Behavior Summary
A behavior summary is the per-entity case view: everything one entity triggered on one day, scored and worked to a disposition.
- v2 interface
- Classic v1 interface
In the navigation rail, open Cases Search (/v2/cases-search), subtitled Faceted search across case summaries. It lists the behavior summaries (the cases) that match a search, and each one opens on the Behavior Summary page.
The search bar carries a full-width search field, matched across all fields; the time-range buttons 1D, 3D, 7D (the default), 30D, and Custom, which adds a start and an end date; and Search. Searches are combined with the selected time range and any filter selections.
The FILTERS panel on the left can be used to filter cases. It has eight groups: Incident Status, Score Level, Entity / Key, Entity / Key Type, Behavior Rules, Behaviors, Risks, and Analyst, each with the number of values found in parentheses and a checkbox per value. The Facet Section covers the panel in detail. When the search has results, a RISK SCORE OVER TIME chart plots each case as a dot by its time and risk score.
The results table shows, by default, each case's Last Seen, Summary, Entity / Key, Status, Score, and Level; ⚙ Columns adds others, such as Behavior Rules, Behaviors, Risks, or Score Level. Click a case to open its detail panel, with the case's overview, attributes, and alerts; its Open case link opens the case on Behavior Summary for that entity and day (/v2/behavior-summary?id=<entity>&dayIndex=<YYYYMMDD>). A summary on Overview Summary opens on Behavior Summary directly.
The case header gives the entity, its type and the day, the severity (such as CRITICAL), the status drop-down, and the Score, Last Updated, and Classification. The Entity and Day fields above it, with Search, load another entity's or day's summary. The page opens on its Info tab; Comments holds the case's discussion, and JSON shows the full behavior summary record, with Copy JSON.
Under Triggered Events, each behavior rule the entity triggered that day is listed with its name and time, a chip for each correlation alert it raised, and its Score, Count, Alerts, and Fields. Click the row to expand it:
- Correlation Alerts: each alert the rule raised, with its description (for example New Behavior (global)).
- Fields: the triggering event's fields and their values, such as Application, Country, and OS for a sign-in.
- Datalake Search: searches the matching events in the data lake, on Datalake Search.
- View Rule, Add Suppression, and Test Suppressions: the behavior rule read-only, a new behavior filter pre-filled from the event, and a test of the event against the current behavior filters.
The status drop-down in the case header changes the status of the case: New, Acknowledged, or Closed. Choosing Closed adds a Classification drop-down beside it, for recording how the case was resolved.
Below the triggered events, a calendar of the entity's notable events puts the day in context (click another day to load its summary), and the behavior rollup totals the entity's events by Event Name. To see the entity's notable events one by one, search for the entity on Notable Events.
Sign in to your Fluency portal at https://<companyname>.app.ingext.io; see Fluency Web Interface for the URL formats.
Choose the Behavior Summary option under the SIEM menu in the navigation bar.
The Behavior Summary page shows a detailed view of behavior alerts. The on-page heading reads Behavior Summary Search, with the subtitle Search for behavior summaries over a date range (/SIEM/behaviorSummarySearch).
The header row carries the page title on the left and an Export Data button on the right, with the time-range selector beneath it: 1D (selected by default), 3D, 7D, 30D, 90D, and ALL TIME, plus a calendar icon for a Custom date range. Below that is a full-width Search field with a Search button; searches are combined with the selected time range and any facet selections.
The facet on the left side can be used to filter events. There are eight fields associated with a behavior model that can be used for search filters: incident status, analyst, score level, key, key type, behavior rule, behavior, and risks. The sidebar starts with a Total Records count, and each facet shows its title, the number of distinct values in parentheses, and a checkbox per value with the matching record count on the right. A checkbox in the minus state excludes the value: by default the 0 score bucket is excluded, so zero-score summaries stay hidden. The Facet Section covers the sidebar and its toolbar in detail.
Each behavior summary appears as a card showing the entity it covers (username: an email address or an AWS ARN), the Day Index the summary belongs to in YYYYMMDD form, the ticket Status badge (N/A when no status is set), the Score as a numeric behavior score with a severity chip such as medium, and the Classification (N/A when unset). A paging bar below the results reports the visible range.
Each card has an ellipsis (...) button in its upper-right corner, whose menu holds one option, View JSON.
View JSON opens a dialog of the same name showing the full behavior summary record as color-coded JSON: identity and range fields such as id, from, to, count, key, keyType, and dayIndex; the behaviorRules and behaviors arrays; the overall riskScore; and a summaryList array that breaks the summary down per rule, each entry carrying its own hits, risks, count, riskScore, ruleID, behavior, and attributeSummaries. The X at the right end of the title bar closes the dialog.
The interactions described from here on (the "triggered events" expansion with its Correlation Hits and Fields tabs, the Status drop-down, and the magnifying-glass pivot to Behavior Timeline) and their screenshots belong to the legacy interface. On the v1 SIEM → Behavior Summary page, each summary appears as a card (entity, Day Index, Status, Score, Classification) with a View JSON row menu.
For each alert, you can see all the triggered events. To the right of that are the corresponding risk scores, in addition to the number of events that triggered them.
Clicking the arrow icon next to each "triggered events" displays two tabs: "Correlation Hits" and "Fields". The "Correlation Hits" tab shows risks that were triggered by the correlation rules associated with this alert, with a description of the field that triggered it corresponding to the alert.
The second tab is the "Fields" tab. This tab displays the attributes associated with the behavior model, in addition to their values alongside each field. Different triggered event has different information in this tab. Two examples are given below.
Clicking the "Status" drop-down menu allows the user to make changes to the current status of an alarm. By default, an alert will display with the N/A status. If the score associated with the alert passes the notification threshold of 3000, it will appear as "New."
Clicking the magnifying glass icon next to the key field will redirect you to the Behavior Timeline page and display all the events associated with the behavior alert triggered. From there, you can navigate to the events page and view more information on the events. More information on how to do this can be found on the page of Behavior Timeline.