Skip to main content

View and Manage Entities

This topic has information about the Entities page in CSE UI, which lists all of the Entities in CSE and their Activity Scores, and the Entities > Details page, which presents information about a particular Entity, including Signals and Insights associated with the Entity.

The Entities page is useful for monitoring Entities that are close to having an Insight created. On the Entities > Details page, you can view Signals and Insights for an Entity, and, as desired, manually create an Insight from Signals associated with the Entity.

You can also update the tags, suppression state, and Criticality assigned to Entities, as described below in the Update Multiple Entities section below. 

About the Entities list page

To view the Entities page, click Entities at the top of the CSE UI.

entities-icon.png

Here’s a screenshot of the Entities page.

entities-page-2.png

LetterDescription
AThis area shows the total number of unique Entities in CSE.
BIn the Filters area, you can filter the list of Entities by Activity Score, Hostname, IP Address, Username, Tags, Type, and Suppressed.
CIn this area you can sort Entities by Activity Score, Name, or Type. 
DThe Import Metadata option allows you to upload a .csv file of updates to Entity tags, suppression state, and Criticality, as described in Update Multiple Entities.
EShows the Entity Type and its value. 
FThe Criticality column shows whether a Criticality has been assigned to the Entity. A Criticality adjusts the severity of Signals for specific Entities based on some risk factor or other consideration. If a Criticality hasn't been assigned to an Entity, the column contains "default".
GThe current Activity Score for the Entity, which by default is the sum of the severities of the Signals that have fired on the Entity over the previous two weeks. For more information, see Understanding Entity Activity Scores, in the Insight Generation Process topic.
HIf you see a link below the Entity value, it’s a tag. You can click it to filter Entities by that tag.
IIf an Entity has the Suppressed indicator, that means that Signals will not be fired on the Entity.  

About the Entities Details page

When you click an Entity on the Entities page, a details page for the Entity appears.

entity-details-page.png

LetterDescription
ASuppression slider. Shows whether or not the Entity is currently suppressed. You can use the slider to suppress the Entity so that it is excluded from the Insight generation process. 
BTags. Lists any tags assigned to the Entity. You can add a new tag, select a tag to assign, or remove a tag from the Entity.
CCriticality. An Entity’s Criticality is a setting that adjusts the severity of Signals that fire on the Entity, based on a risk factor or other consideration. You can reset the Criticality here.
DInventory. If the selected Entity is standard Entity type—an IP address, hostname, or username—this area provides selected information about the Inventory object associated with the Entity. (Inventory information is not provided for custom entity types.) Inventory data is customer or 3rd-party provided information that describes devices and users along with contact information and job descriptions. CSE joins inventory data  on demand with data from Entities in Insights data to provide context to Signals.
EIP Metadata. (Displayed only for IP address Entities.) This section lists the contents of enrichment fields  that were added during Record processing. 
FMatching Network Blocks. (Displayed only for IP address Entities.) If the IP Address is within any Network Blocks, they're listed here.
GRelated Entities. If related entities exist, they are listed here. A related entity is a hostname or MAC address from which we have observed a Record in the log stream for which an IP and hostname or MAC appears in the same device within the Record.
HAudit Log. This area will list any audit events that have been logged for the Entity. An audit log is generated each time an Entity is suppressed or unsuppressed. 
IActivity tab. This tab displays a visualization of Signals on the Entity over time.The x-axis is time, the y-axis is severity. The icons represent Signals.
JRelated Entities tab. If related entities exist, this tab allows you to filter them by time. A related entity is a hostname or MAC address from which we have observed a Record in the log stream for which an IP and hostname or MAC appears in the same device within the Record.
KCreate Insight. You can use this option to create an Insight on the Entity, as described below in Create an Insight, below.
LThe Current State section lists Signals that were generated for the Entity during the current Detection Window that are not already part of an Insight. (The Detection Window is the period over which CSE evaluates Signals, which is 14 days, by default. The Detection Window is configured on the Content > Custom Insights page in the CSE UI.)
MThe Prior Activity section lists Signals that were generated for the Entity prior to the current Detection window, and all Insights for the Entity. 

Create an Insight

You can create an Insight for an Entity based on one or more Signals on the Entity. To do so, checkmark each Signal you want to include in the Insight, and click Create Insight.

create-insight.png

The page refreshes and shows the selected Signals grouped in a new Insight.

insight-created.png

Update multiple Entities

This section describes how to update the tags, suppression state, or Criticality for one or more Entities.

Update Entities from the UI

  1. Click Entities at the top of the CSE UI.

  2. Note that there is a checkbox at the left end of each Entity row, and one above the Entities list. 

    entities-page.png

  3. Click the top checkbox to select all of the Entities on the page, or click the checkbox next to each Entity you want to update.

    update-options.png

  4. Note that once you select an Entity, three options appear at the top of the Entities list. See the instructions for each option below:

Update tags

  1. After selecting the Entities you want to update, click Update Tags

  2. Click the down arrow to display the options:

    tag-options.png

    • Add. Select this option to add one or more tags to the Entity, without affecting any tags already assigned to the Entity. You’re prompted to select a tag. If you select a schema tag, you’re prompted to select a tag value. You can select  multiple tags to add

    • Remove. Select his option to remove one or more tags from the Entity. You’re prompted to select a tag. If you select a schema tag, you’re prompted to select a tag value.You can select multiple tags to remove. If a selected Entity doesn't have the specified tags, no change will be made to the Entity. 

    • Replace. Select this option to remove all of the tags currently assigned to the Entity and add one or more specified tags. You’re prompted to select a tag. If you select a schema tag, you’re prompted to select a tag value. 

      info

      When you use the Replace option, be sure to specify new tags. If you don't, the existing tags will still be removed.

  3. As you select tags, they’ll appear in the update popup.

    tags-to-add.png

  4. When you are done selecting tags, click Update Entity Tags.

Update suppression

  1. After selecting the Entities you want to update, click Update Suppression

  2. The Update Suppression popup appears, with the suppression toggle set to Not Suppressed.

    before-suppression.png

  3. If you want to unsuppress the selected Entities, click Update Entity Suppression. Otherwise, if you want to suppress the Entity, toggle the slider to Suppressed, supply a comment if desired, and then click Update Entity Suppression

Update Criticalities

  1. After selecting the Entities you want to update, click Update Criticalities

  2. The Update Criticalities popup appears.

    update-criticalities.png

  3. If you want to assign default Criticality to the selected Entities, click Update Entity Criticalities. Otherwise, use the down arrow to view defined Criticalities, select one, and then click Update Entity Criticalities.

Import Entity updates from a CSV file

You can update Entities by uploading a .csv file to CSE. 

CSV file format

There are two supported formats. The difference is in how you identify the target Entity. 

  • Format 1—You use the id field to specify a target Entity. id, suppressed, criticality, tags, tags_to_add, tags_to_remove
  • Format 2—You use the type and value fields to specify the target Entity. type, value, suppressed, criticality, tags, tags_to_add, tags_to_remove

Regardless of the format you use, there are a couple of approaches for updating Entity tags.

  • You can use tags_to_add and tags_to_remove to add new tags and remove existing tags, respectively.
  • You can use a tags value to specify replacement tags. This will remove all existing tags and add all of the specified replacement tags.

See the next section for column definitions.

CSV columns

The table below defines the columns in the .csv file.

Note that:

  • The first row of the .csv file must contain all supported columns.
  • The .csv file must contain either values in the id column or values in both the type and value column, and a value in at least one other column.
  • If a row has a value in the tags column, it can’t have values in either the tags_to_add or the tags_to_remove column.
ColumnDescription
idThis field is required for Format 1.
To form the id field value, concatenate the Entity type identifier and the value of the entity, separated by a dash character (-) where the Entity type identifier is one of the following:
_ip
_hostname
_username
_mac
<CustomEntityTypeId>

The id for an IP address would look like:

_ip-1.2.3.4

You can optionally specify an Entity’s sensor zone as a part of the id column, in this format:

_<entity_type>-<sensor_zone>-<entity_value>

For example:

_ip-zone1-172.18.20.3
typeThis field is required for Format 2.
Identifies the type of Entity, one of:
_ip
_hostname
_username
_mac
<CustomEntityTypeId>
valueThis field is required for Format 2.
The value of the Entity, for example, for an IP address:
1.2.3.4
sensor_zoneIdentifies the sensor zone for the Entity.

Don’t include this column if you are specifying Entity sensor zones in the id column, as described above.
suppressedWhen true, CSE suppresses the Entity.
criticalityAssigns a Criticality to the Entity. (An Entity’s Criticality is a setting that adjusts the severity of Signals that fire on the Entity, based on a risk factor or other consideration.) You can only specify a Criticality that has already been configured in CSE. Allowable values:
default
<CustomCriticality>
tagsThe tags to assign to the target. This column can’t be present if the file contains a tags_to_add or tags_to_remove column.
Specify a schema key tag as key:value.
To assign multiple tags, enclose them in double quotes. For example:
"<tag>,<tag>,<tag>" or "<key>:<value>,<key>:<value>"
tags_to_addThe tag to assign to the target Entity. This column can’t be present if the file contains a tags column.
Specify a schema key tag as key:value.
tags_to_removeThe tag to remove from the target Entity. This column can’t be present if the file contains a tags column.
Specify a schema key tag as key:value.

Example CSV files

Format 1 example

id,suppressed,criticality,tags,tags_to_add,tags_to_remove
_ip-zone1-10.0.0.5,false,default,,Office-Based,
_ip-zone1-10.0.0.6,true,default,,Office-Based,Remote
_ip-zone1-10.0.0.7,false,Executive,Office-Based,,

Format 2 example

type,value,sensor_zone,suppressed,criticality,tags,tags_to_add,tags_to_remove
_ip,10.0.0.5,zone1,false,Executive PC,Frequent-Travel,,
_ip,10.0.0.6,zone1,true,default,,Office-Based,Remote
_ip,10.0.0.7,zone1,false,Executive,Office-Based,

Upload CSV file

After creating file, click Import Metadata in the upper right of the Entities page and upload the file.

Sumo Logic YouTubeSumo Logic Twitter
Legal
Privacy Statement
Terms of Use

Copyright © 2022 by Sumo Logic, Inc.