Security signals
What the rules found, and how an analyst works through it.
What a signal is #
A signal is one rule matching one group. The group is whatever the rule groups on — a user, an address, a host — so ten thousand failed logins against a hundred accounts produce a hundred signals rather than one unreadable row.
A sustained attack stays one signal. A new match inside the rule's keep-alive extends the open signal rather than opening a new one, so a flood produces one row that grows rather than a row a minute.
The list #
The signal list is the queue. It filters by severity, status and rule, and searches across the attributes on the signal, so you can pull up everything involving one user or one address.
- Severity — critical, high, medium, low or info.
- Status — open, under review or archived.
- Rule — which rule raised it.
- Search — free text across the signal's attributes.
- Building blocks — signals raised by rules that exist to be correlated against rather than read.
The list also reports totals alongside the rows, grouped by severity, status and rule, which is usually a faster way into an investigation than scrolling.
A signal in detail #
Opening a signal shows the evidence and everything around it.
- Samples — the individual events behind the match, up to ten, kept so you can read the exact values that triggered it.
- Activity — the signal's own history: when it opened, every status change, every assignment, every comment, and any escalation in severity.
- Related signals — other signals sharing a group value with this one, which is how one compromise across several rules is put together.
- The rule — the rule that raised it, at the version that raised it.
Severity can move
A graded rule can raise a signal low and escalate it later as the same group matches harder. The activity log records the escalation, so an analyst can see that a signal worsened rather than having to infer it.
Triage #
Triage is moving a signal through the queue and recording who did what.
- Status — open, under review, or archived.
- Assignee — who owns it. Clearing the assignee returns it to the queue.
- Comment — a note on the signal, up to 4,000 characters.
Archiving asks for a reason, and the reason is stored with the signal. The set is short: it is a false positive, it was testing or maintenance, it was a benign positive, it was a true positive with no harm, it was a true positive and malicious, or something else. Picking ‘false positive’ is the one that usually feeds a suppression.
Triage works on up to 50 signals at once, so a batch of the same finding is one action rather than fifty. Each signal is recorded separately, so the activity log still shows who touched what.
Comments #
A comment can be added to any signal. Comments sit in the activity log alongside the status changes, which makes the signal the record of the investigation rather than a row that gets reassigned and forgotten.
Reading one well #
- Read the samples before the summary. They are the actual events.
- Check the related signals before concluding. One rule matching is a symptom; several rules matching the same group is the finding.
- Look at the activity log when a signal looks older than its status suggests.
Triage in severity order, but read the activity log first on anything that has already been reassigned once. It tells you what the previous analyst concluded, which is the thing you would otherwise redo.
Limits #
- A signal keeps up to 10 samples.
- Triage changes up to 50 signals in one action.
- A comment is at most 4,000 characters; an assignee is at most 255.
Onward #
The rules that raised these are in Detection rules, and the way to stop known noise arriving is Suppressions.