Skip to content

Commit 92e0370

Browse files
authored
Add note for dynamic severity (#5968)
1 parent 1de9bf4 commit 92e0370

File tree

3 files changed

+7
-0
lines changed

3 files changed

+7
-0
lines changed

docs/cse/rules/write-aggregation-rule.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ description: Learn how to write an aggregation rule.
77

88
import useBaseUrl from '@docusaurus/useBaseUrl';
99
import CseRule from '../../reuse/cse-rule-description-links.md';
10+
import CseDynamicSeverity from '../../reuse/cse-dynamic-severity.md';
1011
import Iframe from 'react-iframe';
1112

1213
This topic has information about Cloud SIEM aggregation rules and how to write them.
@@ -107,6 +108,7 @@ On the right side of the Rules Editor, in the **Then Create a Signal** section,
107108
1. The severity area updates.
108109
1. **severity of**. Use the pulldown to select a default severity value.
109110
1. **for the record field**. Use the down arrows to display a list of fields, and select one. The dynamic severity will be based on the value of (or existence of) that field in the record that matched the rule expression.
111+
<CseDynamicSeverity/>
110112
1. The **Add More Mappings** option appears. <br/><img src={useBaseUrl('img/cse/add-more-mappings.png')} alt="Add More Mappings option" style={{border: '1px solid gray'}} width="450"/>
111113
1. **Click Add More Mappings**. (Optional) You can define additional mappings if desired. If you don’t, the severity value will be the value of the record field you selected above.
112114
1. The **if the value is** option appears.<br/><img src={useBaseUrl('img/cse/if-the-value-is.png')} alt="If the Value Is option" style={{border: '1px solid gray'}} width="450"/>

docs/cse/rules/write-match-rule.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ description: Learn how to write a match rule.
77

88
import useBaseUrl from '@docusaurus/useBaseUrl';
99
import CseRule from '../../reuse/cse-rule-description-links.md';
10+
import CseDynamicSeverity from '../../reuse/cse-dynamic-severity.md';
1011
import Iframe from 'react-iframe'; 
1112

1213
This topic has information about match rules and how to create them in the Cloud SIEM UI.
@@ -87,6 +88,7 @@ Watch this micro lesson to learn how to create a match rule.
8788
1. The severity area updates.
8889
1. **severity of**. Use the pulldown to select a default severity value.
8990
1. **for the record field**. Use the down arrows to display a list of fields, and select one. The dynamic severity will be based on the value of (or existence of) that field in the record that matched the rule expression.
91+
<CseDynamicSeverity/>
9092
1. The **Add More Mappings** option appears. <br/><img src={useBaseUrl('img/cse/add-more-mappings.png')} alt="Add More Mappings option" style={{border: '1px solid gray'}} width="300"/>
9193
1. Click **Add More Mappings**. (Optional) You can define additional mappings if desired. If you don’t, the severity value will be the value of the record field you selected above.
9294
1. The **if the value is** option appears.<br/><img src={useBaseUrl('img/cse/if-the-value-is.png')} alt="If the Value is Option.png" style={{border: '1px solid gray'}} width="300"/>

docs/reuse/cse-dynamic-severity.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
:::note
2+
When configuring dynamic severity, you must select a record field that is numeric. If you select a non-numeric field, severity does not return a numeric value, and no signal fires.
3+
:::

0 commit comments

Comments
 (0)