The major entities that make up your LogicHub solution are accessible from your library. To access the library, select any of the following under My Library on the side menu.
Display a list of all content that you have permission to view.
Display a list of all content that is owned by you. The content in your library is organized in folders. A personal folder is automatically created for each entity type. You can also create custom folders to further organize your content by selecting New > Folder on the All content or Personal page.
Capture the flow of a security expert's analysis in a logical process to assess whether specific activity is acceptable or suspicious. See About playbooks.
Execute actions as part of case analysis. See Create commands for cases.
Create a link between LogicHub and an external system such as a SIEM environment. See Create connections.
For playbook integrations, specify links to external sources.
Specify queries that determine what data is brought into LogicHub for analysis and scoring. See Create event types.
Compare current behavior to past behavior as part of stream execution to determine whether the current behavior is consistent. See Add a baseline to a playbook in Easy Mode. For a description of the actions on the Baselines page, see Manage your streams.
Store and reuse the data from one playbook in other playbooks or batches. See Create custom lists.
Designate the external systems that will receive the results of a playbook. See Add destinations.
Each content library page includes a search and filter bar, a gray action bar with actions that become visible when you select one or more content items, a table that lists the items of that type, and buttons to add new content.
Perform any of the following actions on content library pages.
Select a ‘View as’ Option
Depending on your privileges, you may have the option to view the table of items as yourself or as a user with admin privileges.
Search for content
Search on any of the fields in the table by entering text in the search field. Search is case-insensitive.
To apply a search filter, click the filter type and select one or more options to match.
To clear a filter, click Clear in the filter bar or dropdown.
Add an item
On most of the library pages, you can add a new item by clicking the New button in the upper right corner of the page.
For playbooks, dashboards, and commands, there is also an option to import a previously exported item. Click Import or drag the file you want to import to the library page.
For more information on adding items, click the link for the entity type in this help topic.
To view details about an item, click the item row. The details panel slides open on the right.
Open an item
To open an item in the table, click the item name link.
Perform actions on a selected item
To perform actions on a selected item, click the More icon (...) in the table or in the Details panel. The available actions depend on the type of entity and may include the following:
- Edit. Make changes to a selected item.
- Pin. Keep the item pinned to the top of the list on the library page so you don't have to scroll to find it. to remove the pin, select the More icon (...) and select Unpin.
- Share. Extend access to the item to other users or groups. See Share Content from your Library.
- Move (folders only). Move a folder from one location in the content library to another. Navigate in the dialog box to select the new folder, and click Move.
- Download. Export the item.
- Download as PDF (dashboards only). Export the dashboard in PDF format.
- Copy. Make a copy of the item. Specify the folder to store the copy and click Save.
- Rename. Enter a new name for the item.
- Go to File Location. Go to the library folder where the item is stored.
- Schedule (dashboards only). Set up a schedule to send the dashboard to selected email recipients according to a schedule. See Manage Dashboards.
- Schedule Stream (playbooks only). See Create a stream.
- Create Use Case (playbooks only). Share a use case, which consists of a playbook along with its associated resources, which can include event types, integrations, modules, or connections. See Share use cases with others.
- Configure Event Type (playbooks only). See Create event types.
- Delete. Remote the selected item.
Perform actions on multiple items
When you select checkboxes for one or more items, the gray action bar displays the actions that you can perform on multiple items. The available actions vary according to the entity type, and some actions may be grayed out, depending on your permissions level for the entity type.
Share selected items
To share specified items, select the checkboxes for them and then click Share on the gray action bar.
To move items or folders from one location to another, select the checkboxes for them and then click Share on the gray action bar. Navigate to select the destination location, and click Move.
Change the table view
To change between the list view and folder view on a library page, select from the menu on the right of the gray action bar. The list view shows all of the items without reference to the folders that they are in. The Folder View shows the folders that contain any of the items and allows you to navigate the folder hierarchy. As you navigate, a breadcrumb at the top of the page indicates your location. The Type menu on the right of the gray action bar allows you to select the types of entities to display in the folders.
Updated 8 months ago