App Components¶
This page describes the various different compoents that ship as part of the app and their functions.
Searches¶
es_is_installed
- Checks to see if ES is installed on that SH(C). If so, is enables/disables the proper searches via the enable_searches alert actionitsi_is_installed
- Checks to see if ITSI is installed on that SH(C). If so, is enables/disables the proper searches via the enable_searches alert actiones_share_itsi
- Runs a scheduled search to pull information from ES notables to populate the share_with_itsi indexitsi_share_es
- Runs a scheduled search to pull information from ITSI episodes to populate the share_with_es indexITSI Episode
- Scheduled correlation search to create ES notables based on data in share_with_esES Alert
- Scheduled correlation search to create ITSI notables based on data in share_with_itsi
Indexes¶
share_with_es
- Index that holds specific data from ITSI episodes, used to generate ES notablesshare_with_itsi
- Index that holds specific data from ES notables, used to generate ITSI notables
Alert Actions¶
enable_searches
- Makes REST calls to enable and disable the proper searches based on the SH(C) it is installed on
Macros¶
filter_share_itsi
- Limits which ES notables are saved to the share_with_itsi indexfilter_share_es
- Limits which ITSI episodes are saved to the share_with_es indexitsi_severvity_description
- Maps a number to a string for severity