})
+From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), navigate to the **Copilot** tab.})
+From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Copilot** in the left nav.})
### Step 3: Execute a Suggestion
-Click on any of the prebuilt **Suggestions** prompts to launch your investigation. These AI-curated natural language insights are tailored to the specific data source you've chosen.
+Click on any of the prebuilt **Suggestions** prompts to launch your investigation. These AI-curated natural language insights are tailored to the specific source you've chosen.
In this example, we'll click `Count the number of log entries by the collector ID`. This translates the insight to a log query and renders results.
})
-+#### Ask a question -
-})
Broad questions may not yield accurate results. For best outcomes, frame your queries around a small, well-defined problem. If Copilot is unable to translate your prompt into a query, it will display "Failed translation".
-Break your questions into smaller, specific prompts to help Copilot provide more accurate answers.
})
-
+Break your questions into smaller, specific requirements to help Copilot provide more accurate answers.Manual entry (not recommended)
+In the **Ask Something...** field, you can manually enter a natural language prompt similar to the prebuilt ones under **Suggestions**. In addition, use autocompletions if appropriate. Type a work in the search bar to trigger completions based on the keyword. -In the **Ask Something...** field, you can manually enter a natural language prompt similar to the prebuilt ones under **Suggestions**. +
Broad questions may not yield accurate results. For best outcomes, frame your queries around a small, well-defined problem. If Copilot is unable to translate your prompt into a query, it will display "Failed translation".
-Break your questions into smaller, specific prompts to help Copilot provide more accurate answers.
-
+
+
+
+Copilot is built on [Sumo Logic search query language](/docs/search/search-query-language). Below are key functions you can call using natural language prompts:
+
+* `Count logs by` [field(s)]
+* `Group logs by` [field(s)]
+* `Sort by` [field(s)] [in descending order]
+* `Percentage breakdown in` [field] `values`
+* `Find` [stat] `for` [field] (max, min, standard deviation, etc.)
+* `Filter by` [field] `contains` [keyword]
+ :::note
+ Keyword searches are case-sensitive
+ :::
+* `Apply logreduce to logs`
+
+Additional prompts can trigger more advanced activities (e.g., mapping network activity against CrowdStrike):
+
+* `Analyze risk and severity of network activity`
+* `Identify top application categories accessed`
+##### Tips and tricks
+
+* **Start with a broad query**. Begin with a query like `Show me the most recent logs` to understand the structure and available fields in your logs.
+* **Clarify field names**. If fields have similar names and cause confusion, explicitly specify the field (e.g., `
-
})
-
-
1. Click in the code editor field and edit your search. Not familiar with Sumo Logic query language? See [Search Query Language](/docs/search/search-query-language) to learn more.JSON Syntax Rules
- -* Copilot supports querying JSON logs only. It cannot be used to query unstructured data, metrics, or traces. To retrieve a list of `_sourceCategories` with JSON data, use the following query: - ```sql - _sourceCategory=* "{" "}" - | limit 10000 | logreduce keys noaggregate - | count by _sourceCategory, _schema - | where _schema != "unknown" - | sum(_count) by _sourceCategory - ``` -* If your log query contains a mix of JSON and non-JSON formatting (i.e., a log file is partially JSON), you can isolate the JSON portion by adding `{` to the source expression to trigger **Suggestions**.
-})
1. When you're done, press Enter or click the search button.})
@@ -153,6 +166,22 @@ You can manually edit your log search query code if needed.
To save space, you can use the **Hide Log Query** icon to collapse the log query code.})
:::
+#### Compatible Log Formats
+
+Copilot querying is compatible with JSON logs, partial JSON logs, and unstructured logs with Field Extraction Rules. It cannot be used to query metrics or trace telemetry.
+
+To retrieve a list of `_sourceCategories` with JSON data, use the following query:
+
+```sql
+_sourceCategory=* "{" "}"
+| limit 10000 | logreduce keys noaggregate
+| count by _sourceCategory, _schema
+| where _schema != "unknown"
+| sum(_count) by _sourceCategory
+```
+
+If your log query contains a mix of JSON and non-JSON formatting (i.e., a log file is partially JSON), you can isolate the JSON portion by adding `{` to the source expression to trigger **Suggestions**.
+
#### History
Often, users work on multiple incidents at the same time. To view Copilot interactions related to these incidents, click **History**.})
@@ -165,7 +194,7 @@ Second, you can resume from a specific query in a conversation by clicking on th
#### New Conversation
-To start a new exploration, click **New Conversation**. })
+To start a fresh exploration, click **New Conversation**. This clears your current session and allows you to begin with a clean slate.
### Step 4: Open in Log Search
@@ -204,7 +233,7 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
1. In Copilot, you type the source for Cloud SIEM network records:
```
- * _index=sec_record_network
+ _index=sec_record_network
```
1. You know what you are looking for. So, you ask:
```
@@ -216,7 +245,7 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
Count logs by action. Sort the results. versus the previous 1h
```
Notice the system translated the suggestion to a log query and rendered results as a bar graph with no user input. })
-1. Switching to table view, you notice “Malicious” in the search results. So, you add in `Filter results by action contains Malicious` to the query:
+1. Switching to table view, you notice "Malicious” in the search results. So, you add in `Filter results by action contains Malicious` to the query:
```
Count logs by action. Sort the results. Filter results by action contains Malicious.
```
@@ -233,6 +262,10 @@ You are a SecOps engineer who uses [Cloud SIEM](/docs/cse/). You are worried abo
To summarize, you conclude there is malicious activity originating from certain users who need to be investigated further.
+## Role Based Access Control
+
+Role Based Access Control is not supported for contextual suggestions and autocompletions. It is possible for a user who is blocked by [log search RBAC](/docs/manage/users-roles/roles/construct-search-filter-for-role/) to view suggestions or completions for unpermitted source expressions. However, they will not be executed by the search and will see the error: `""`.
+
## Feedback
We want your feedback! Let us know what you think by clicking the thumbs up or thumbs down icon and entering the context of your query.
diff --git a/sidebars.ts b/sidebars.ts
index e45509e381..9dce30781d 100644
--- a/sidebars.ts
+++ b/sidebars.ts
@@ -1324,6 +1324,7 @@ module.exports = {
},
],
},
+ 'search/copilot',
{
type: 'category',
label: 'Search Query Language',
diff --git a/static/img/search/copilot/copilot-tab-new.png b/static/img/search/copilot/copilot-tab-new.png
index f7b6a4dd23..fa565d9f95 100644
Binary files a/static/img/search/copilot/copilot-tab-new.png and b/static/img/search/copilot/copilot-tab-new.png differ
diff --git a/static/img/search/copilot/copilot-tab.png b/static/img/search/copilot/copilot-tab.png
index 62760a84d1..79b0488ebc 100644
Binary files a/static/img/search/copilot/copilot-tab.png and b/static/img/search/copilot/copilot-tab.png differ