{"type":"doc","content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Severity Resources & Threat Breakdown","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Severity Resources & Threat Breakdown","type":"text","marks":[{"type":"strong"}]},{"text":" report provides visualization broken by Severity and Threat Category for resources. Most inner group shows the severity; middle circle reflect the assets and severity; the outer circle show the Threat category. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"example visualization","id":"17bb61b5-67ef-4124-970d-bb6531ce1bfc","collection":"contentId-3519583108","type":"file","height":425}}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AMP, go to the ","type":"text"},{"text":"Log Search ","type":"text","marks":[{"type":"strong"}]},{"text":"screen to access ChaosSearch.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click on ","type":"text"},{"text":"Visualizations","type":"text","marks":[{"type":"strong"}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":300,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":423,"alt":"chaossearch nav menu","id":"5816b290-63d6-461c-a462-6b20ca1faf1b","collection":"contentId-3519583108","type":"file","height":302}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Create new visualization ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"create new visualization","id":"b48edcf9-a9a8-4c39-ac03-08863b1145d0","collection":"contentId-3519583108","type":"file","height":96}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the New Visualization pop up, select the ","type":"text"},{"text":"Pie ","type":"text","marks":[{"type":"strong"}]},{"text":"visualization option.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":300,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":300,"alt":"select pie visualization","id":"93a64946-8698-4f79-99a1-1683b487db38","collection":"contentId-3519583108","type":"file","height":239}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Choose a source","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"id":"39761596-60d4-4bd7-9a02-ed1034d9a1a9","collection":"contentId-3519583108","type":"file","height":150}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"Log Search will refresh to display the query screen. From here, the visualization can be configured.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":400,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"visualization editor","id":"7c300274-c170-48fd-b531-0e77ac6bcf40","collection":"contentId-3519583108","type":"file","height":324}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"Click ","type":"text"},{"text":"Add filter.","type":"text","marks":[{"type":"strong"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":400,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"add filter button","id":"de99eebf-6eb4-4b47-94d2-15fe107019ff","collection":"contentId-3519583108","type":"file","height":322}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Populate the following filters (Case sensitive):","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

Field	Operator	Value	Note
type	is	carbon-black
event.type	is one of	WATCHLIST, CB_ANALYTICS
Data_type	Is	armor-security-logs
event.severity	Is one of	8, 9, 10	Optional if you want to filter higher severities

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Operator","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Note","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"is","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"carbon-black","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"event.type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"is one of","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"WATCHLIST, CB_ANALYTICS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Data_type","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Is","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"armor-security-logs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"event.severity","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Is one of","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"8, 9, 10","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Optional if you want to filter higher severities","type":"text"}]}]}]}]}],"version":1},"reason":"A table in list item can't be created or edited in the new editor."}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"Two buckets are needed to configure this visualization. Under Buckets, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button, making sure to select ","type":"text"},{"text":"split slices","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"In the Aggregation drop down, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"In the ","type":"text"},{"text":"Field ","type":"text","marks":[{"type":"strong"}]},{"text":"box, enter \"event.severity\" or search for it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"Order by, Order and Size should all remain with their default values. Properly configured, the first bucket will look like the screenshot below:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":300,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":318,"id":"1c70d253-aae6-4964-958c-b5aea4068b7c","collection":"contentId-3519583108","type":"file","height":728}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To add the second bucket, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button underneath Buckets, making sure to select ","type":"text"},{"text":"split slices","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Sub aggregation dropdown, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Field, enter \"external_id\" to select it. (External Id is the same as CoreInstanceId)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":300,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":330,"alt":"bucket configuration","id":"1783eb48-788b-48e6-9eba-8a1de3519438","collection":"contentId-3519583108","type":"file","height":733}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To add the second bucket, click the ","type":"text"},{"text":"Add ","type":"text","marks":[{"type":"strong"}]},{"text":"button underneath Buckets, making sure to select ","type":"text"},{"text":"split slices","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Sub aggregation dropdown, select ","type":"text"},{"text":"Terms","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Field, enter \"threat.blocked_threat_category\" to select it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Order by, Order and Size will be set to default. Properly configured, the second bucket will look like the screenshot below:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":328,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":328,"alt":"bucket configuration","id":"0bd27c22-d3df-4b22-882a-a9eca16759e5","collection":"contentId-3519583108","type":"file","height":725}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Optional step if you like to display labels, click Options tab:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":300,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":441,"id":"c54c7172-9aa3-4672-b56d-9ec5c7f6ba49","collection":"contentId-3519583108","type":"file","height":790}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When both buckets are configured, click the ","type":"text"},{"text":"Apply Changes ","type":"text","marks":[{"type":"strong"}]},{"text":"button.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":624,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"apply changes button","id":"4f6607a4-a578-4f7d-8a39-2e2aac08f32a","collection":"contentId-3519583108","type":"file","height":133}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the date range for the visualization.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the range encompasses more than one report, an additional filter with the report id can be added.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":608,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":608,"alt":"date range filter","id":"6b87330a-7c73-4239-8a2a-1ab272091cca","collection":"contentId-3519583108","type":"file","height":68}}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the visualization by clicking ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"in the top left of the screen.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":624,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"alt":"save button","id":"64506ef3-f455-415a-b9f4-cc2b9b170573","collection":"contentId-3519583108","type":"file","height":215}}]},{"type":"paragraph","content":[{"text":"Users can view previous visualizations by clicking ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Visualizations ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":"and selecting the desired visualization from the list.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}