Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.10] Adds links from threat intel integrations guide to IoC page (backport #3857) #3903

Merged
merged 1 commit into from
Sep 11, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/cases/indicators-of-compromise.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ If indicator data is not appearing in the Indicators table after you installed a
** *{filebeat} integrations* - `filebeat-*`
* Ensure the indicator data you're ingesting is mapped to {ecs-ref}[Elastic Common Schema (ECS)].

NOTE: These troubleshooting steps also apply to the <<es-threat-intel-integrations, Threat Intelligence view>>.

[discrete]
[[intelligence-page-ui]]
== Indicators page UI
Expand Down
8 changes: 4 additions & 4 deletions docs/getting-started/threat-intel-integrations.asciidoc
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[[es-threat-intel-integrations]]
= Enable threat intelligence integrations

The Threat Intelligence view provides a streamlined way to collect threat intelligence data that you can use for threat detection and matching. Threat intelligence data consists of threat indicators ingested from third-party threat intelligence sources.
The Threat Intelligence view provides a streamlined way to collect threat intelligence data that you can use for threat detection and matching. Threat intelligence data consists of <<ti-indicators, threat indicators>> ingested from third-party threat intelligence sources.

Threat indicators describe potential threats, unusual behavior, or malicious activity on a network or in an environment. They are commonly used in indicator match rules to detect and match known threats. When an indicator match rule generates an alert, it includes information about the matched threat indicator.

Expand All @@ -10,7 +10,7 @@ NOTE: To learn more about alerts with threat intelligence, visit <<view-alert-de
You can connect to threat intelligence sources using an <<agent-ti-integration, {agent} integration>>, the <<ti-mod-integration, Threat Intel module>>, or a <<custom-ti-integration, custom integration>>.

[role="screenshot"]
image::images/threat-intelligence-view.png[width=65%][height=65%][Shows the Threat Intelligence view on the Overview page]
image::images/threat-intelligence-view.png[width=65%][height=65%][Shows the Threat Intelligence view on the Overview dashboard]

There are a few scenarios when data won't display in the Threat Intelligence view:

Expand Down Expand Up @@ -41,7 +41,7 @@ If you know the name of {agent} integration you want to install, you can search

=========================
. Select an {agent} integration, then complete the installation steps.
. Return to the Threat Intelligence view on the Overview page. Refresh the page if indicator data isn't displaying.
. Return to the Threat Intelligence view on the Overview dashboard. If indicator data isn't displaying, refresh the page or refer to these <<troubleshoot-indicators-page, troubleshooting steps>>.

[float]
[[ti-mod-integration]]
Expand All @@ -54,7 +54,7 @@ NOTE: For more information about enabling available threat intelligence filesets
. Update the `securitySolution:defaultThreatIndex` <<update-threat-intel-indices, advanced setting>> by adding the appropriate index pattern name after the default {fleet} threat intelligence index pattern (`logs-ti*`):
.. If you're _only_ using {filebeat} version 8.x, add the appropriate {filebeat} threat intelligence index pattern. For example, `logs-ti*`, `filebeat-8*`.
.. If you're using a previous version of Filebeat _and_ a current one, differentiate between the threat intelligence indices by using unique index pattern names. For example, if you’re using {filebeat} version 7.0.0 and 8.0.0, update the setting to `logs-ti*`,`filebeat-7*`,`filebeat-8*`.
. Return to the Threat Intelligence view on the Overview page. Refresh the page if indicator data isn't displaying.
. Return to the Threat Intelligence view on the Overview dashboard. Refresh the page if indicator data isn't displaying.

[float]
[[custom-ti-integration]]
Expand Down