Signals¶
When a security detection rule is enabled and effectively detects an anomaly, a corresponding event record is generated. Signals provide a centralized processing entry, allowing you to perform specific analysis and response operations in subsequent real-world scenarios.
Signals can be generated from multiple data sources, such as:
-
A firewall detects an access attempt from a known malicious IP address.
-
Endpoint detection and response software discovers a process attempting to modify critical system files.
-
A cloud platform audit log records a user performing a high-privilege operation outside working hours.
-
An identity authentication system detects multiple failed login attempts.
-
...
A certain type of signal may not constitute a threat on its own, but when multiple related signals are correlated and analyzed in the Explorer, they may sound the alarm.
Data Display¶
The Signal Explorer provides multiple professional analysis views in the form of lists and charts.
Displays abnormal data collected in the current workspace within the last two days. The distribution chart above the list is counted by signal status by default, and can be switched to count by volume via status distribution preferences to view the total number of signal records in each time period.
Displays data in chart forms such as top lists, time series charts, pie charts, treemaps, and grouped tables, filtering data based on the by condition using the count, last, first, and count_distinct operation modes.
Signal Details¶
In the Explorer, click a specific data record and the corresponding details page slides out from the side.
You can view the basic attributes, extended fields, anomaly records, related signals, and associated views of the record.
Anomaly Records¶
Displays SIEM event data with the same dimension_tags within three days before and after the current event occurs.
Note
If no data records with the same dimension_tags exist, the system displays event data with the same df_monitor_checker_id.