Security Operations Integration - Sightings Search Flow

Security Operations Integration - Sightings Search flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.

Before you begin

Role required: sn_si.analyst

About this task

If a security incident has an observable attached to it, this flow is triggered when you click on Run Sighting Search in the Actions on selected rows… drop-down menu in the Security Incident Observables tab.

[Omitted image “integration-sightings-search.png”] Alt text: Flow design for Security Operations Integration- Sightings Search

Activities specific to this flow are described here. For more information on other activities, see Common Security Operations integration flows and orchestration activities.

• Sightings Search - Determine Observables activity
  The Sightings Search - Determine Observables workflow activity determines which observables to include in the workflow.

• Persistent Observable Sightings activity
  The Persistent Observable Sightings workflow activity retrieves observables from the third-party integration.

• Get Observable Sightings Queries activity
  The Get Observable Sightings Queries workflow activity retrieves queries from the integration configuration.

• Security Operations - Arcsight Logger Sightings Search Flow
  Security Operations - ArcSight Logger Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search Flow.

• Security Operations - Elasticsearch Sightings Search Flow
  Security Operations - Elasticsearch Sightings Search flow is the Elasticsearch implementation launched by the Security Operations Integration - Sightings Search flow.

• Security Operations - McAfee ESM Sightings Search Flow
  Security Operations - McAfee ESM Sightings Search flow is the implementation for the McAfee Sighting Search implementation launched by the Security Operations Integration - Sightings Search Flow.

• Security Operations - QRadar Sightings Search Flow
  Security Operations - QRadar Sightings Search flow is the implementation for the IBM QRadar integration launched by the Security Operations Integration - Sightings Search flow.

• Security Operations Integration - Splunk Sightings Search Flow
  Security Operations - Splunk Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search flow.

Parent Topic:Create sightings search configuration records