## Summary Adding `Anomaly Detection with Machine Learning` section to docs for new Machine Learning features. Example generated docs: ![image](https://user-images.githubusercontent.com/2946766/62312719-2a32d780-b44c-11e9-9967-4639eedf05d5.png) ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. - [] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~ - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md) - [x] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials - [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~ - [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~ ### For maintainers - [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ - [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~
53 lines
1.6 KiB
Text
53 lines
1.6 KiB
Text
[role="xpack"]
|
|
[[xpack-siem]]
|
|
= SIEM
|
|
|
|
[partintro]
|
|
--
|
|
beta[]
|
|
|
|
The SIEM app in Kibana provides an interactive workspace for security teams to
|
|
triage events and perform initial investigations. It enables analysis of
|
|
host-related and network-related security events as part of alert investigations
|
|
or interactive threat hunting.
|
|
|
|
|
|
[role="screenshot"]
|
|
image::siem/images/overview-ui.png[SIEM Overview in Kibana]
|
|
|
|
|
|
[float]
|
|
== Add data
|
|
|
|
Kibana provides step-by-step instructions to help you add data. The
|
|
{siem-guide}[SIEM Guide] is a good source for more
|
|
detailed information and instructions.
|
|
|
|
[float]
|
|
=== {Beats}
|
|
|
|
https://www.elastic.co/products/beats/auditbeat[{auditbeat}],
|
|
https://www.elastic.co/products/beats/filebeat[{filebeat}],
|
|
https://www.elastic.co/products/beats/winlogbeat[{winlogbeat}], and
|
|
https://www.elastic.co/products/beats/packetbeat[{packetbeat}]
|
|
send security events and other data to Elasticsearch.
|
|
|
|
The default index patterns for SIEM events are `auditbeat-*`, `winlogbeat-*`,
|
|
`filebeat-*`, and `packetbeat-*``. You can change the default index patterns in
|
|
*Kibana > Management > Advanced Settings > siem:defaultIndex*.
|
|
|
|
[float]
|
|
=== Elastic Common Schema (ECS) for normalizing data
|
|
|
|
The {ecs-ref}[Elastic Common Schema (ECS)] defines a common set of fields to be
|
|
used for storing event data in Elasticsearch. ECS helps users normalize their
|
|
event data to better analyze, visualize, and correlate the data represented in
|
|
their events.
|
|
|
|
SIEM can ingest and normalize events from ECS-compatible data sources.
|
|
|
|
--
|
|
|
|
|
|
include::siem-ui.asciidoc[]
|
|
include::machine-learning.asciidoc[]
|