You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/search/copilot.md
+95-35Lines changed: 95 additions & 35 deletions
Original file line number
Diff line number
Diff line change
@@ -2,6 +2,7 @@
2
2
id: copilot
3
3
title: Sumo Logic Copilot - Feature Preview
4
4
sidebar_label: Copilot 🤖
5
+
description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant designed to simplify log analysis by allowing you to ask questions in plain English and providing search suggestions without the need to write log queries.
This is a Preview release. To learn more, contact your Sumo Logic account executive.
22
-
:::
23
23
24
-
Sumo Logic Copilot is an AI-based assistant that streamlines log analysis insights by allowing you to ask questions in plain English and provides search suggestions, all without your having to write a log query.
24
+
Sumo Logic Copilot is an AI-based assistant designed to simplify log analysis by allowing you to ask questions in plain English and providing search suggestionswithout the need to write log queries.
25
25
26
-
In this document, you'll learn the recommended Copilot workflow as well as best practices.
26
+
### Key features
27
27
28
-
<details>
29
-
<summary>Click here to watch a step-by-step video investigation using Copilot.</summary>
28
+
***AI-curated insights**. Get customized insights tailored to your data.
29
+
***Natural language queries**. Ask questions in plain English.
30
+
***Pre-built insights**. Utilize pre-built insights to accelerate your workflow.
31
+
***Root cause analysis**. Quickly identify the root cause of issues with AI assistance.
32
+
33
+
### Who benefits from Copilot?
34
+
35
+
Copilot is ideal for:
36
+
37
+
***On-call engineers**. Accelerate time to resolution for application insights.
Copilot combines pre-built insights with the ability to ask questions of your logs in natural English, helping you to:
43
+
44
+
***Find root causes faster**. Use AI to quickly pinpoint issues.
45
+
***Enhance efficiency**. Streamline the log analysis process.
46
+
47
+
48
+
## Sample Copilot queries
30
49
31
50
<!-- add micro lesson video when published-->
51
+
<!-- replace with https://www.youtube.com/watch?v=QrRvN2Bg4NY ? -->
52
+
53
+
In the scenario depicted in the video, Copilot is leveraged to investigate a security issue where it appears AWS CloudTrail access keys were leaked outside an organization.
@@ -42,40 +64,71 @@ In this document, you'll learn the recommended Copilot workflow as well as best
42
64
allowfullscreen
43
65
/>
44
66
67
+
To recap the steps taken:
45
68
46
-
In the scenario depicted in the video, we leverage Copilot to investigate a security issue: AWS CloudTrail access keys being leaked outside an organization. Here's a recap:
47
-
48
-
1. First, we select the data source for AWS CloudTrail audit logs.
49
-
1. Launch our log investigation by clicking the AI-suggested insight `Count logs by eventname`, which translates the insight to a log query and renders results.
50
-
1. Refine query by applying the suggestion `Count logs by eventname, access key and sourceIp`.
51
-
1. Filter for Create and Authorize events, as attackers often create new resources during a breach. We find an anomaly with `AuthoritySecurityGroupIngress` events.
52
-
1. Provide feedback to enhance the AI's accuracy stating that the queries have been accurate so far.
53
-
1. Add the security `groupid` to the prompt to tabulate events containing that data.
69
+
1. First, the data source is selected for AWS CloudTrail audit logs.
70
+
1. Launch the log investigation by clicking the AI-suggested insight `Count logs by eventname`, which translates the insight to a log query and renders results.
71
+
1. The query is refined by applying the suggestion `Count logs by eventname, access key and sourceIp`.
72
+
1. The filter is applied for Create and Authorize events; attackers often create new resources during a breach. You'll then see an anomaly with `AuthoritySecurityGroupIngress` events.
73
+
1. Feedback is provided back to Sumo Logic to enhance the AI's accuracy stating that the queries have been accurate so far.
74
+
1. The security `groupid` is added to the prompt to tabulate events containing that data.
54
75
1. Focus on a specific access key, `ABCDEFGOYCM3PIKNOVRA`, noting `PutRolePolicy` events indicating permission elevation. Multiple AWS accounts are impacted.
55
-
1. We conclude that the access key was used to modify permissions, providing the attacker with a potential network entry point. Remediation would involve disabling the key, blocking the source IP, and further log analysis.
56
-
</details>
57
76
58
-
## Step 1: Open Copilot
77
+
You can conclude that the access key was used to modify permissions, providing the attacker with a potential network entry point. Remediation would involve disabling the key, blocking the source IP, and further log analysis.
78
+
79
+
<!--
80
+
### Security example
81
+
82
+
This video demonstrates how to use Copilot to analyze AWS CloudTrail data by reviewing AI-curated suggestions, refining searches with natural language prompts, and launching an AI-generated dashboard for root cause analysis and sharing.
1. **Select AWS CloudTrail**. Start by selecting AWS CloudTrail as the data source.
99
+
1. **Review Suggestions**. Look at the **Suggestions** section where AI-curated natural language insights are provided, customized for the specific AWS CloudTrail data.
100
+
1. **Select a Suggestion**. Choose the suggestion `Count logs by eventname`.
101
+
1. **Refine Search**. Enhance your search for log anomalies by adding `access key and sourceIp` to the prompt. No need to edit the query code.
102
+
1. **Filter Results**. Narrow down the results by adding `eventname contains Create` to the prompt.
103
+
1. **Review Recommendations**. Quickly review AI-driven recommendations to identify attacker TTPs (Tactics, Techniques, and Procedures).
104
+
1. **Launch Dashboard**. Launch an AI-generated dashboard directly from the UI for root cause analysis.
105
+
-->
106
+
107
+
## How to use Copilot
108
+
109
+
In this section, you'll learn the recommended workflow for using Copilot effectively, along with best practices to maximize its benefits.
110
+
111
+
### Step 1: Open Copilot
59
112
60
113
To start using Copilot, navigate to the **Copilot** tab on the Sumo Logic home page.
Because manually typing an AI prompt requires careful precision for optimal performance, we recommend clicking the prebuilt [Suggestions](#suggestions-recommended) prompts, which have been proven effective through extensive testing.
@@ -89,19 +142,19 @@ You'll need to be very specific. Broad questions do not return good results. Whe
89
142
If the statement in the **Ask Something...** field can't be translated into a query, this field will say "Failed translation".
90
143
:::
91
144
92
-
## Step 4: Refine your investigation
145
+
###Step 4: Refine your investigation
93
146
94
147
After executing a prompt, you'll see your current investigation summarized in plain text in the **Ask Something...** field. You can use these natural language query prompt ideas to launch and/or refine investigations.
95
148
96
149
Optionally, follow any of the below steps to refine your search.
97
150
98
-
### Refine
151
+
####Refine
99
152
100
153
Click any of the **Suggestions** > **Refine** prompts to apply suggested refinements to your existing investigation.
As a best practice, start with a simple prompt, verify the query translation, and refine it gradually. For example:
107
160
@@ -111,10 +164,17 @@ As a best practice, start with a simple prompt, verify the query translation, an
111
164
1. Further refinement. `Count of logs grouped by type, reason, kind, name. Filter logs where reason is FailedScheduling. Filter logs that contain redis-cluster in name. Sort the results by count`.
112
165
113
166
:::tip
114
-
Express your chain of thought to the AI by breaking up the prompt into smaller problems that the AI can answer more accurately.
167
+
168
+
<details>
169
+
<summary>Express your chain of thought to the AI by breaking up your prompt into smaller problems that the AI can answer more accurately. Click here to see an example.</summary>
1. Click the clock icon and select your desired time range from the dropdown.<br/><img src={useBaseUrl('img/search/copilot/time-period.png')} alt="Copilot time period" style={{border: '1px solid gray'}} width="400" />
We want your feedback! Let us know what you think by clicking the thumbs up or thumbs down icon. Optionally, you can also enter more context and information.
Click the **Open in Log Search** icon (insert pic), which will copy your query from Copilot over to a new Log Search, allowing you to utilize all of Sumo's search functionality. You can continue investigating, save the search, and remediate.
160
214
161
215
<img src={useBaseUrl('img/search/copilot/open-in-log-search.png')} alt="Copilot open in log search" style={{border: '1px solid gray'}} width="400" />
162
216
163
217
If you'd like to start over and begin a new investigation, click the **New Conversation** icon.<br/><img src={useBaseUrl('img/search/copilot/new-conversation.png')} alt="Copilot new conversation" style={{border: '1px solid gray'}} width="275" />
218
+
219
+
## Feedback
220
+
221
+
We want your feedback! Let us know what you think by clicking the thumbs up or thumbs down icon. Optionally, you can also enter more context and information.
0 commit comments