Skip to content

Commit b5c6ea7

Browse files
authored
Update entity types list (#6100)
1 parent 521b652 commit b5c6ea7

File tree

2 files changed

+4
-21
lines changed

2 files changed

+4
-21
lines changed

docs/cse/records-signals-entities-insights/create-custom-entity-type.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ This topic has instructions for how to create custom entity types in Cloud SIEM.
1111

1212
In Cloud SIEM, *entities* are fundamental to the insight generation process. When a Cloud SIEM rule fires, it generates a signal for each “on-entity” attribute configured for the rule. Cloud SIEM correlates signals by entity to create insights. This process is described in the [Insight Generation Process](/docs/cse/get-started-with-cloud-siem/insight-generation-process/) topic.
1313

14-
Cloud SIEM has a number of built-in [entity types](/docs/cse/records-signals-entities-insights/view-manage-entities#about-entities), for example, IP Address, Hostname, and Username.
14+
Cloud SIEM has a number of built-in entity types, for example, IP address, hostname, and username. For a list of fields that Cloud SIEM considers entities and the entity types they map to, see [Schema: Entity Fields](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/schema/entity_fields.md) in the Cloud SIEM Content Catalog.
1515

1616
When you create a rule, in the signal configuration section, the rules editor prompts you to select an “on-entity” attribute from a list of all of the Cloud SIEM schema attributes that hold entities. What if you want to correlate signals by something other than an item that is one of Cloud SIEM standard entity types? That’s what custom entity types are for.
1717

docs/cse/records-signals-entities-insights/view-manage-entities.md

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -37,29 +37,12 @@ Watch this micro lesson to learn more about entities.
3737

3838
## About entities
3939

40-
In Cloud SIEM, an entity is a unique actor that a signal fired upon. Cloud SIEM has a number of [built-in entity types](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/schema/entity_fields.md):
41-
42-
* Command
43-
* Deployment
44-
* Domain
45-
* Email
46-
* File
47-
* Hash
48-
* Hostname
49-
* IP Address
50-
* MAC Address
51-
* Pod
52-
* Process
53-
* Replica Set
54-
* Resource
55-
* URL
56-
* User Agent
57-
* Username
58-
59-
You can create custom entity types as well. For more information, see [Create a Custom Entity Type](/docs/cse/records-signals-entities-insights/create-custom-entity-type/).
40+
In Cloud SIEM, an entity is a unique actor that a signal fired upon, for example, IP address, hostname, or username.
6041

6142
When a signal is fired, if an entity doesn’t already exist in Cloud SIEM for the item that the signal fired on, Cloud SIEM creates an entity for it. For more information about entities and signal and insight generation, see [Insight Generation Process](/docs/cse/get-started-with-cloud-siem/insight-generation-process).
6243

44+
For a list of fields that Cloud SIEM considers entities and the entity types they map to, see [Schema: Entity Fields](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/schema/entity_fields.md) in the Cloud SIEM Content Catalog. To create custom entity types, see [Create a Custom Entity Type](/docs/cse/records-signals-entities-insights/create-custom-entity-type/).
45+
6346
:::note
6447
Entity names have a limit of 512 characters. If an entity's name value is 512 characters or longer, the system discards the log, and as a result, no signal is generated.
6548
:::

0 commit comments

Comments
 (0)