugo/content/.gitignore b/hugo/content/.gitignore index bc481666bd0..6c75959639e 100644 --- a/hugo/content/.gitignore +++ b/hugo/content/.gitignore @@ -119,6 +119,7 @@ /*/session_replay/privacy_options.md /*/session_replay/setup_and_configuration.md /*/session_replay/troubleshooting.md +/*/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md /*/dd_e2e/cdocs/components/stepper_customizable.md /*/serverless/azure_container_apps/_index.md /*/serverless/azure_container_apps/manual_instrumentation/_index.md diff --git a/hugo/content/en/account_management/rbac/data_access.md b/hugo/content/en/account_management/rbac/data_access.md index bee9fc060e8..ae802727acc 100644 --- a/hugo/content/en/account_management/rbac/data_access.md +++ b/hugo/content/en/account_management/rbac/data_access.md @@ -77,6 +77,7 @@ The following are available as a Preview upon request: - Database Monitoring - Hosts - Processes +- Containers ## Advanced configuration diff --git a/hugo/content/en/data_security/cloud_siem.md b/hugo/content/en/data_security/cloud_siem.md index b918654a22e..658b71ef464 100644 --- a/hugo/content/en/data_security/cloud_siem.md +++ b/hugo/content/en/data_security/cloud_siem.md @@ -56,6 +56,6 @@ Security notifications can be sent to [integrations][4], such as Jira, PagerDuty [1]: /security/notifications/variables/?tab=cloudsiem#template-variables [2]: /help/ -[3]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule?tab=threshold#describe-your-playbook +[3]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule#describe-your-playbook [4]: /security/notifications/#integrations [5]: /integrations/webhooks/ diff --git a/hugo/content/en/experiments/guide/connecting_a_data_warehouse.mdoc.md b/hugo/content/en/experiments/guide/connecting_a_data_warehouse.mdoc.md index 771045a72ad..d8456617bfa 100644 --- a/hugo/content/en/experiments/guide/connecting_a_data_warehouse.mdoc.md +++ b/hugo/content/en/experiments/guide/connecting_a_data_warehouse.mdoc.md @@ -529,7 +529,7 @@ The examples in this guide use `datadog_experiments_user` and `datadog_experimen ### Create a dedicated service user and role in Snowflake -1. Use the [Snowflake documentation][18] to create a public-private key pair for enhanced authentication. Datadog only supports unencrypted private keys. +1. Use the [Snowflake documentation][18] to create a public-private key pair for enhanced authentication. Datadog supports both unencrypted private keys and passphrase-protected PKCS#8 private keys. 1. Run the following commands in Snowflake to create the user and role in the service account. Replace `` with the public key you generated in the previous step. ```sql @@ -596,7 +596,7 @@ To connect your Snowflake account to Datadog for warehouse-native experiment ana 1. Add your {% ui %}Account URL{% /ui %}. To find your account URL, see the [Snowflake guide][19]. 1. Toggle off all resources (these are not needed for experiment analysis). 1. Enter the Snowflake {% ui %}User Name{% /ui %} you created in [Step 1](#step-1-prepare-the-snowflake-service-account) (for example, `datadog_experiments_user`). -1. Scroll to the {% ui %}Configure a key pair authentication{% /ui %} section and upload your unencrypted {% ui %}private key{% /ui %}. +1. Scroll to the {% ui %}Configure a key pair authentication{% /ui %} section and upload your {% ui %}private key{% /ui %}. If your private key is passphrase-protected, enter the passphrase in the {% ui %}Private Key Password{% /ui %} field. 1. Click {% ui %}Save{% /ui %}. {% alert %} diff --git a/hugo/content/en/profiler/profile_types.md b/hugo/content/en/profiler/profile_types.md index 3e53f8075a9..a1d195d23dd 100644 --- a/hugo/content/en/profiler/profile_types.md +++ b/hugo/content/en/profiler/profile_types.md @@ -43,7 +43,7 @@ Live Heap (v1.61.0+) : The objects and memory allocated by each method that have not yet been garbage collected. This is useful for investigating the overall memory usage of your service and identifying potential memory leaks. The profiler automatically uses the most accurate engine available for your JVM version.
_Requires: Java 11+_ -Wall Time in Native Code +Wall Time : The elapsed time spent by each method. Elapsed time includes time when code is running on CPU, waiting for I/O, and anything else that happens while the method is running. Class Load diff --git a/hugo/content/en/real_user_monitoring/rum_without_limits/retention_filters.md b/hugo/content/en/real_user_monitoring/rum_without_limits/retention_filters.md index b0da945a1ef..f3355c065ab 100644 --- a/hugo/content/en/real_user_monitoring/rum_without_limits/retention_filters.md +++ b/hugo/content/en/real_user_monitoring/rum_without_limits/retention_filters.md @@ -78,7 +78,7 @@ Permanent retention filters are predefined retention filters that cannot be modi There are three permanent retention filters: -- {{< ui >}}RUM-APM Flat Sampling{{< /ui >}}: Retains 100% of sessions with ingested distributed traces (and index their traces on APM). These sessions (and their traces) are **not subject to RUM billing (or APM billing)**. +- {{< ui >}}RUM-APM Flat Sampling{{< /ui >}}: Retains 1% of sessions with ingested distributed traces (and index their traces on APM). These sessions (and their traces) are **not subject to RUM billing (or APM billing)**. - {{< ui >}}Synthetics Sessions{{< /ui >}}: Retains all sessions generated by [Synthetic Monitoring][1]. These sessions are billed under Synthetic Monitoring and are **not subject to RUM billing**. - {{< ui >}}Sessions with forced replays{{< /ui >}}: Retains all sessions for which a replay was force-collected through the [force collection][2] mechanism. diff --git a/hugo/content/en/real_user_monitoring/rum_without_limits/retention_quotas.md b/hugo/content/en/real_user_monitoring/rum_without_limits/retention_quotas.md index fdd2b581db6..605b960bf65 100644 --- a/hugo/content/en/real_user_monitoring/rum_without_limits/retention_quotas.md +++ b/hugo/content/en/real_user_monitoring/rum_without_limits/retention_quotas.md @@ -58,4 +58,4 @@ Retention quotas can also be managed through [APIs][1]. {{< partial name="whats-next/whats-next.html" >}} -[1]: /api/latest/rum-retention-quota/ +[1]: /api/latest/rum-retention-quotas/ diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/_index.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/_index.md index 5a4274640dc..dafc4a09ff7 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/_index.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/_index.md @@ -13,7 +13,7 @@ aliases: - /security/cloud_siem/log_detection_rules/ - /security/cloud_siem/detection_rules/ further_reading: -- link: "/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule/" +- link: "/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/" tag: "Documentation" text: "Create a custom detection rule" - link: "/cloud_siem/default_rules/" @@ -90,7 +90,7 @@ Use unit testing to test your rules against sample logs and make sure the detect {{< partial name="whats-next/whats-next.html" >}} -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule/ +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/ [2]: https://app.datadoghq.com/security/siem/rules [3]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/threshold/ [4]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/new_value/ diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/anomaly.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/anomaly.md index aea2e828975..0177444aef5 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/anomaly.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/anomaly.md @@ -34,5 +34,4 @@ A short learning period is applied for new rules or newly observed values for a - Scope the query narrowly. Filter by service, environment, team, or endpoint to reduce noise. - Start with managed default rules for broad coverage, then add custom anomaly rules for high-volume log sources. -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule?tab=anomaly -[2]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule/?tab=anomaly#rule-multi-triggering-rt-anomaly \ No newline at end of file +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=anomaly \ No newline at end of file diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/content_anomaly.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/content_anomaly.md index 84ca626cdb8..c9829a5826f 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/content_anomaly.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/content_anomaly.md @@ -126,7 +126,7 @@ $$\text"J(log1,log2)" = 2 / 8 = 0.25$$ | Evaluation window | Yes | No | Yes | | Retention | 14 days | 30 days | 10 days | -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=content_anomaly [2]: https://www.unicode.org/reports/tr29/tr29-22.html [3]: https://en.wikipedia.org/wiki/Jaccard_index [4]: https://en.wikipedia.org/wiki/MinHash diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md deleted file mode 100644 index 139ec6d3919..00000000000 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Create a Custom Rule -type: multi-code-lang ---- - diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.mdoc.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.mdoc.md new file mode 100644 index 00000000000..04da5dfb497 --- /dev/null +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.mdoc.md @@ -0,0 +1,1220 @@ +--- +title: Create a Custom Rule +content_filters: + - trait_id: cloud_siem_detection_rule_detection_method + option_group_id: cloud_siem_detection_rule_detection_method_options + - trait_id: cloud_siem_detection_rule_type + option_group_id: cloud_siem_detection__rule_type_options + - trait_id: cloud_siem_detection_threshold_rule_query_language + option_group_id: cloud_siem_detection_rule_event_query_only_language_options + show_if: + - cloud_siem_detection_rule_detection_method: ["threshold"] + cloud_siem_detection_rule_type: ["real_time_rule"] + - trait_id: cloud_siem_detection_threshold_sql_rule_query_language + option_group_id: cloud_siem_detection_threshold_sql_rule_query_language_options + show_if: + - cloud_siem_detection_rule_detection_method: ["threshold"] + cloud_siem_detection_rule_type: ["scheduled_rule", "historical_job"] + - trait_id: cloud_siem_detection_sequence_rule_query_language + option_group_id: cloud_siem_detection_sequence_rule_query_language_options + show_if: + - cloud_siem_detection_rule_detection_method: ["sequence"] + - trait_id: cloud_siem_detection_signal_correlation_rule_query_language + option_group_id: cloud_siem_detection_signal_correlation_rule_query_language_options + show_if: + - cloud_siem_detection_rule_detection_method: ["signal_correlation"] + - trait_id: cloud_siem_detection_rule_query_language + option_group_id: cloud_siem_detection_rule_event_query_only_language_options + hide_if: + - cloud_siem_detection_rule_detection_method: ["threshold","signal_correlation","sequence"] +aliases: +- /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule +- /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/scheduled_rule +- /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/historical_job +- /security/cloud_siem/detect_and_monitor/custom_detection_rules/signal_correlation_rules +--- + +## Overview + +### Understand rule creation options + +Before creating a rule, you must choose three options: +{% collapse-content title="Detection method" level="h4" expanded=false id="detection-methods" %} +The event to monitor for: + +**Threshold** +: Detects when a query for a specific activity occurs a number of times you define. Set the threshold to 1 for signature-based detections, or use a higher value to alert on patterns of alerted activity. This is the most common starting point when building a rule. + +**New Value** +: Triggers when one or more tracked attributes take on a value not seen during the learning period; for example, an account logging in from a country, IP, and device it's never used before. + +**Anomaly** +: Detects unexpected spikes or upward shifts, but not drop-offs, in log activity, accounting for daily and weekly seasonality. An example detection could be a spike in outbound traffic from a database server at 2 PM, far outside its normal nightly backup window. + +**Content Anomaly** +: Attackers hide intent in fields the rest of the log looks normal in; for example, encoded commands, oddly long URLs, or suspicious user agents. Content Anomaly inspects those fields and flags content that doesn't match what you usually see. + +**Impossible Travel** +: If a user signs in from New York and London 10 minutes apart, at least one of those sessions isn't theirs. Impossible Travel detects credential theft by comparing the speed required to move between consecutive logins. + +**Third Party** +: Your security stack already detects threats in your endpoint, identity, and cloud tools. Third Party brings those findings into Cloud SIEM so they can be triaged alongside your native rules, in a single, unified workflow. + +**Sequence** +: A sequence of events that are suspicious in combination with each other: for example, a successful login from a previously unseen IP, then a new privileged role granted to that user, then access to a sensitive resource, all in that order, by the same actor. Each step on its own can look like normal admin activity. Only the precise chain points to credential abuse. +{% /collapse-content %} + +{% collapse-content title="Rule type" level="h4" expanded=false id="rule-types" %} +When you want to analyze incoming or indexed events: + +**Real-time rule** +: Real-time detection rules continuously monitor and analyze incoming logs for security threats. These rules trigger immediate alerts when specific patterns or anomalies are detected, enabling quicker response to potential incidents. + +**Scheduled rule** +: Scheduled detection rules run at predefined intervals to analyze indexed log data and detect security threats. These rules can identify patterns, anomalies, or specific conditions within a defined time frame, and trigger alerts or reports if the criteria are met. They complement real-time monitoring by providing periodic, in-depth analysis of logs using [calculated fields][7]. + +**Historical job** +: Historical jobs are one-time executable queries on historical logs used to backtest detection rules and assess their effectiveness on past data. The generated job results are lightweight versions of signals providing information on potential threats and anomalies on historical logs. After reviewing the results, you can convert results needing immediate action into signals. +{% /collapse-content %} +{% collapse-content title="Query language" level="h4" expanded=false id="query-languages" %} +The language used to write your query: + +**Event query** +: Depending on the detection method and rule type, you can create detections based on data in logs, audit trails, events, RUM, signals, or rules. + +**SQL** +: Use SQL syntax to write detection rules using [DDSQL][5] that are compatible with datasets. + +**Event/rule query** +: If you select the Sequence detection method, for each step in the sequence, you can query logs using either events or rules. +{% /collapse-content %} + +The options you choose impact the steps required to create the rule. Use the filters at the top of this page to specify your rule creation options, so the relevant instructions populate on the rest of the page. + +{% table %} +* **Detection method** +* **Rule types** {% colspan=3 %} +--- +* +* **Real-time rule** +* **Scheduled rule** +* **Historical job** +--- +* **Threshold** +* Event query +* Event query, SQL {% colspan=2 %} +--- +* **New Value** +* Event query {% rowspan=5 %} {% colspan=3 %} +--- +* **Anomaly** +--- +* **Content anomaly** +--- +* **Impossible travel** +--- +* **Third party** +--- +* **Sequence** +* Event/rule query +* *Not supported* +* Event/rule query +--- +* **Signal correlation** +* Rule query {% colspan=2 %} +* *Not supported* +{% /table %} + +If you're getting started, you can click these links to automatically apply common filter combinations to this page: +- [Threshold/Real-time rule/Event query](?cloud_siem_detection_rule_detection_method=threshold&cloud_siem_detection_rule_type=real_time_rule&cloud_siem_detection_threshold_rule_query_language=event_query) +- [Threshold/Scheduled rule/SQL](?cloud_siem_detection_rule_detection_method=threshold&cloud_siem_detection_rule_type=scheduled_rule&cloud_siem_detection_threshold_sql_rule_query_language=sql) +- [Threshold/Historical job/SQL](?cloud_siem_detection_rule_detection_method=threshold&cloud_siem_detection_rule_type=historical_job&cloud_siem_detection_threshold_sql_rule_query_language=sql) + +## Create a rule + +1. To create a detection rule, navigate to the [Create a New Detection][2] page. +1. {% if equals($cloud_siem_detection_rule_detection_method, "threshold") %}Select the **Threshold** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "new_value") %}Select the **New value** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "anomaly") %}Select the **Anomaly** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "content_anomaly") %}Select the **Content Anomaly** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "impossible_travel") %}Select the **Impossible travel** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "third_party") %}Select the **Third party** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "sequence") %}Select the **Sequence** detection method.{% /if %} +{% if equals($cloud_siem_detection_rule_detection_method, "signal_correlation") %}Select the **Signal correlation** detection method.{% /if %} +1. {% if and(or(equals($cloud_siem_detection_rule_detection_method, "threshold"),equals($cloud_siem_detection_rule_detection_method, "new_value"),equals($cloud_siem_detection_rule_detection_method, "anomaly"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel"),equals($cloud_siem_detection_rule_detection_method, "third_party")),equals($cloud_siem_detection_rule_type, "real_time_rule")) %}Select **Real-Time Rule**, which also automatically selects **Event query** as the query language.{% /if %} +{% if and(or(equals($cloud_siem_detection_rule_detection_method, "new_value"),equals($cloud_siem_detection_rule_detection_method, "anomaly"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel"),equals($cloud_siem_detection_rule_detection_method, "third_party")),equals($cloud_siem_detection_rule_type, "scheduled_rule")) %}Select **Scheduled Rule**, which also automatically selects **Event query** as the query language.{% /if %} +{% if and(or(equals($cloud_siem_detection_rule_detection_method, "new_value"),equals($cloud_siem_detection_rule_detection_method, "anomaly"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel"),equals($cloud_siem_detection_rule_detection_method, "third_party")),equals($cloud_siem_detection_rule_type, "historical_job")) %}Select **Historical Job**, which also automatically selects **Event query** as the query language. Under **Select Logs Index and Timerange**, select the parameters for your historical query.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "threshold"),equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_threshold_sql_rule_query_language, "event_query")) %}Select **Scheduled Rule**, then **Event query**.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "threshold"),equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_threshold_sql_rule_query_language, "sql")) %}Select **Scheduled Rule**, then **SQL**.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "threshold"),equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_threshold_sql_rule_query_language, "event_query")) %}Select **Historical Job**, then **Event query**. Under **Select Logs Index and Timerange**, select the parameters for your historical query.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "threshold"),equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_threshold_sql_rule_query_language, "sql")) %}Select **Historical Job**, then **SQL**. Under **Select Timerange**, select the time window for your historical query.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "sequence"),equals($cloud_siem_detection_rule_type, "real_time_rule")) %}Select **Real-time rule**, which also automatically selects **Event/rule query** as the query language.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "sequence"),equals($cloud_siem_detection_rule_type, "historical_job")) %}Select **Historical job**, which also automatically selects **Event/rule query** as the query language. Under **Select Logs Index and Timerange**, select the parameters for your historical query.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "signal_correlation"),equals($cloud_siem_detection_rule_type, "real_time_rule")) %}Select **Real-time rule**, which also automatically selects **Rule query** as the query language.{% /if %} +{% if and(equals($cloud_siem_detection_rule_detection_method, "signal_correlation"),equals($cloud_siem_detection_rule_type, "scheduled_rule")) %}Select **Scheduled rule**, which also automatically selects **Rule query** as the query language.{% /if %} + +## Define your search query + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} + +{% img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/threshold_query.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +{% img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/new_value_query.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +{% img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. +1. (Optional) In the **Count** dropdown menu, select attributes whose unique values you want to count during the specified time frame. + {% partial file="security/cloud_siem/anomaly_query.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/content_anomaly_query.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +{% img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" /%} +{% alert level="info" %} +All logs and events matching this query are analyzed for potential impossible travel. +{% /alert %} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/impossible_travel_query.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. +1. In the **Trigger for each new** dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over a 24-hour roll-up period. +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Add Root Query** and repeat steps 2-4 to add and test additional queries. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "sequence")) %} +{% img src="security/security_monitoring/detection_rules/sequence/sequence_queries.png" alt="Sequence editor page showing the sequence with two steps" style="width:100%;" /%} + +### Add step + +1. To search a different data type, click the down arrow next to **Logs** and select **Signals** or **Rules**. +1. Define the condition for the step. + - **Logs**: Construct a search query using the [Log Explorer search syntax][1]. + - **Signals**: Reference an existing rule or query on signal fields. + - **Rules**: Select a rule. +1. Set **group by** fields (for example, `@usr.email` or `@ip.address`) to link entities across steps. +1. Enter a threshold condition, such as `>10`. +1. If you want to use another query, connect this query with the next query using `AND` or `OR` and repeat steps 1-4. +1. In the **roll-up over** dropdown menu, select the time frame all queries in that step must occur to transition to the next step. + +### Define step transitions + +For the current step and the next step: + +1. In the **within** dropdown menu, select an evaluation window for the transition. + {% alert level="info" %} + The total evaluation time across the sequence can be up to 24 hours. + {% /alert %} +1. Follow the instructions in [Add step](#add-step) to complete the step. + {% alert level="info" %} + You can select different `group by` fields between steps. For example, link `@usr.email` from an earlier step to `@ip.address` in a later step. + {% /alert %} +1. Click **Add Step** if you want to add more steps. + +### Severity and notification + +1. In the **Trigger** dropdown menu, select the severity status. +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][3]. + - You can create [notification rules][4] to manage notifications automatically, avoiding manual edits for each detection rule. + +### Review the sequence preview + +1. In the **Preview detection** section, check the steps, transitions, and time window in the visualization of the steps. Reorder the steps and adjust time windows as needed. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "signal_correlation")) %} +{% img src="security/security_monitoring/detection_rules/signal_correlation_query.png" alt="Define the search query" style="width:100%;" /%} + +1. Select a rule for **Rule a**. +1. Click the pencil icon to rename the rule. +1. Use the **correlated by** dropdown to define the correlating attribute. + - You can select multiple attributes (maximum of 3) to correlate the selected rules. +1. Select a rule for **Rule b** in the second Rule editor's dropdown. + - The attributes and sliding window time frame is automatically set to what was selected for **Rule a**. +1. Click the pencil icon to rename the rule. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} + +{% if equals($cloud_siem_detection_threshold_sql_rule_query_language, "event_query") %} +{% img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/threshold_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + +{% if equals($cloud_siem_detection_threshold_sql_rule_query_language, "sql") %} +You can use SQL syntax to write detection rules for additional flexibility, consistency, and portability. For information on the available syntax, see [DDSQL Reference][5]. + +In Datadog, SQL queries are compatible with data stored in [datasets][6]. You can create datasets to format data already stored in tables for the following data types: +- Logs +- Audit Trail logs +- Events +- Security signals +- Spans +- RUM events +- Product Analytics events +- Cloud Network data +- NetFlow data +- Reference tables +- Infrastructure tables + +{% img src="security/security_monitoring/detection_rules/sql-ocsf-query-example.png" alt="Example of a SQL dataset and query" style="width:100%;" /%} + +1. Under **Define Datasets**, choose one or more datasets to use in your query. In the dropdown, you can select an existing published dataset to either use or clone, or click the **New** icon to create a dataset from scratch. + - If you chose an existing dataset and made changes, click **Update** to apply those changes to that dataset, or **Clone With Changes** to create a dataset with your changes applied. + - If you created a dataset, click **Create** so you can use it in your rule. +1. Under **Write Queries**, enter one or more SQL queries. For more information, see [DDSQL Reference][5]. Click **Preview** to see a list of matching results. + +Datadog applies rule conditions to the results your SQL queries return. It evaluates each query result against the conditions you define in the [rule conditions](#set-conditions) section, such as a count threshold or group-by attribute. It generates a signal when the query results meet those conditions. +{% /if %} + +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +{% img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/new_value_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +{% img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/anomaly_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/content_anomaly_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +{% img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" /%} +{% alert level="info" %} +All logs and events matching this query are analyzed for potential impossible travel. +{% /alert %} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/impossible_travel_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. If you are using an add-on and see the **Index** dropdown menu, select the index of logs you want to analyze. +1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. +1. In the **Trigger for each new** dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over a 24-hour roll-up period. +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Add Root Query** and repeat steps 3-7 to add and test additional queries. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "signal_correlation")) %} +{% img src="security/security_monitoring/detection_rules/signal_correlation_query.png" alt="Define the search query" style="width:100%;" /%} + +1. Select a rule for **Rule a**. +1. Click the pencil icon to rename the rule. +1. Use the **correlated by** dropdown to define the correlating attribute. + - You can select multiple attributes (maximum of 3) to correlate the selected rules. +1. Select a rule for **Rule b** in the second Rule editor's dropdown. + - The attributes and sliding window time frame is automatically set to what was selected for **Rule a**. +1. Click the pencil icon to rename the rule. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} + +{% if equals($cloud_siem_detection_threshold_sql_rule_query_language, "event_query") %} +{% img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/threshold_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + +{% if equals($cloud_siem_detection_threshold_sql_rule_query_language, "sql") %} +You can use SQL syntax to write historical jobs for additional flexibility, consistency, and portability. For information on the available syntax, see [DDSQL Reference][5]. + +In Datadog, SQL queries are compatible with data stored in [datasets][6]. You can create datasets to format data already stored in tables for the following data types: +- Logs +- Audit Trail logs +- Events +- Security signals +- Spans +- RUM events +- Product Analytics events +- Cloud Network data +- NetFlow data +- Reference tables +- Infrastructure tables + +{% img src="security/security_monitoring/detection_rules/sql-ocsf-query-example.png" alt="Example of a SQL dataset and query" style="width:100%;" /%} + +1. Under **Define Datasets**, choose one or more datasets to use in your query. In the dropdown, you can select an existing published dataset to either use or clone, or click the **New** icon to create a dataset from scratch. + - If you chose an existing dataset and made changes, click **Update** to apply those changes to that dataset, or **Clone With Changes** to create a dataset with your changes applied. + - If you created a dataset, click **Create** so you can use it in your rule. +1. Under **Write Queries**, enter one or more SQL queries. For more information, see [DDSQL Reference][5]. Click **Preview** to see a list of matching results. + +Datadog applies conditions to the results your SQL queries return. It evaluates each query result against the conditions you define in the [job conditions](#set-conditions) section, such as a count threshold or group-by attribute. It generates a job result when the query results meet those conditions. +{% /if %} + +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +{% img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/new_value_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +{% img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/anomaly_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/content_anomaly_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +{% img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" /%} +{% alert level="info" %} +All logs and events matching this query are analyzed for potential impossible travel. +{% /alert %} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. + {% partial file="security/cloud_siem/impossible_travel_query.mdoc.md" /%} +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" /%} + +1. To search Audit Trail events or events from Events Management, click the down arrow next to **Logs** and select **Audit Trail** or **Events**. +1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. +1. In the **Trigger for each new** dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over a 24-hour roll-up period. +1. (Optional) To create calculated fields that transform your logs during query time: + {% partial file="security/cloud_siem/add_calculated_fields.mdoc.md" /%} +1. (Optional) Filter logs using reference tables: + {% partial file="security/cloud_siem/add_reference_tables.mdoc.md" /%} +1. (Optional) To test your rules against sample logs, click **Unit Test**. + {% partial file="security/cloud_siem/unit_testing.mdoc.md" /%} +1. Click **Add Root Query** and repeat steps 2-6 to add and test additional queries. +1. Click **Save Rule**. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "sequence")) %} +{% img src="security/security_monitoring/detection_rules/sequence/sequence_queries.png" alt="Sequence editor page showing the sequence with two steps" style="width:100%;" /%} + +### Add step + +1. To search a different data type, click the down arrow next to **Logs** and select **Signals** or **Rules**. +1. Define the condition for the step. + - **Logs**: Construct a search query using the [Log Explorer search syntax][1]. + - **Signals**: Reference an existing rule or query on signal fields. + - **Rules**: Select a rule. +1. Set **group by** fields (for example, `@usr.email` or `@ip.address`) to link entities across steps. +1. Enter a threshold condition, such as `>10`. +1. If you want to use another query, connect this query with the next query using `AND` or `OR` and repeat steps 1-4. +1. In the **roll-up over** dropdown menu, select the time frame all queries in that step must occur to transition to the next step. + +### Define step transitions + +For the current step and the next step: + +1. In the **within** dropdown menu, select an evaluation window for the transition. + {% alert level="info" %} + The total evaluation time across the sequence can be up to 24 hours. + {% /alert %} +1. Follow the instructions in [Add step](#add-step) to complete the step. + {% alert level="info" %} + You can select different `group by` fields between steps. For example, link `@usr.email` from an earlier step to `@ip.address` in a later step. + {% /alert %} +1. Click **Add Step** if you want to add more steps. + +### Severity and notification + +1. In the **Trigger** dropdown menu, select the severity status. +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][3]. + - You can create [notification rules][4] to manage notifications automatically, avoiding manual edits for each detection rule. + +### Review the sequence preview + +1. In the **Preview detection** section, check the steps, transitions, and time window in the visualization of the steps. Reorder the steps and adjust time windows as needed. +1. Click **Save Rule**. +{% /if %} + +## Set conditions + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} +{% img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_threshold.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-rt-threshold %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-threshold %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-threshold %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-threshold %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} + +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +{% img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_severity_notify_only.mdoc.md" /%} + +### Other parameters + +#### Forget value {% #forget-value-rt-new-value %} + +{% partial file="security/cloud_siem/forget_value.mdoc.md" /%} + +#### Rule multi-triggering behavior {% #rule-multi-triggering-rt-new-value %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-new-value %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-new-value %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-new-value %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} + +#### Enable instantaneous baseline {% #enable-instantaneous-baseline-new-value %} + +{% partial file="security/cloud_siem/enable_instantaneous_baseline.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +{% img src="security/security_monitoring/detection_rules/anomaly_notification.png" alt="Set your severity, anomaly percentile, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_anomaly.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-rt-anomaly %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-anomaly %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/condition_content_anomaly.png" alt="Set your condition, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_content_anomaly.mdoc.md" /%} + +### Other parameters + +#### Content anomaly detection {% #content-anomaly-rt-content-anomaly %} + +{% partial file="security/cloud_siem/content_anomaly_options.mdoc.md" /%} + +#### Rule multi-triggering behavior {% #rule-multi-triggering-rt-content-anomaly %} + +{% partial file="security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-content-anomaly %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-content-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-content-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +{% img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_severity_notify_only.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-rt-impossible-travel %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-impossible-travel %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-impossible-travel %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-impossible-travel %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/condition_else.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_third_party.mdoc.md" /%} + +### Other parameters + +#### Decrease severity for non-production environments {% #decrease-severity-rt-third-party %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-third-party %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-third-party %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "sequence")) %} +#### Rule multi-triggering {% #rule-multi-triggering-rt-sequence %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-sequence %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-rt-sequence %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-rt-sequence %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_detection_method, "signal_correlation")) %} +{% img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_then_operator.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-rt-signal-correlation %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-rt-signal-correlation %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} +{% img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_threshold.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-scheduled-threshold %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-threshold %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-threshold %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-threshold %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +{% img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_severity_notify_only.mdoc.md" /%} + +### Other parameters + +#### Forget value {% #forget-value-scheduled-new-value %} + +{% partial file="security/cloud_siem/forget_value.mdoc.md" /%} + +#### Rule multi-triggering behavior {% #rule-multi-triggering-scheduled-new-value %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-new-value %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-new-value %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-new-value %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +{% img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_severity_notify_only.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-scheduled-anomaly %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-anomaly %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/condition_content_anomaly.png" alt="Set your condition, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_content_anomaly.mdoc.md" /%} + +### Other parameters + +#### Content anomaly detection {% #content-anomaly-scheduled-content-anomaly %} + +{% partial file="security/cloud_siem/content_anomaly_options.mdoc.md" /%} + +#### Rule multi-triggering behavior {% #rule-multi-triggering-scheduled-content-anomaly %} + +{% partial file="security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-content-anomaly %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-content-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-content-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +{% img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_severity_notify_only.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-scheduled-impossible-travel %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-impossible-travel %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-impossible-travel %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-impossible-travel %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/condition_else.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_third_party.mdoc.md" /%} + +### Other parameters + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-third-party %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-scheduled-third-party %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-third-party %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "scheduled_rule"),equals($cloud_siem_detection_rule_detection_method, "signal_correlation")) %} +{% img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_then_operator.mdoc.md" /%} + +### Other parameters + +#### Rule multi-triggering {% #rule-multi-triggering-scheduled-signal-correlation %} + +{% partial file="security/cloud_siem/rule_multi_triggering.mdoc.md" /%} + +#### Decrease severity for non-production environments {% #decrease-severity-scheduled-signal-correlation %} + +{% partial file="security/cloud_siem/enable_decrease_severity.mdoc.md" /%} + +#### Group signals {% #group-signals-scheduled-signal-correlation %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "threshold")) %} +{% img src="security/security_monitoring/detection_rules/threshold_historical_condition.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +{% partial file="security/cloud_siem/set_conditions_threshold.mdoc.md" /%} + +### Other parameters + +#### Job multi-triggering {% #job-multi-triggering-threshold %} + +{% partial file="security/cloud_siem/job_multi_triggering.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-historical-threshold %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-threshold %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "new_value")) %} +### Other parameters + +#### Forget value {% #forget-value-historical-new-value %} + +{% partial file="security/cloud_siem/forget_value.mdoc.md" /%} + +#### Job multi-triggering behavior {% #job-multi-triggering-historical-new-value %} + +{% partial file="security/cloud_siem/job_multi_triggering.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-historical-new-value %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-new-value %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "anomaly")) %} +### Other parameters + +#### Job multi-triggering {% #job-multi-triggering-historical-anomaly %} + +{% partial file="security/cloud_siem/job_multi_triggering.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-historical-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} + +#### Bucket duration + +In the **Bucket Duration** dropdown, select a duration over which to measure percentiles. + +#### Learning duration + +In the **Learning Duration** dropdown, select an amount of time for the rule to learn new values. + +#### Learning period alerts + +In the **Learning Period Alerts** dropdown, choose whether you want Cloud SIEM to send alerts during the learning period. +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "content_anomaly")) %} +{% img src="security/security_monitoring/detection_rules/content_anomaly_historical_condition.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Anomaly count** field, enter the condition for how many anomalous logs within the specified window are required to trigger a signal. + - For example, if the condition is `a >= 3` where `a` is the query, a signal is triggered if there are at least three anomalous logs within the evaluation window. + - All rule conditions are evaluated as condition statements. Thus, the order of the conditions affects which notifications are sent because the first condition to match generates the signal. Click and drag your rule conditions to change their ordering. + - A rule condition contains logical operations (`>`, `>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. + - The ASCII lowercase query labels are referenced in this section. An example rule condition for query `a` is `a > 3`. + {% alert level="info" %} + The query label must precede the operator. For example, `a > 3` is allowed; `3 < a` is not allowed. + {% /alert %} +1. In the **within a window of** dropdown menu, select the time period during which a signal is triggered if the condition is met. + - An `evaluation window` is specified to match when at least one of the cases matches true. This is a sliding window and evaluates cases in real time. + +### Other parameters + +#### Content anomaly detection {% #content-anomaly-historical-content-anomaly %} + +{% partial file="security/cloud_siem/content_anomaly_options.mdoc.md" /%} + +#### Job multi-triggering behavior {% #job-multi-triggering-historical-content-anomaly %} + +{% partial file="security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-historical-content-anomaly %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-content-anomaly %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "impossible_travel")) %} +### Other parameters + +#### Job multi-triggering {% #job-multi-triggering-impossible-travel %} + +{% partial file="security/cloud_siem/job_multi_triggering.mdoc.md" /%} + +#### Enable optional group by {% #enable-group-by-impossible-travel %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-impossible-travel %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "third_party")) %} +{% img src="security/security_monitoring/detection_rules/set_condition_root_query.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" /%} + +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Query** field, enter the tags of a log that you want to trigger a signal. + - For example, if you want logs with the tag `dev:demo` to trigger signals with a severity of `INFO`, enter `dev:demo` in the query field. Similarly, if you want logs with the tag `dev:prod` to trigger signals with a severity of `MEDIUM`, enter `dev:prod` in the query field. + +### Other parameters + +#### Enable optional group by {% #enable-group-by-historical-third-party %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-third-party %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if and(equals($cloud_siem_detection_rule_type, "historical_job"),equals($cloud_siem_detection_rule_detection_method, "sequence")) %} +#### Rule multi-triggering {% #rule-multi-triggering-historical-sequence %} + +{% partial file="security/cloud_siem/job_multi_triggering.mdoc.md" /%} + + + +#### Enable optional group by {% #enable-group-by-historical-sequence %} + +{% partial file="security/cloud_siem/enable_group_by.mdoc.md" /%} + +#### Group signals {% #group-signals-historical-sequence %} + +{% partial file="security/cloud_siem/group_signals.mdoc.md" /%} +{% /if %} + + +{% if equals($cloud_siem_detection_rule_type, "scheduled_rule") %} +## Add custom schedule + +You can set specific evaluation time and how often it runs by creating a [custom schedule](#create-custom-schedule) or using a [recurrence rule (RRULE)](#use-rrule). + +### Create custom schedule + +{% img src="security/security_monitoring/detection_rules/custom_schedule.png" alt="The Use custom schedule section with an example" style="width:100%;" /%} + +1. Select **Create Custom Schedules**. +1. Set how often and at what time you want the rule to run. + +### Use RRULE + +{% img src="security/security_monitoring/detection_rules/rrule_example.png" alt="The Use RRULE section with an example" style="width:100%;" /%} + +Recurrence rule (RRULE) is a property name from the [iCalendar RFC][8], which is the standard for defining recurring events. Use the [official RRULE generator][9] to generate recurring rules for more advanced scheduling use cases. + +For example, if the RRULE is: + +```text +FREQ=DAILY;INTERVAL=1;BYHOUR=6;BYMINUTE=0 +``` + +The example RRULE runs the scheduled rule once a day at 6:00 AM. + +{% alert level="info" %} +- Attributes specifying the duration in RRULE are not supported (for example, `DTSTART`, `DTEND`, `DURATION`). +- Evaluation frequencies must be a day or longer. For shorter evaluation frequencies, use the default monitor schedules. +{% /alert %} + +To write a custom RRULE for your detection rule: + +1. Select ** Use RRULE**. +1. Set the date and time for when you want the rule to start. +1. Input a [RRULE string][9] to set how often you want the rule to run. +{% /if %} + + +{% if equals($cloud_siem_detection_rule_type, "historical_job") %} +## Notify when job is complete + +(Optional) Click **Add Recipient** to send notifications upon the completion of job analysis. See [Notification channels][3] for more information. +{% /if %} + +## Describe your playbook + +{% partial file="security/cloud_siem/security-rule-say-whats-happening.mdoc.md" /%} + + +{% if or(equals($cloud_siem_detection_rule_type, "real_time_rule"),equals($cloud_siem_detection_rule_type, "scheduled_rule")) %} +## Create a suppression + +{% partial file="security/cloud_siem/create_suppression.mdoc.md" /%} +{% /if %} + +[1]: /logs/search_syntax/ +[2]: https://app.datadoghq.com/security/siem/rules/new +[3]: /security_platform/notifications/#notification-channels +[4]: /security/notifications/rules/ +[5]: /ddsql_reference/ +[6]: https://app.datadoghq.com/security/configuration/datasets +[7]: /logs/explorer/calculated_fields/ +[8]: https://icalendar.org/rrule-tool.html +[9]: https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html \ No newline at end of file diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/historical_job.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/historical_job.md deleted file mode 100644 index 055ec8cc02d..00000000000 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/historical_job.md +++ /dev/null @@ -1,275 +0,0 @@ ---- -title: Create a Historical Job -code_lang: historical_job -type: multi-code-lang -weight: 3 ---- - -## Overview - -Historical jobs are one-time executable queries on historical logs used to backtest detection rules and assess their effectiveness on past data. The generated job results are lightweight versions of signals providing information on potential threats and anomalies on historical logs. After reviewing the results, you can convert results needing immediate action into signals. - -## Create a rule - -1. To create a threshold detection rule or job, navigate to the [Create a New Detection][1] page. -1. Select {{< ui >}}Historical Job{{< /ui >}}. - -## Define your historical job - -1. Select the logs index and time range for the job. -1. Select the detection method you want to use for creating signals. - -## Define search queries - -{{< tabs >}} -{{% tab "Threshold" %}} - -Choose the query language you want to use. - -{{% collapse-content title="Event Query" level="h3" expanded=false id="threshold-event-query" %}} -{{< img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/threshold_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -{{% /collapse-content %}} -{{% collapse-content title="SQL" level="h3" expanded=false id="threshold-sql" %}} -You can use SQL syntax to write historical jobs for additional flexibility, consistency, and portability. For information on the available syntax, see [DDSQL Reference][1]. - -In Datadog, SQL queries are compatible with data stored in [datasets][2]. You can create datasets to format data already stored in tables for the following data types: -- Logs -- Audit Trail logs -- Events -- Security signals -- Spans -- RUM events -- Product Analytics events -- Cloud Network data -- NetFlow data -- Reference tables -- Infrastructure tables - - - -{{< img src="security/security_monitoring/detection_rules/sql-ocsf-query-example.png" alt="Example of a SQL dataset and query" style="width:100%" >}} - -1. Under {{< ui >}}Define Datasets{{< /ui >}}, choose one or more datasets to use in your query. In the dropdown, you can select an existing published dataset to either use or clone, or click the {{< ui >}}New{{< /ui >}} icon to create a dataset from scratch. - - If you chose an existing dataset and made changes, click {{< ui >}}Update{{< /ui >}} to apply those changes to that dataset, or {{< ui >}}Clone With Changes{{< /ui >}} to create a dataset with your changes applied. - - If you created a dataset, click {{< ui >}}Create{{< /ui >}} to use it in your job. -2. Under {{< ui >}}Write Queries{{< /ui >}}, enter one or more SQL queries. For more information, see [DDSQL Reference][1]. Click {{< ui >}}Preview{{< /ui >}} to see a list of matching results. - -Conditions are applied to the results returned by your SQL queries. Each query result is evaluated against the conditions you define in the {{< ui >}}Set Conditions{{< /ui >}} section, such as a count threshold or group-by attribute. A job result is generated when the query results meet those conditions. - -[1]: /ddsql_reference/ -[2]: https://app.datadoghq.com/security/configuration/datasets -{{% /collapse-content %}} - -{{% /tab %}} -{{% tab "New Value" %}} - -{{< img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/new_value_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/anomaly_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/content_anomaly_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -{{< img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/impossible_travel_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -**Note**: All logs and events matching this query are analyzed for a potential impossible travel. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. -1. In the {{< ui >}}Trigger for each new{{< /ui >}} dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over 24-hour roll-up period. -{{% cloud_siem/add_calculated_fields %}} - - See [Calculated Fields Expressions Language][3] for information on syntax and language constructs. -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -Click {{< ui >}}Add Root Query{{< /ui >}} to add additional queries. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{< /tabs >}} - -## Set conditions - -{{< tabs >}} -{{% tab "Threshold" %}} - -{{< img src="security/security_monitoring/detection_rules/threshold_historical_condition.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_threshold %}} - -### Other parameters - -#### 1. Job multi-triggering {#job-multi-triggering-threshold} - -{{% cloud_siem/job_multi_triggering %}} - -#### 2. Enable optional group by {#enable-group-by-historical-threshold} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "New Value" %}} - -### Other parameters - -#### 1. Forget value {#forget-value-historical-new-value} - -{{% cloud_siem/forget_value %}} - -#### 2. Job multi-triggering behavior {#job-multi-triggering-historical-new-value} - -{{% cloud_siem/job_multi_triggering %}} - -#### 3. Enable optional group by {#enable-group-by-historical-new-value} - -{{% cloud_siem/enable_group_by %}} - -#### 4. Enable instantaneous baseline - -{{% cloud_siem/enable_instantaneous_baseline %}} - -{{% /tab %}} -{{% tab "Anomaly" %}} - -### Other parameters - -#### 1. Job multi-triggering {#job-multi-triggering-historical-anomaly} - -{{% cloud_siem/job_multi_triggering %}} - -#### 2. Enable optional group by {#enable-group-by-historical-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/content_anomaly_historical_condition.png" alt="Set your condition, severity, and notification recipients" style="width:100%;" >}} - -1. (Optional) Click the pencil icon next to {{< ui >}}Condition 1{{< /ui >}} if you want to rename the condition. This name is appended to the rule name when a signal is generated. -1. In the {{< ui >}}Anomaly count{{< /ui >}} field, enter the condition for how many anomalous logs within the specified window are required to trigger a signal. - - For example, if the condition is `a >= 3` where `a` is the query, a signal is triggered if there are at least three anomalous logs within the evaluation window. - - All rule conditions are evaluated as condition statements. Thus, the order of the conditions affects which notifications are sent because the first condition to match generates the signal. Click and drag your rule conditions to change their ordering. - - A rule condition contains logical operations (`>`, `>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. - - The ASCII lowercase query labels are referenced in this section. An example rule condition for query `a` is `a > 3`. - - **Note**: The query label must precede the operator. For example, `a > 3` is allowed; `3 < a` is not allowed. -1. In the {{< ui >}}within a window of{{< /ui >}} dropdown menu, select the time period during which a signal is triggered if the condition is met. - - An `evaluation window` is specified to match when at least one of the cases matches true. This is a sliding window and evaluates cases in real time. - -### Other parameters - -#### 1. Content anomaly detection {#content-anomaly-historical-content-anomaly} -{{% cloud_siem/content_anomaly_options %}} - -#### 2. Job multi-triggering behavior {#job-multi-triggering-historical-content-anomaly} - -{{% cloud_siem/rule_multi_triggering_content_anomaly %}} - -#### 3. Enable optional group by {#enable-group-by-historical-content-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -### Other parameters - -#### 1. Job multi-triggering {#job-multi-triggering-historical-anomaly} - -{{% cloud_siem/job_multi_triggering %}} - -#### 2. Enable optional group by {#enable-group-by-historical-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/set_condition_root_query.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -1. (Optional) Click the pencil icon next to {{< ui >}}Condition 1{{< /ui >}} if you want to rename the condition. This name is appended to the rule name when a signal is generated. -1. In the {{< ui >}}Query{{< /ui >}} field, enter the tags of a log that you want to trigger a signal. - - For example, if you want logs with the tag `dev:demo` to trigger signals with a severity of `INFO`, enter `dev:demo` in the query field. Similarly, if you want logs with the tag `dev:prod` to trigger signals with a severity of `MEDIUM`, enter `dev:prod` in the query field. - -### Other parameters - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{< /tabs >}} - -## Notify when job is complete - -(Optional) Click {{< ui >}}Add Recipient{{< /ui >}} to send notifications upon the completion of job analysis. See [Notification channels][2] for more information. - -## Describe your playbook - -{{% security-rule-say-whats-happening %}} - -[1]: https://app.datadoghq.com/security/siem/rules/new -[2]: /security_platform/notifications/#notification-channels diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule.md deleted file mode 100644 index 287adc4124a..00000000000 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule.md +++ /dev/null @@ -1,346 +0,0 @@ ---- -title: Create a Real-Time Rule -aliases: - - /security/cloud_siem/detect_and_monitor/custom_detection_rules/signal_correlation_rules/ -code_lang: real_time_rule -type: multi-code-lang -weight: 1 ---- - -## Overview - -Real-time detection rules continuously monitors and analyzes incoming logs for security threats. These rules trigger immediate alerts when specific patterns or anomalies are detected, enabling quicker response to potential incidents. - -## Create a rule - -1. To create a detection rule, navigate to the [Create a New Detection][1] page. -1. Select {{< ui >}}Real-Time Rule{{< /ui >}}. - -## Define your real-time rule - -Select the detection method you want to use for creating signals. - -## Define search queries - -{{< tabs >}} -{{% tab "Threshold" %}} - -{{< img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/threshold_query %}} -{{% cloud_siem/add_reference_tables %}}

-{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "New Value" %}} - -{{< img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/new_value_query %}} -{{% cloud_siem/add_reference_tables %}}

-{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -1. (Optional) In the {{< ui >}}Count{{< /ui >}} dropdown menu, select attributes whose unique values you want to count during the specified time frame. -{{% cloud_siem/anomaly_query %}} -{{% cloud_siem/add_reference_tables %}}

-{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/content_anomaly_query %}} -{{% cloud_siem/add_reference_tables %}}

-{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -{{< img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/impossible_travel_query %}} -{{% cloud_siem/add_reference_tables %}}

-{{% cloud_siem/unit_testing %}} - -**Note**: All logs and events matching this query are analyzed for a potential impossible travel. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. -1. In the {{< ui >}}Trigger for each new{{< /ui >}} dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over 24-hour roll-up period. -{{% cloud_siem/unit_testing %}} - -Click {{< ui >}}Add Root Query{{< /ui >}} to add additional queries. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Signal Correlation" %}} - -{{< img src="security/security_monitoring/detection_rules/signal_correlation_query.png" alt="Define the search query" style="width:100%;" >}} - -1. Select a rule for {{< ui >}}Rule a{{< /ui >}}. -1. Click the pencil icon to rename the rule. -1. Use the {{< ui >}}correlated by{{< /ui >}} dropdown to define the correlating attribute. - - You can select multiple attributes (maximum of 3) to correlate the selected rules. -1. Select a rule for {{< ui >}}Rule b{{< /ui >}} in the second Rule editor's dropdown. - - The attributes and sliding window time frame is automatically set to what was selected for {{< ui >}}Rule a{{< /ui >}}. -1. Click the pencil icon to rename the rule. - -[1]: /logs/search_syntax/ - -{{% /tab %}} -{{% tab "Sequence" %}} - -{{< img src="security/security_monitoring/detection_rules/sequence/sequence_queries.png" alt="Sequence editor page showing the sequence with two steps" style="width:100%;" >}} - -#### Add step - -1. To search a different data type, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Signals{{< /ui >}} or {{< ui >}}Rules{{< /ui >}}. -1. Define the condition for the step. - - **Logs**: Construct a search query using the [Log Explorer search syntax][1]. - - **Signals**: Reference an existing rule or query on signal fields. - - **Rules**: Select a rule. -1. Set **group by** fields (for example, `@usr.email` or `@ip.address`) to link entities across steps. -1. Enter a threshold condition, such as `>10`. -1. If you want to use another query, connect this query with the next query using `AND` or `OR` and repeat steps 1-4. -1. In the {{< ui >}}roll-up over{{< /ui >}} dropdown menu, select the time frame all queries in that step must occur to transition to the next step. - -#### Define step transitions - -For the current step and the next step: - -1. In the {{< ui >}}within{{< /ui >}} dropdown menu, select an evaluation window for the transition. - - **Note**: The total evaluation time across the sequence can be up to 24 hours. -1. Follow the instructions in [Add step](#add-step) to complete the step. - - **Note**: You can select different `group by` fields between steps. For example, link `@usr.email`from an earlier step to `@ip.address` in a later step. -1. Click {{< ui >}}Add Step{{< /ui >}} if you want to add more steps. - -#### Severity and notification - -1. In the {{< ui >}}Trigger{{< /ui >}} dropdown menu, select the severity status. -1. (Optional) In the {{< ui >}}Add notify{{< /ui >}} section, click {{< ui >}}Add Recipient{{< /ui >}} to configure [notification targets][2]. - - You can create [notification rules][3] to manage notifications automatically, avoiding manual edits for each detection rule. - -#### Review the sequence preview - -In the {{< ui >}}Preview detection{{< /ui >}} section, check the steps, transitions, and time window in the visualization of the steps. Reorder the steps and adjust time windows as needed. - -[1]: /logs/search_syntax/ -[2]: /security_platform/notifications/#notification-channels -[3]: /security/notifications/rules/ - -{{% /tab %}} -{{< /tabs >}} - -## Set conditions - -{{< tabs >}} -{{% tab "Threshold" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_threshold %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-rt-threshold} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-rt-threshold} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-rt-threshold} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "New Value" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_severity_notify_only %}} - -### Other parameters - -#### 1. Forget value {#forget-value-rt-new-value} - -{{% cloud_siem/forget_value %}} - -#### 2. Rule multi-triggering behavior {#rule-multi-triggering-rt-new-value} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 3. Decrease severity for non-production environments {#decrease-severity-new-value} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 4. Enable optional group by {#enable-group-by-rt-new-value} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_severity_notify_only %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-rt-anomaly} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-rt-anomaly} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-rt-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_content_anomaly.png" alt="Set your condition, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_content_anomaly %}} - -### Other parameters - -#### 1. Content anomaly detection {#content-anomaly-rt-content-anomaly} -{{% cloud_siem/content_anomaly_options %}} - -#### 2. Rule multi-triggering behavior {#rule-multi-triggering-rt-content-anomaly} - -{{% cloud_siem/rule_multi_triggering_content_anomaly %}} - -#### 3. Decrease severity for non-production environments {#decrease-severity-rt-content-anomaly} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 4. Enable optional group by {#enable-group-by-rt-content-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_severity_notify_only %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-rt-impossible-travel} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-rt-impossible-travel} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-rt-impossible-travel} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_else.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_third_party %}} - -### Other parameters - -#### 1. Decrease severity for non-production environments {#decrease-severity-rt-third-party} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 2. Enable optional group by {#enable-group-by-rt-third-party} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Signal Correlation" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_then_operator %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-rt-signal-correlation} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-rt-signal-correlation} - -{{% cloud_siem/enable_decrease_severity %}} - -{{% /tab %}} -{{% tab "Sequence" %}} - -#### 1. Rule multi-triggering {#rule-multi-triggering-rt-sequence} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-rt-sequence} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-rt-sequence} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{< /tabs >}} - -## Describe your playbook - -{{% security-rule-say-whats-happening %}} - -## Create a suppression - -{{% cloud_siem/create_suppression %}} - -[1]: https://app.datadoghq.com/security/siem/rules/new diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/scheduled_rule.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/scheduled_rule.md deleted file mode 100644 index 5288bac222c..00000000000 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/scheduled_rule.md +++ /dev/null @@ -1,375 +0,0 @@ ---- -title: Create a Scheduled Rule -code_lang: scheduled_rule -type: multi-code-lang -weight: 2 ---- - -## Overview - -Scheduled detection rules run at predefined intervals to analyze indexed log data and detect security threats. These rules can identify patterns, anomalies, or specific conditions within a defined time frame, and trigger alerts or reports if the criteria are met. - -Scheduled rules complement real-time monitoring by ensuring periodic, in-depth analysis of logs using [calculated fields][2]. - -## Create a rule - -1. To create a detection rule, navigate to the [Create a New Detection][1] page. -1. Select {{< ui >}}Scheduled Rule{{< /ui >}}. - -## Define your scheduled rule - -Select the detection method you want to use for creating signals. - -## Define search queries - -{{< tabs >}} -{{% tab "Threshold" %}} - -Choose the query language you want to use. - -{{% collapse-content title="Event Query" level="h3" expanded=false id="threshold-event-query" %}} -{{< img src="security/security_monitoring/detection_rules/threshold_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/threshold_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} -{{% /collapse-content %}} -{{% collapse-content title="SQL" level="h3" expanded=false id="threshold-sql" %}} -You can use SQL syntax to write detection rules for additional flexibility, consistency, and portability. For information on the available syntax, see [DDSQL Reference][1]. - -In Datadog, SQL queries are compatible with data stored in [datasets][2]. You can create datasets to format data already stored in tables for the following data types: -- Logs -- Audit Trail logs -- Events -- Security signals -- Spans -- RUM events -- Product Analytics events -- Cloud Network data -- NetFlow data -- Reference tables -- Infrastructure tables - - - -{{< img src="security/security_monitoring/detection_rules/sql-ocsf-query-example.png" alt="Example of a SQL dataset and query" style="width:100%" >}} - -1. Under {{< ui >}}Define Datasets{{< /ui >}}, choose one or more datasets to use in your query. In the dropdown, you can select an existing published dataset to either use or clone, or click the {{< ui >}}New{{< /ui >}} icon to create a dataset from scratch. - - If you chose an existing dataset and made changes, click {{< ui >}}Update{{< /ui >}} to apply those changes to that dataset, or {{< ui >}}Clone With Changes{{< /ui >}} to create a dataset with your changes applied. - - If you created a dataset, click {{< ui >}}Create{{< /ui >}} so you can use it in your rule. -2. Under {{< ui >}}Write Queries{{< /ui >}}, enter one or more SQL queries. For more information, see [DDSQL Reference][1]. Click {{< ui >}}Preview{{< /ui >}} to see a list of matching results. - -Rule conditions are applied to the results returned by your SQL queries. Each query result is evaluated against the conditions you define in the {{< ui >}}Set Conditions{{< /ui >}} section, such as a count threshold or group-by attribute. A signal is generated when the query results meet those conditions. - -[1]: /ddsql_reference/ -[2]: https://app.datadoghq.com/security/configuration/datasets -{{% /collapse-content %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "New Value" %}} - -{{< img src="security/security_monitoring/detection_rules/new_value_20250310.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/new_value_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/anomaly_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/content_anomaly_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/content_anomaly_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -{{< img src="security/security_monitoring/detection_rules/impossible_travel_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a search query for your logs or events using the [Log Explorer search syntax][1]. -{{% cloud_siem/impossible_travel_query %}} -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -**Note**: All logs and events matching this query are analyzed for a potential impossible travel. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/third_party_query.png" alt="Define the search query" style="width:100%;" >}} - -1. To search Audit Trail events or events from Events Management, click the down arrow next to {{< ui >}}Logs{{< /ui >}} and select {{< ui >}}Audit Trail{{< /ui >}} or {{< ui >}}Events{{< /ui >}}. -1. If you are an add-on and see the {{< ui >}}Index{{< /ui >}} dropdown menu, select the index of logs you want to analyze. -1. Construct a root query for your logs or events using the [Log Explorer search syntax][1]. -1. In the {{< ui >}}Trigger for each new{{< /ui >}} dropdown menu, select the attributes where each attribute generates a signal for each new attribute value over 24-hour roll-up period. -{{% cloud_siem/add_calculated_fields %}} -{{% cloud_siem/add_reference_tables %}} -{{% cloud_siem/unit_testing %}} - -Click {{< ui >}}Add Root Query{{< /ui >}} to add additional queries. - -[1]: /logs/search_syntax/ -[2]: https://app.datadoghq.com/logs - -{{% /tab %}} -{{% tab "Signal Correlation" %}} - -{{< img src="security/security_monitoring/detection_rules/signal_correlation_query.png" alt="Define the search query" style="width:100%;" >}} - -1. Select a rule for {{< ui >}}Rule a{{< /ui >}}. -1. Click the pencil icon to rename the rule. -1. Use the {{< ui >}}correlated by{{< /ui >}} dropdown to define the correlating attribute. - - You can select multiple attributes (maximum of 3) to correlate the selected rules. -1. Select a rule for {{< ui >}}Rule b{{< /ui >}} in the second Rule editor's dropdown. - - The attributes and sliding window time frame is automatically set to what was selected for {{< ui >}}Rule a{{< /ui >}}. -1. Click the pencil icon to rename the rule. - -[1]: /logs/search_syntax/ - -{{% /tab %}} -{{< /tabs >}} - -## Set conditions - -{{< tabs >}} -{{% tab "Threshold" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_threshold %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-schedule-threshold} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-schedule-threshold} -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-schedule-threshold} -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "New Value" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -### Other parameters - -#### 1. Forget value {#forget-value-scheduled-new-value} - -{{% cloud_siem/forget_value %}} - -#### 2. Rule multi-triggering behavior {#rule-multi-triggering-scheduled-new-value} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 3. Decrease severity for non-production environments {#decrease-severity-scheduled-new-value} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 4. Enable optional group by {#enable-group-by-scheduled-new-value} - -{{% cloud_siem/enable_group_by %}} - -#### 5. Enable instantaneous baseline - -{{% cloud_siem/enable_instantaneous_baseline %}} - -{{% /tab %}} -{{% tab "Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_severity_notify_only %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-scheduled-anomaly} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-scheduled-anomaly} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-scheduled-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Content Anomaly" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_content_anomaly.png" alt="Set your condition, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_content_anomaly %}} - -### Other parameters - -#### 1. Content anomaly detection {#content-anomaly-scheduled-content-anomaly} - -{{% cloud_siem/content_anomaly_options %}} - -#### 2. Rule multi-triggering behavior {#rule-multi-triggering-scheduled-content-anomaly} - -{{% cloud_siem/rule_multi_triggering_content_anomaly %}} - -#### 3. Decrease severity for non-production environments {#decrease-severity-scheduled-content-anomaly} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 4. Enable optional group by {#enable-group-by-scheduled-content-anomaly} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Impossible Travel" %}} - -{{< img src="security/security_monitoring/detection_rules/severity_notification.png" alt="Set your severity and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_severity_notify_only %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-scheduled-impossible-travel} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-scheduled-impossible-travel} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 3. Enable optional group by {#enable-group-by-scheduled-impossible-travel} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Third Party" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_else.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_third_party %}} - -### Other parameters - -#### 1. Decrease severity for non-production environments {#decrease-severity-scheduled-third-party} - -{{% cloud_siem/enable_decrease_severity %}} - -#### 2. Enable optional group by {#enable-group-by-scheduled-third-party} - -{{% cloud_siem/enable_group_by %}} - -{{% /tab %}} -{{% tab "Signal Correlation" %}} - -{{< img src="security/security_monitoring/detection_rules/condition_simple_then.png" alt="Set your conditions, severity, and notification recipients" style="width:100%;" >}} - -{{% cloud_siem/set_conditions_then_operator %}} - -### Other parameters - -#### 1. Rule multi-triggering {#rule-multi-triggering-scheduled-signal-correlation} - -{{% cloud_siem/rule_multi_triggering %}} - -#### 2. Decrease severity for non-production environments {#decrease-severity-scheduled-signal-correlation} - -{{% cloud_siem/enable_decrease_severity %}} - -{{% /tab %}} -{{< /tabs >}} - -## Add custom schedule - -You can set specific evaluation time and how often it runs by creating a [custom schedule](#create-custom-schedule) or using a [recurrence rule (RRULE)](#use-rrule). - -### Create custom schedule - -{{< img src="security/security_monitoring/detection_rules/custom_schedule.png" alt="The Use custom schedule section with an example" style="width:100%;" >}} - -1. Select {{< ui >}}Create Custom Schedules{{< /ui >}}. -1. Set how often and at what time you want the rule to run. - -### Use RRULE - -{{< img src="security/security_monitoring/detection_rules/rrule_example.png" alt="The Use RRULE section with an example" style="width:100%;" >}} - -Recurrence rule (RRULE) is a property name from the [iCalendar RFC][3], which is the standard for defining recurring events. Use the [official RRULE generator][4] to generate recurring rules. Leverage RRULEs to cover more advanced scheduling use cases. - -For example, if the RRULE is: - -```text -FREQ=DAILY;INTERVAL=1;BYHOUR=6;BYMINUTE=0 -``` - -The example RRULE runs the scheduled rule once a day at 6:00 AM. - -**Notes**: -- Attributes specifying the duration in RRULE are not supported (for example, `DTSTART`, `DTEND`, `DURATION`). -- Evaluation frequencies must be a day or longer. For shorter evaluation frequencies, use the default monitor schedules. - -To write a custom RRULE for your detection rule: - -1. Select {{< ui >}} Use RRULE{{< /ui >}}. -1. Set the date and time for when you want the rule to start. -1. Input a [RRULE string][4] to set how often you want the rule to run. - -## Describe your playbook - -{{% security-rule-say-whats-happening %}} - -## Create a suppression - -{{% cloud_siem/create_suppression %}} - -[1]: https://app.datadoghq.com/security/configuration/siem/rules -[2]: /logs/explorer/calculated_fields/ -[3]: https://icalendar.org/rrule-tool.html -[4]: https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/impossible_travel.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/impossible_travel.md index 3153f16c004..ed0285bc3e7 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/impossible_travel.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/impossible_travel.md @@ -5,7 +5,9 @@ disable_toc: false ## Overview -The impossible travel method detects access from different locations whose distance is greater than the distance a human can travel in the time between the two access events. See [Create Rule][1] for detailed instructions on how to create an impossible travel rule. +The impossible travel method detects access from different locations whose distance is greater than the distance a human can travel in the time between the two access events. + +See [Create Rule][1] for detailed instructions on how to create an impossible travel rule. ## How the impossible travel method works @@ -35,4 +37,4 @@ When {{< ui >}}Baseline User Locations{{< /ui >}} is enabled: - If it's not an impossible travel situation, Datadog moves on to the next log or event. - It it's an impossible travel situation, Datadog checks if there is an IP transition pattern. From example, if a user travels from location A to location B and that travel pattern has occurred in the past, a signal is not triggered. -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=impossible_travel diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/new_value.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/new_value.md index 2e1410ff8a0..d3a867e0368 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/new_value.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/new_value.md @@ -47,5 +47,5 @@ The learning duration has the following options: The [Forget value][2] option determines how long the rule keeps a value known. After this period has passed, the value is forgotten and the rule alerts on the value again. The maximum number of days for {{< ui >}}Forget value{{< /ui >}} is 30 days. -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule?tab=newvalue -[2]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule?tab=newvalue#forget-value-rt-new-value +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=new_value +[2]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=new_value&cloud_siem_detection_rule_type=real_time_rule#forget-value-rt-new-value \ No newline at end of file diff --git a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence.md b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence.md index 142068d36e6..e763c793e8e 100644 --- a/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence.md +++ b/hugo/content/en/security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence.md @@ -15,10 +15,10 @@ The sequence method enables you to detect multi-stage attacks by identifying ord You can define a sequence of steps that must occur within a defined time frame and across related entities, such as a user, host, or IP address. Each sequence can combine conditions from multiple logs or signals to identify coordinated activity that might be missed by individual rules. -{{< img src="security/security_monitoring/detection_rules/sequence/preview.png" alt="Sequence editor page showing a preview of the steps" style="width:100%;" >}} - See [Create Rule][1] for instructions on how to configure a sequence rule. +{{< img src="security/security_monitoring/detection_rules/sequence/preview.png" alt="Sequence editor page showing a preview of the steps" style="width:100%;" >}} + ## How the sequence method works ### Detection logic @@ -65,4 +65,4 @@ When you [create a sequence detection rule][1], you can configure these options: {{< partial name="whats-next/whats-next.html" >}} -[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/real_time_rule?tab=sequence +[1]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule?cloud_siem_detection_rule_detection_method=sequence diff --git a/hugo/content/en/synthetics/_index.md b/hugo/content/en/synthetics/_index.md index 3236c2dff39..2838542ffab 100644 --- a/hugo/content/en/synthetics/_index.md +++ b/hugo/content/en/synthetics/_index.md @@ -92,6 +92,12 @@ Use [Synthetic Test Suites][26] to organize multiple tests into logical collecti {{< img src="synthetics/test_suites/test_suite_summary.png" alt="Synthetic Monitoring Test Suite summary page" style="width:100%;">}} +## Explore Bits Testing and Goal-Based Testing + +Use [Bits Testing][27] to explore your application, map critical user journeys, and generate Synthetic tests that cover them, including [Goal-Based tests][28] that verify users can reach a goal using non-deterministic, agentic testing. + +{{< img src="synthetics/bits_testing/bits_testing_landing.png" alt="The Bits Testing landing page with a prompt to describe the test coverage you want" style="width:100%;">}} + ## Launch private locations Use [Synthetic private locations][15] to monitor internal APIs and websites or create custom locations in areas that are mission-critical to your business. @@ -179,3 +185,5 @@ See [Getting Started with Synthetic Monitoring][18] for instructions on creating [24]: /synthetics/notifications/ [25]: /synthetics/network_path_tests/ [26]: /synthetics/test_suites/ +[27]: /synthetics/bits_testing/ +[28]: /synthetics/goal_based_testing/ diff --git a/hugo/content/en/synthetics/bits_testing.md b/hugo/content/en/synthetics/bits_testing.md new file mode 100644 index 00000000000..70b7c7d67ca --- /dev/null +++ b/hugo/content/en/synthetics/bits_testing.md @@ -0,0 +1,133 @@ +--- +title: Bits Testing +description: Use Bits Testing, an AI agent that explores your application to map critical user journeys and generate covering Synthetic tests. +private: true +further_reading: +- link: "/synthetics/goal_based_testing/" + tag: "Documentation" + text: "Goal-Based Testing" +- link: "/synthetics/browser_tests/" + tag: "Documentation" + text: "Browser Testing" +- link: "/synthetics/api_tests/http_tests" + tag: "Documentation" + text: "HTTP Tests" +- link: "/synthetics/network_path_tests/" + tag: "Documentation" + text: "Network Path Testing" +- link: "/synthetics/test_suites/" + tag: "Documentation" + text: "Test Suites" +- link: "/synthetics/platform/settings/#global-variables" + tag: "Documentation" + text: "Global Variables" +- link: "https://www.datadoghq.com/pricing/?product=synthetic-monitoring#products" + tag: "Pricing" + text: "Synthetic Monitoring pricing" +--- + +{{< beta-callout url="https://www.datadoghq.com/product-preview/bits-testing/" >}} +Bits Testing is in Preview. Request access to join the waiting list. +{{< /beta-callout >}} + +## Overview + +Bits Testing is an AI agent that explores your application to map its most critical user journeys. It recommends ways to increase test coverage, and it can generate the Synthetic tests needed to close coverage gaps. + +Bits Testing can also generate [Goal-Based tests][1]. This Synthetic test type uses prompted, non-deterministic, agentic testing to check that users can complete a specific goal in your application. + +## Prerequisites + +If your application sits behind bot protection or a web application firewall (WAF), allow the IPs listed under `synthetics` in the [Datadog IP ranges][2] with your provider. To run Bits Testing from a single location, you can allow only that location's IP range instead. See [Run Bits Testing](#run-bits-testing) for the locations Bits Testing can run from. + +## Access Bits Testing + +Open Bits Testing from Synthetic Monitoring & Testing using any of the following: + +- **Bits Testing** in the Synthetic Monitoring & Testing top navigation. +- `Cmd+K` on macOS or `Ctrl+K` on Windows, then search for Bits Testing. +- **Bits Testing** in the side navigation menu, under **Digital Experience > Synthetic Monitoring & Testing**. + +## Run Bits Testing + +1. On the Bits Testing page, describe the coverage you want in plain language. For example, ask Bits Testing to increase coverage generally, or to focus on specific features. +1. Select a location to run the exploration from: + - Frankfurt (GCP: `gcp:europe-west3`) + - N. Virginia (AWS: `aws:us-east-1`) + - Ohio (AWS: `aws:us-east-2`) + - Virginia (Azure: `azure:eastus`) +1. Optionally, select an [Agent Profile](#agent-profiles). +1. Click {{< ui >}}Run Now{{< /ui >}}. + +{{< img src="synthetics/bits_testing/bits_testing_run_config.png" alt="The Bits Testing run configuration panel with a starting URL, location, and Agent Profile selectors" style="width:100%;" >}} + +Bits Testing explores your application starting from the URL you provide. At each new page it encounters, it determines a set of actions to try, and it repeats this process as it moves through your application. + +{{< img src="synthetics/bits_testing/bits_testing_exploration_in_progress.png" alt="A Bits Testing run in progress, exploring an application from its starting URL" style="width:100%;" >}} + +### Agent Profiles + +An Agent Profile stores context that Bits Testing uses while interacting with your application, such as login credentials. + +To create an Agent Profile: + +1. Open the {{< ui >}}Agent Profile{{< /ui >}} dropdown menu and select {{< ui >}}+ New Profile{{< /ui >}}. +1. Name the profile. +1. Add one or more variables. For each variable, set: + - **Usage**: The variable's purpose, for example, `username` or `password`. + - **Value**: Either a typed value, or an existing [Global Variable][3]. +1. Click {{< ui >}}Create Profile{{< /ui >}}. + +{{< img src="synthetics/bits_testing/bits_testing_agent_profile_modal.png" alt="The New Profile modal for creating an Agent Profile, with fields for name, variable usage, and value" style="width:100%;" >}} + +The new profile is automatically selected for the current run. Saved Agent Profiles can be reused in later Bits Testing runs without redefining their variables. + +## Review results + +When a run completes, Bits Testing displays a graph of the branches it explored: + +- **Successful (green)** branches led to a relevant user journey that Bits Testing can generate a test for. +- **Unsuccessful (indigo)** branches didn't yield a relevant journey, either because Bits Testing judged the flow as not relevant or inconsistent, or because it encountered an error. + +If a run doesn't complete successfully, the graph shows the error that stopped it. + +{{< img src="synthetics/bits_testing/bits_testing_results_graph.png" alt="A completed Bits Testing exploration graph showing the branches explored and the journeys found" style="width:100%;" >}} + +## Generated test suites + +Click a green journey card to open the AI-generated test suite for that journey. A test suite can include: + +- **[Browser tests][6]** that replay the interactions a user takes to complete the journey, with assertions along the way. +- **[HTTP tests][7]** that validate the endpoints the journey calls to retrieve data. +- **[Network path tests][8]** that check the hosts powering the journey are reachable. +- **[Goal-Based tests][1]** that validate the journey using non-deterministic, agentic testing. + +Each test in the suite includes a free sample test run. Review the suite and either: + +- Click {{< ui >}}Ignore{{< /ui >}} if the suite isn't relevant, and optionally share feedback about why. +- Click {{< ui >}}Start Testing{{< /ui >}} to add the suite's tests to your account. + +After you start testing a suite, each test becomes a regular Synthetic test that you can edit or delete. By default, generated tests run every 5 minutes from the location you selected for the Bits Testing run. + +{{< img src="synthetics/bits_testing/bits_testing_generated_suite.png" alt="A generated test suite with Browser, HTTP, Network Path, and Goal-Based tests, showing a passed run's details" style="width:100%;" >}} + +## Billing + +During the Preview, running Bits Testing and Goal-Based tests is free. Tests you enable from a Bits Testing run are billed as regular Synthetic tests, based on test runs. See [Synthetic Monitoring pricing][4]. + +## Supported locations + +Bits Testing and Goal-Based tests run only from the locations in [Run Bits Testing](#run-bits-testing). Browser, HTTP, and network path tests generated by Bits Testing don't have this restriction. After they're created, they support the same locations as any other Synthetic test, including [private locations][5]. + +## Further reading + +{{< partial name="whats-next/whats-next.html" >}} + +[1]: /synthetics/goal_based_testing/ +[2]: /api/latest/ip-ranges/list-ip-ranges/ +[3]: /synthetics/platform/settings/#global-variables +[4]: https://www.datadoghq.com/pricing/?product=synthetic-monitoring#products +[5]: /synthetics/platform/private_locations/ +[6]: /synthetics/browser_tests/ +[7]: /synthetics/api_tests/http_tests +[8]: /synthetics/network_path_tests/ diff --git a/hugo/content/en/synthetics/browser_tests/_index.md b/hugo/content/en/synthetics/browser_tests/_index.md index 0ae13435799..309d931e17c 100644 --- a/hugo/content/en/synthetics/browser_tests/_index.md +++ b/hugo/content/en/synthetics/browser_tests/_index.md @@ -253,7 +253,7 @@ For more information, see [Synthetic Monitoring notifications][9]. ## Record your steps -Tests can be only recorded from [Google Chrome][10] and [Microsoft Edge][18]. To record your test, download the [Datadog Record Test extension][11]. +Tests can be recorded from [Google Chrome][10]. To record your test, download the [Datadog Record Test extension][11]. Because Microsoft Edge is Chromium-based, you can also install the Chrome extension in Edge after you turn on **Allow extensions from other stores**. See Microsoft's [guide to adding extensions from other stores][18] for instructions. You can switch tabs in a browser test recording to perform an action on your application (such as clicking on a link that opens another tab) and add another test step. Your browser test must interact with the page first (through a click) before it can perform an [assertion][12]. By recording all of the test steps, the browser test can switch tabs automatically at test execution. @@ -387,5 +387,5 @@ Use [granular access control][17] to limit who has access to your test based on [15]: /account_management/rbac#custom-roles [16]: /account_management/rbac/#create-a-custom-role [17]: /account_management/rbac/granular_access -[18]: https://www.microsoft.com/edge +[18]: https://support.microsoft.com/en-us/edge/add-turn-off-or-remove-extensions-in-microsoft-edge [19]: /synthetics/guide/how-synthetics-monitors-trigger-alerts/ diff --git a/hugo/content/en/synthetics/goal_based_testing.md b/hugo/content/en/synthetics/goal_based_testing.md new file mode 100644 index 00000000000..3dab6b6d196 --- /dev/null +++ b/hugo/content/en/synthetics/goal_based_testing.md @@ -0,0 +1,83 @@ +--- +title: Goal-Based Testing +description: Verify that users can complete a goal in your application with prompted, non-deterministic, agentic Synthetic tests. +private: true +further_reading: +- link: "/synthetics/bits_testing/" + tag: "Documentation" + text: "Bits Testing" +- link: "/synthetics/browser_tests/" + tag: "Documentation" + text: "Browser Testing" +- link: "/synthetics/test_suites/" + tag: "Documentation" + text: "Test Suites" +- link: "https://www.datadoghq.com/pricing/?product=synthetic-monitoring#products" + tag: "Pricing" + text: "Synthetic Monitoring pricing" +--- + +{{< beta-callout url="https://www.datadoghq.com/product-preview/bits-testing/" >}} +Goal-Based Testing is in Preview. Request access to join the waiting list. +{{< /beta-callout >}} + +## Overview + +Goal-Based Testing is a Synthetic test type that uses prompted, non-deterministic, agentic testing to check that a user can reach a specific goal in your application. It's well suited to testing AI features and to validating critical user journeys that shouldn't require ongoing test maintenance. + +Unlike a browser test, a Goal-Based test doesn't follow a fixed, recorded set of steps. Instead, an agent explores your application, trying multiple paths toward the goal you describe. + +## Create a Goal-Based test + +You can create a Goal-Based test in two ways: + +- Let [Bits Testing][1] generate one automatically as part of a journey's test suite. +- Create one manually by clicking {{< ui >}}New Test{{< /ui >}} and selecting Goal-Based test. + +{{< img src="synthetics/goal_based_testing/goal_based_test_type_selection.png" alt="The New Synthetics Test dialog with Goal-Based Test selected" style="width:50%;" >}} + +When creating a Goal-Based test manually, provide: + +- A **starting URL** for the application under test. +- A **goal**, written as a prompt in plain language (for example, "Ask the support chatbot for a product recommendation"). +- A **location** to run the test from. See [supported locations](#supported-locations). +- Optionally, an [Agent Profile][2] to reuse variables such as login credentials. + +{{< img src="synthetics/goal_based_testing/goal_based_test_creation.png" alt="The New Goal-Based Test panel with starting URL and goal fields" style="width:60%;" >}} + +### Supported locations + +Goal-Based tests run only from the Datadog managed locations listed in [Run Bits Testing][4]. + +For pricing, see [Bits Testing billing][3]. + +## How Goal-Based Testing evaluates a run + +After you start a Goal-Based test, the agent explores your application from the starting URL, branching across the different paths a user might take toward the goal. + +When the run finishes, the test reports a **Pass** result if one of the explored branches reached the goal. It reports a **Fail** result if no branch reached the goal or the agent ran into an error. Alongside the result, Goal-Based Testing shows: + +- A summary explaining the rationale behind the Pass or Fail result. +- Step-by-step navigation through the actions the agent took, so you can review exactly what it tried. + +{{< img src="synthetics/goal_based_testing/goal_based_test_run_result.png" alt="A failed Goal-Based test run showing the explored paths, a rationale for the failure, and the final screenshot" style="width:100%;" >}} + +## Schedule and edit a test + +After the first run completes, click the {{< ui >}}Edit test{{< /ui >}} icon to: + +- Schedule the test to run on a recurring basis. +- Edit the test name. +- Add tags. +- Change the selected Agent Profile. + +{{< img src="synthetics/goal_based_testing/goal_based_test_schedule.png" alt="The Scheduling step of the Goal-Based test creation wizard, with recurrence interval options" style="width:80%;" >}} + +## Further reading + +{{< partial name="whats-next/whats-next.html" >}} + +[1]: /synthetics/bits_testing/ +[2]: /synthetics/bits_testing/#agent-profiles +[3]: /synthetics/bits_testing/#billing +[4]: /synthetics/bits_testing/#run-bits-testing diff --git a/hugo/content/es/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md b/hugo/content/es/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md deleted file mode 100644 index 26c93965eef..00000000000 --- a/hugo/content/es/security/cloud_siem/detect_and_monitor/custom_detection_rules/create_rule/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Crear una regla personalizada -type: multi-code-lang ---- diff --git a/hugo/customization_config/en/option_groups/cloud_siem_custom_detection_rules.yaml b/hugo/customization_config/en/option_groups/cloud_siem_custom_detection_rules.yaml new file mode 100644 index 00000000000..e83f83010d8 --- /dev/null +++ b/hugo/customization_config/en/option_groups/cloud_siem_custom_detection_rules.yaml @@ -0,0 +1,119 @@ +cloud_siem_detection_rule_detection_method_options: + - id: threshold + default: true + - id: new_value + - id: anomaly + - id: content_anomaly + - id: impossible_travel + - id: third_party + - id: sequence + - id: signal_correlation + +cloud_siem_detection_threshold_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_new_value_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_anomaly_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_content_anomaly_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_impossible_travel_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_third_party_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + - id: historical_job + +cloud_siem_detection_sequence_rule_type_options: + - id: real_time_rule + default: true + - id: historical_job + +cloud_siem_detection_signal_correlation_rule_type_options: + - id: real_time_rule + default: true + - id: scheduled_rule + +# Deprecated option lists from when users selected rule types before search query types + +# cloud_siem_detection_rule_type_options: +# - id: real_time_rule +# default: true +# - id: scheduled_rule +# - id: historical_job + +# cloud_siem_detection_real_time_rule_search_query_options: +# - id: threshold +# default: true +# - id: new_value +# - id: anomaly +# - id: content_anomaly +# - id: impossible_travel +# - id: third_party +# - id: sequence +# - id: signal_correlation + +# cloud_siem_detection_scheduled_rule_search_query_options: +# - id: threshold +# default: true +# - id: new_value +# - id: anomaly +# - id: content_anomaly +# - id: impossible_travel +# - id: third_party +# - id: signal_correlation + +# cloud_siem_detection_historical_job_search_query_options: +# - id: threshold +# default: true +# - id: new_value +# - id: anomaly +# - id: content_anomaly +# - id: impossible_travel +# - id: third_party + +# Deprecated language list from when it was static + +# cloud_siem_detection_rule_query_language_options: +# - id: event_query +# default: true +# - id: rule_query +# - id: sql + +cloud_siem_detection_rule_event_query_only_language_options: + - id: event_query + default: true + +cloud_siem_detection_threshold_sql_rule_query_language_options: + - id: event_query + default: true + - id: sql + +cloud_siem_detection_sequence_rule_query_language_options: + - id: event_rule_query + default: true + +cloud_siem_detection_signal_correlation_rule_query_language_options: + - id: rule_query + default: true \ No newline at end of file diff --git a/hugo/customization_config/en/options/general.yaml b/hugo/customization_config/en/options/general.yaml index ed461be77d7..8008d1cd914 100644 --- a/hugo/customization_config/en/options/general.yaml +++ b/hugo/customization_config/en/options/general.yaml @@ -519,6 +519,48 @@ options: - label: Elixir id: elixir +- id: real_time_rule + label: Real-time rule + +- id: scheduled_rule + label: Scheduled rule + +- id: historical_job + label: Historical job + +- id: new_value + label: New value + +- id: anomaly + label: Anomaly + +- id: content_anomaly + label: Content anomaly + +- id: impossible_travel + label: Impossible travel + +- id: third_party + label: Third party + +- id: signal_correlation + label: Signal correlation + +- id: sequence + label: Sequence + +- id: event_query + label: Event query + +- id: rule_query + label: Rule query + +- id: event_rule_query + label: Event/rule query + +- id: sql + label: SQL + - label: BigQuery id: bigquery @@ -548,4 +590,3 @@ options: - label: ECS Fargate id: ecs_fargate - \ No newline at end of file diff --git a/hugo/customization_config/en/traits/general.yaml b/hugo/customization_config/en/traits/general.yaml index 0b8a359844e..11ff4daf0bb 100644 --- a/hugo/customization_config/en/traits/general.yaml +++ b/hugo/customization_config/en/traits/general.yaml @@ -53,6 +53,41 @@ traits: type: text internal_notes: For example, HTTP, gRPC, or SOCKS. +- id: cloud_siem_detection_rule_type + label: "Rule type" + type: text + internal_notes: The rule type a user wants to use when creating a custom detection rule for Cloud SIEM. + +- id: cloud_siem_detection_rule_detection_method + label: "Detection method" + type: text + internal_notes: The detection method a user wants to use when creating a custom detection rule for Cloud SIEM. + +- id: cloud_siem_detection_rule_query_language + label: "Query language" + type: text + internal_notes: The search query language a user wants to use when creating a custom detection rule for Cloud SIEM. + +- id: cloud_siem_detection_threshold_rule_query_language + label: "Query language" + type: text + internal_notes: The search query language a user wants to use when creating a custom detection rule for Cloud SIEM, when the search query type is threshold AND the rule type is real-time rule. + +- id: cloud_siem_detection_threshold_sql_rule_query_language + label: "Query language" + type: text + internal_notes: The search query language a user wants to use when creating a custom detection rule for Cloud SIEM, when the search query type is threshold AND the rule type is either scheduled rule or historical job. + +- id: cloud_siem_detection_sequence_rule_query_language + label: "Query language" + type: text + internal_notes: The search query language a user wants to use when creating a custom detection rule for Cloud SIEM, when the search query type is sequence. + +- id: cloud_siem_detection_signal_correlation_rule_query_language + label: "Query language" + type: text + internal_notes: The search query language a user wants to use when creating a custom detection rule for Cloud SIEM, when the search query type is signal correlation. + - id: interface label: Interface type: text diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_calculated_fields.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_calculated_fields.mdoc.md new file mode 100644 index 00000000000..64a26868371 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_calculated_fields.mdoc.md @@ -0,0 +1,7 @@ +1. Click **Add** and select **Calculated fields**. +1. In **Name your field**, enter a descriptive name that indicates the purpose of the calculated field. + - For example, if you want to combine users' first and last name into one field, you might name the calculated field `fullName`. +1. In the **Define your formula** field, enter a formula or expression, which determines the result to be computed and stored as the value of the calculated field for each log event. + - See [Calculated Fields Expressions Language][701] for information on syntax and language constructs. + +[701]: /logs/explorer/calculated_fields/expression_language/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_reference_tables.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_reference_tables.mdoc.md new file mode 100644 index 00000000000..456af4831c6 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/add_reference_tables.mdoc.md @@ -0,0 +1,5 @@ +1. Click the **Add** button next to the query editor and select **Join with Reference Table**. +1. In the **Inner join with reference table** dropdown menu, select your reference table. +1. In the **where field** dropdown menu, select the log field to join on. +1. Select the **IN** or **NOT IN** operator to filter in or filter out matching logs. +1. In the **column** dropdown menu, select the column of the reference table to join on. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/anomaly_query.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/anomaly_query.mdoc.md new file mode 100644 index 00000000000..3bcfe369467 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/anomaly_query.mdoc.md @@ -0,0 +1,6 @@ +1. (Optional) In the **Count** dropdown menu, select attributes whose unique values you want to count during the specified time frame. +1. (Optional) In the **group by** dropdown menu, select attributes you want to group by. + - The defined `group by` generates a signal for each `group by` value. + - Typically, the `group by` is an entity (like user or IP). The `group by` can also join the queries together. + - Joining logs that span a time frame can increase the confidence or severity of the security signal. For example, if you want to detect a successful brute force attack, both successful and unsuccessful authentication logs must be correlated for a user. + - Anomaly detection inspects how the `group by` attribute has behaved in the past. If a `group by` attribute is seen for the first time (for example, the first time an IP is communicating with your system) and is anomalous, it does not generate a security signal because the anomaly detection algorithm has no historical data to compare with. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_options.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_options.mdoc.md new file mode 100644 index 00000000000..526934f87ff --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_options.mdoc.md @@ -0,0 +1,9 @@ +In the **Content anomaly detection options** section, specify the parameters to assess whether a log is anomalous or not. +- Content anomaly detection balances precision and sensitivity using several rule parameters that you can set: + 1. Similarity threshold: Defines how dissimilar a field value must be to be considered anomalous (default: `70%`). + 1. Minimum similar items: Sets how many similar historical logs must exist for a value to be considered normal (default: `1`). + 1. Evaluation window: The time frame during which anomalies are counted toward a signal (for example, a 10-minute time frame). +- These parameters help to identify field content that is both unusual and rare, filtering out minor or common variations. +- See [Anomaly detection parameters][501] for more information. + +[501]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/content_anomaly/#anomaly-detection-parameters \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_query.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_query.mdoc.md new file mode 100644 index 00000000000..85b70cc1558 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/content_anomaly_query.mdoc.md @@ -0,0 +1,9 @@ +1. In the **Detect anomaly** field, specify the fields whose values you want to analyze. +1. In the **group by** field, specify the fields you want to group by. + - The defined `group by` generates a signal for each `group by` value. + - Typically, the `group by` is an entity (like user or IP). The `group by` can also join the queries together. + - Joining logs that span a time frame can increase the confidence or severity of the security signal. For example, to detect a successful brute force attack, both successful and unsuccessful authentication logs must be correlated for a user. +1. In the **Learn for** dropdown menu, select the number of days for the learning period. During the learning period, the rule sets a baseline of normal field values and does not generate any signals. + {% alert level="info" %} + If the detection rule is modified, the learning period restarts at day `0`. + {% /alert %} \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/create_suppression.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/create_suppression.mdoc.md new file mode 100644 index 00000000000..f1190d716b6 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/create_suppression.mdoc.md @@ -0,0 +1,16 @@ +(Optional) Create a suppression or add the rule to an existing suppression to prevent a signal from being generated in specific cases. For example, if a user `john.doe` is triggering a signal, but their actions are benign and you do not want signals triggered from this user, add the following query into the **Add a suppression query** field: `@user.username:john.doe`. + +### Create new suppression + +1. Enter a name for the suppression rule. +1. (Optional) Enter a description. +1. Enter a suppression query. +1. (Optional) Add a log exclusion query to exclude logs from being analyzed. These queries are based on **log attributes**. + {% alert level="info" %} + The legacy suppression was based on log exclusion queries, but it is now included in the suppression rule's **Add a suppression query** step. + {% /alert %} + +### Add to existing suppression + +1. Click **Add to Existing Suppression**. +1. Select an existing suppression in the dropdown menu. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_decrease_severity.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_decrease_severity.mdoc.md new file mode 100644 index 00000000000..b1a74c12216 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_decrease_severity.mdoc.md @@ -0,0 +1,3 @@ +Toggle **Decrease severity for non-production environments** if you want to prioritize production environment signals over non-production signals. +- The severity of signals in non-production environments are decreased by one level from what is defined by the rule case. +- The severity decrement is applied to signals with an environment tag starting with `staging`, `test`, or `dev`. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_group_by.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_group_by.mdoc.md new file mode 100644 index 00000000000..de2dc425349 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_group_by.mdoc.md @@ -0,0 +1 @@ +Toggle the **Enable Optional Group By** section if you want to group events even when values are missing. If there is a missing value, a sample value is generated so that the log does not get excluded. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_instantaneous_baseline.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_instantaneous_baseline.mdoc.md new file mode 100644 index 00000000000..56053329805 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/enable_instantaneous_baseline.mdoc.md @@ -0,0 +1 @@ +Toggle **Enable instantaneous baseline** if you want to build the baseline based on past events for the first event received. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/forget_value.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/forget_value.mdoc.md new file mode 100644 index 00000000000..dce4300332b --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/forget_value.mdoc.md @@ -0,0 +1 @@ +In the **Forget Value** dropdown, select the number of days (**1**-**30 days**) after which the value is forgotten. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/group_signals.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/group_signals.mdoc.md new file mode 100644 index 00000000000..63a64d73adb --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/group_signals.mdoc.md @@ -0,0 +1 @@ +Toggle **Group signals** if you want to reduce the number of signals generated. Then, select one or more groups for which you want to generate one security signal each. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/impossible_travel_query.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/impossible_travel_query.mdoc.md new file mode 100644 index 00000000000..9164a42e2a9 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/impossible_travel_query.mdoc.md @@ -0,0 +1,10 @@ +1. In the **User attribute** dropdown menu, select the log attribute that contains the user ID. This can be an identifier like an email address, user name, or account identifier. +1. The **Location attribute** value is automatically set to `@network.client.geoip`. + - The `location attribute` specifies which field holds the geographic information for a log. + - The only supported value is `@network.client.geoip`, which is enriched by the [GeoIP parser][801] to give a log location information based on the client's IP address. +1. Select the **Baseline user locations** checkbox if you want Datadog to learn regular access locations before triggering a signal. + - When selected, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. + - See [How the impossible detection method works][802] for more information. + +[801]: /logs/log_configuration/processors/?tab=ui#geoip-parser +[802]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/impossible_travel/#how-the-impossible-travel-method-works \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/job_multi_triggering.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/job_multi_triggering.mdoc.md new file mode 100644 index 00000000000..d2e3674dab9 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/job_multi_triggering.mdoc.md @@ -0,0 +1,7 @@ +In the **Job multi-triggering behavior** section, configure how often to keep updating the same signal when new values are detected within a specified time frame. For example, the same signal updates when any new value is detected within 1 hour, for a maximum duration of 24 hours. +- An `evaluation window` defines a sliding period in which at least one case evaluates as true and assesses cases in real time. +- After a signal is generated, the signal remains "open" if a case is matched at least once within the `keep alive` window. Each time a new event matches any of the cases, the *last updated* timestamp is updated for the signal. +- A signal closes after the time exceeds the `maximum signal duration`, regardless of the query being matched. This time is calculated from the first seen timestamp. +{% alert level="info" %} +The `evaluation window` must be less than or equal to the `keep alive` and `maximum signal duration`. +{% /alert %} \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/new_value_query.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/new_value_query.mdoc.md new file mode 100644 index 00000000000..9c3c2550f0c --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/new_value_query.mdoc.md @@ -0,0 +1,12 @@ +1. In the **Detect new value** dropdown menu, select the attributes you want to detect. + - For example, you can create a query for successful user authentication with the following settings: + - **Detect new value** is `country` + - **group by** is `user` + - Learning duration is `after 7 days` + {% br /%}Then, logs coming in over the next 7 days are evaluated with those configured values. If a log comes in with a new value after the learning duration (`7 days`), a signal is generated, and the new value is learned to prevent future signals with this value. + - You can also identify users and entities using multiple **Detect new value** attributes in a single query. + - For example, if you want to detect when a user signs in from a new device and from a country that they've never signed in from before, add `device_id` and `country_name` to the **Detect new value** field. +1. (Optional) Define a signal grouping in the **group by** dropdown menu. + - The defined `group by` generates a signal for each `group by` value. + - Typically, the `group by` is an entity (like user or IP address). +1. In the dropdown menu to the right of **group by**, select the learning duration. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering.mdoc.md new file mode 100644 index 00000000000..02c4657162f --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering.mdoc.md @@ -0,0 +1,7 @@ +Configure how often you want to keep updating the same signal if new values are detected within a specified time frame. For example, the same signal updates if any new value is detected within 1 hour, for a maximum duration of 24 hours. +- An `evaluation window` is specified to match when at least one of the cases matches true. This is a sliding window and evaluates cases in real time. +- After a signal is generated, the signal remains "open" if a case is matched at least once within the `keep alive` window. Each time a new event matches any of the cases, the *last updated* timestamp is updated for the signal. +- A signal closes after the time exceeds the `maximum signal duration`, regardless of the query being matched. This time is calculated from the first seen timestamp. +{% alert level="info" %} +The `evaluation window` must be less than or equal to the `keep alive` and `maximum signal duration`. +{% /alert %} \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md new file mode 100644 index 00000000000..a21207effea --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/rule_multi_triggering_content_anomaly.mdoc.md @@ -0,0 +1,6 @@ +Configure how often you want to keep updating the same signal if new values are detected within a specified time frame. For example, the same signal updates if any new value is detected within 1 hour, for a maximum duration of 24 hours. +- After a signal is generated, the signal remains "open" if a case is matched at least once within the `keep alive` window. Each time a new event matches any of the cases, the *last updated* timestamp is updated for the signal. +- A signal closes after the time exceeds the `maximum signal duration`, regardless of the query being matched. This time is calculated from the first seen timestamp. +{% alert level="info" %} +The `evaluation window` must be less than or equal to the `keep alive` and `maximum signal duration`. +{% /alert %} \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/security-rule-say-whats-happening.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/security-rule-say-whats-happening.mdoc.md new file mode 100644 index 00000000000..55204b52872 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/security-rule-say-whats-happening.mdoc.md @@ -0,0 +1,11 @@ +1. Enter a **Rule name**. The name appears in the detection rules list view and the title of the security signal. +1. In the **Rule message** section, use [notification variables][201] and Markdown to customize the notifications sent when a signal is generated. + - You can use [template variables][202] in the notification to inject dynamic context from triggered logs directly into a security signal and its associated notifications. + - See the [Notification Variables documentation][201] for more information and examples. +1. Use the **Tag resulting signals** dropdown menu to add tags to your signals. For example, `security:attack` or `technique:T1110-brute-force`. + {% alert level="info" %} + The tag `security` is special. This tag is used to classify the security signal. The recommended options are `attack`, `threat-intel`, `compliance`, `anomaly`, and `data-leak`. + {% /alert %} + +[201]: /security_platform/notifications/variables/ +[202]: /security_platform/notifications/variables/#template-variables \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_anomaly.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_anomaly.mdoc.md new file mode 100644 index 00000000000..37a57a9dde4 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_anomaly.mdoc.md @@ -0,0 +1,8 @@ +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. In the **Anomaly Percentile** dropdown menu, select a minimum percentage required for Cloud SIEM to generate a signal.{% br /%}The anomaly percentile refers to the log volume over the selected time period in comparison to your historical log volumes. If you select 99.5%, then Cloud SIEM only generates a signal if the number of logs for the current period is greater than 99.5% of all prior periods. +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][101]. + - You can create [notification rules][102] to manage notifications automatically, avoiding manual edits for each detection rule. + + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_content_anomaly.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_content_anomaly.mdoc.md new file mode 100644 index 00000000000..dcbca156ae4 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_content_anomaly.mdoc.md @@ -0,0 +1,17 @@ +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. In the **Anomaly count** field, enter the condition for how many anomalous logs within the specified window are required to trigger a signal. + - For example, if the condition is `a >= 3` where `a` is the query, a signal is triggered if there are at least three anomalous logs within the evaluation window. + - All rule conditions are evaluated as condition statements. Thus, the order of the conditions affects which notifications are sent because the first condition to match generates the signal. Click and drag your rule conditions to change their ordering. + - A rule condition contains logical operations (`>`, `>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. + - The ASCII lowercase query labels are referenced in this section. An example rule condition for query `a` is `a > 3`. + {% alert level="info" %} + The query label must precede the operator. For example, `a > 3` is allowed; `3 < a` is not allowed. + {% /alert %} +1. In the **within a window of** dropdown menu, select the time period during which a signal is triggered if the condition is met. + - An `evaluation window` is specified to match when at least one of the cases matches true. This is a sliding window and evaluates cases in real time. +1. In the **And notify** section, click **Add Recipient** to optionally configure [notification targets][101]. + - You can also create [notification rules][102] to avoid manual edits to notification preferences for individual detection rules. + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_severity_notify_only.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_severity_notify_only.mdoc.md new file mode 100644 index 00000000000..6aa498b0b70 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_severity_notify_only.mdoc.md @@ -0,0 +1,7 @@ +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][101]. + - You can create [notification rules][102] to manage notifications automatically, avoiding manual edits for each detection rule. + + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_then_operator.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_then_operator.mdoc.md new file mode 100644 index 00000000000..f0532d5b422 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_then_operator.mdoc.md @@ -0,0 +1,19 @@ +1. If you want to create a simple condition, leave the selection as is. If you want to create a `then` condition, click **THEN condition**. + - Use the **Then condition** when you want to trigger a signal if query A occurs and then query B occurs. + {% alert level="info" %} + The `then` operator can only be used on a single rule condition. + {% /alert %} +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. If you are creating a **Simple condition**, enter the condition when a signal should be created. If you are creating a **Then condition**, enter the conditions required for a signal to be generated. + - All rule conditions are evaluated as conditional statements. Thus, the order of the conditions affects which notifications are sent because the first condition to match generates the signal. Click and drag your rule conditions to change their order. + - A rule condition contains logical operations (`>`, `>=`, `<`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. + - The ASCII lowercase query labels are referenced in this section. An example rule condition for query `a` is `a > 3`. + {% alert level="info" %} + The query label must precede the operator. For example, `a > 3` is allowed; `3 < a` is not allowed. + {% /alert %} +1. In the **And notify** section, click **Add Recipient** to optionally configure [notification targets][101]. + - You can create [notification rules][102] to manage notifications automatically, avoiding manual edits for each detection rule. + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_third_party.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_third_party.mdoc.md new file mode 100644 index 00000000000..0d1f0cd0f49 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_third_party.mdoc.md @@ -0,0 +1,11 @@ +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. In the **Query** field, enter the tags of a log that you want to trigger a signal. + - For example, if you want logs with the tag `dev:demo` to trigger signals with a severity of `INFO`, enter `dev:demo` in the query field. Similarly, if you want logs with the tag `dev:prod` to trigger signals with a severity of `MEDIUM`, enter `dev:prod` in the query field. +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][101]. + - You can also create [notification rules][102] to avoid manual edits to notification preferences for individual detection rules. +1. For the `else` condition, follow steps 3 and 4. + - The `else` condition is the default condition. If you don't add any other conditions, then all logs trigger a signal with the severity set in the default condition. + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_threshold.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_threshold.mdoc.md new file mode 100644 index 00000000000..e9d7bb392b4 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/set_conditions_threshold.mdoc.md @@ -0,0 +1,21 @@ +1. If you have a single query, skip to step 2. If you have multiple queries, you can create a **Simple condition** or **Then condition**. + - If you want to create a **simple** condition, leave the selection as is. + - If you want to create a **then** condition, click **THEN condition**. + - Use the **Then condition** when you want to trigger a signal if query A occurs and then query B occurs. + {% alert level="info" %} + The `then` operator can only be used on a single rule condition. + {% /alert %} +1. (Optional) Click the pencil icon next to **Condition 1** if you want to rename the condition. This name is appended to the rule name when a signal is generated. +1. In the **Set severity to** dropdown menu, select the appropriate severity level (`INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). +1. If you are creating a **Simple condition**, enter the condition when a signal should be created. If you are creating a **Then condition**, enter the conditions required for a signal to be generated. + - All rule conditions are evaluated as condition statements. Thus, the order of the conditions affects which notifications are sent because the first condition to match generates the signal. Click and drag your rule conditions to change their order. + - A rule condition contains logical operations (`>`, `>=`, `<`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries. + - The ASCII lowercase query labels are referenced in this section. An example rule condition for query `a` is `a > 3`. + {% alert level="info" %} + The query label must precede the operator. For example, `a > 3` is allowed; `3 < a` is not allowed. + {% /alert %} +1. (Optional) In the **And notify** section, click **Add Recipient** to configure [notification targets][101]. + - You can also create [notification rules][102] to avoid manual edits to notification preferences for individual detection rules. + +[101]: /security_platform/notifications/#notification-channels +[102]: /security/notifications/rules/ \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/threshold_query.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/threshold_query.mdoc.md new file mode 100644 index 00000000000..443d9fddb6b --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/threshold_query.mdoc.md @@ -0,0 +1,5 @@ +1. (Optional) In the **Count** dropdown menu, select attributes whose unique values are counted over the specified time frame. +1. (Optional) In the **group by** dropdown menu, select attributes you want to group by. + - The defined `group by` generates a signal for each `group by` value. + - Typically, the `group by` is an entity (like user, or IP). The `group by` is also used to join the queries together. + - Joining logs that span a time frame can increase the confidence or severity of the security signal. For example, to detect a successful brute force attack, both successful and unsuccessful authentication logs must be correlated for a user. \ No newline at end of file diff --git a/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/unit_testing.mdoc.md b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/unit_testing.mdoc.md new file mode 100644 index 00000000000..6697e013363 --- /dev/null +++ b/hugo/layouts/shortcodes/mdoc/en/security/cloud_siem/unit_testing.mdoc.md @@ -0,0 +1,10 @@ +1. To construct a sample log, you can: + 1. Navigate to [Log Explorer][601] in a new window. + 1. In the search bar, enter the query you are using for the detection rule. + 1. Select one of the logs. + 1. Click the export button at the top right side of the log side panel, and then select **Copy**. +1. Navigate back to the **Unit Test** modal, and then paste the log into the text box. Edit the sample as needed for your use case. +1. Toggle the switch for **Query is expected to match based on the example event** to fit your use case. +1. Click **Run Query Test**. + +[601]: https://app.datadoghq.com/logs \ No newline at end of file diff --git a/hugo/static/images/security/security_monitoring/detection_rules/anomaly_notification.png b/hugo/static/images/security/security_monitoring/detection_rules/anomaly_notification.png new file mode 100644 index 00000000000..63380a6cd81 Binary files /dev/null and b/hugo/static/images/security/security_monitoring/detection_rules/anomaly_notification.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_agent_profile_modal.png b/hugo/static/images/synthetics/bits_testing/bits_testing_agent_profile_modal.png new file mode 100644 index 00000000000..183c1180c0d Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_agent_profile_modal.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_exploration_in_progress.png b/hugo/static/images/synthetics/bits_testing/bits_testing_exploration_in_progress.png new file mode 100644 index 00000000000..f81218ea718 Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_exploration_in_progress.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_generated_suite.png b/hugo/static/images/synthetics/bits_testing/bits_testing_generated_suite.png new file mode 100644 index 00000000000..f92c40549af Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_generated_suite.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_landing.png b/hugo/static/images/synthetics/bits_testing/bits_testing_landing.png new file mode 100644 index 00000000000..f3be1eb5c58 Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_landing.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_nav_and_prompt.png b/hugo/static/images/synthetics/bits_testing/bits_testing_nav_and_prompt.png new file mode 100644 index 00000000000..cb1dcc7cd91 Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_nav_and_prompt.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_results_graph.png b/hugo/static/images/synthetics/bits_testing/bits_testing_results_graph.png new file mode 100644 index 00000000000..271fbe567d0 Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_results_graph.png differ diff --git a/hugo/static/images/synthetics/bits_testing/bits_testing_run_config.png b/hugo/static/images/synthetics/bits_testing/bits_testing_run_config.png new file mode 100644 index 00000000000..928de460a24 Binary files /dev/null and b/hugo/static/images/synthetics/bits_testing/bits_testing_run_config.png differ diff --git a/hugo/static/images/synthetics/goal_based_testing/goal_based_test_creation.png b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_creation.png new file mode 100644 index 00000000000..830849a7979 Binary files /dev/null and b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_creation.png differ diff --git a/hugo/static/images/synthetics/goal_based_testing/goal_based_test_run_result.png b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_run_result.png new file mode 100644 index 00000000000..2a74c390657 Binary files /dev/null and b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_run_result.png differ diff --git a/hugo/static/images/synthetics/goal_based_testing/goal_based_test_schedule.png b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_schedule.png new file mode 100644 index 00000000000..ad816075f1d Binary files /dev/null and b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_schedule.png differ diff --git a/hugo/static/images/synthetics/goal_based_testing/goal_based_test_type_selection.png b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_type_selection.png new file mode 100644 index 00000000000..a208b63e354 Binary files /dev/null and b/hugo/static/images/synthetics/goal_based_testing/goal_based_test_type_selection.png differ