Skip to main content

SIEM

The SIEM menu contains the pages used to review detections and manage detection logic:

In this section​

  • Overview Summary — a dashboard of behavioral activity over the last 24 hours.
  • Behavior Summary — search and review aggregated behavior summaries.
  • Behavior Timeline — a chronological view of behavior events with alerts and attributes.
  • Resources — search the resources (users, devices, and other entities) observed by the system.
  • Behavior Rules — view, create, and manage behavior detection rules and filters.
  • EntityInfo Tables — manage entity information tables used to enrich events.