Skip to main content

Alerts & Actions

A Security Information and Event Management (SIEM) system relies on various security services to generate audit and security logs. These logs encompass a wide range of data sources, including firewall logs, Endpoint Detection and Response (EDR) audit data, EDR alerts, and network flow data. Each of these services is considered a "data source" within the SIEM framework.

Events and Cases​

In the Fluency environment, an event can be seen as a building block of security analysis. When multiple events form a pattern or indicate a potential security concern, they are grouped together into what the platform calls a "case". In Fluency, a case consists of notable events with significant RiskScore, helping security analysts prioritize and respond to potential threats effectively.

Cases are listed on the Overview Summary page (SIEM → Overview Summary).

Understanding "state": the concept of "state" in the SIEM context refers to the relationship between similar events, as well as their relation to all events and the user-entity (UE). By understanding the state of events, analysts can better discern patterns, anomalies, and potential threats within the system.

Generating Notable Events​

Notable events are generated through the analysis of data collected from various sources. These events can take several forms:

  • Notification: An event that occurred and requires attention.
  • Alert: An event that demands immediate response due to its severity.
  • Action: An event that denotes an interaction with data or a change in system state.
  • Summary: A collection of properties of the system over a specific time period.
  • Metric: A summary message with consistent time span per message.

Categorizing Notable Events​

In the process of generating notable events, the platform categorizes them based on their nature and significance:

  • Notifications and Alerts: These events are inherently notable and are categorized accordingly. The platform also enriches alerts with additional context, such as their state in relation to other events.
  • Actions: These events represent interactions with the system worth categorizing. The platform identifies notable actions based on specific criteria or patterns, such as unique properties associated with user logins that may indicate potential security risks.
  • Summary: These are normally discarded, as the raw data that creates these has already been captured.
  • Metrics: These are like Actions. Metrics may generate notifications based on threshold and trending alerts.

By effectively categorizing and analyzing notable events, SIEM systems empower security teams to detect and respond to security threats in a timely and efficient manner.

The supporting pages examine how to create notifications based on the types above.

In this section​

  • Actions — the FPL actions that deliver a notification: email, Slack, webhooks and external ticketing.
  • Notifications — the endpoints and rules that decide what gets sent where.