Security Operations Integration - Sightings Search Flow

Security Operations Integration - Sightings Search flow is a high-level flow independent of integrations. It uses the configured queries to search for a set of observables based on the configured integrations which support the capability. Use it to fulfill an integration such as Splunk or Elasticsearch.

Before you begin

Role required: sn_si.analyst

About this task

If a security incident has an observable attached to it, this flow is triggered when you click on Run Sighting Search in the Actions on selected rows... drop-down menu in the Security Incident Observables tab.

Figure 1. Sightings Search

Activities specific to this flow are described here. For more information on other activities, see Common Security Operations integration flows and orchestration activities.

• Sightings Search - Determine Observables activity
  The Sightings Search - Determine Observables workflow activity determines which observables to include in the workflow.
• Persistent Observable Sightings activity
  The Persistent Observable Sightings workflow activity retrieves observables from the third-party integration.
• Get Observable Sightings Queries activity
  The Get Observable Sightings Queries workflow activity retrieves queries from the integration configuration.
• Security Operations - Arcsight Logger Sightings Search Flow
  Security Operations - ArcSight Logger Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search Flow.
• Security Operations - Elasticsearch Sightings Search Flow
  Security Operations - Elasticsearch Sightings Search flow is the Elasticsearch implementation launched by the Security Operations Integration - Sightings Search flow.
• Security Operations - McAfee ESM Sightings Search Flow
  Security Operations - McAfee ESM Sightings Search flow is the implementation for the McAfee Sighting Search implementation launched by the Security Operations Integration - Sightings Search Flow.
• Security Operations - QRadar Sightings Search Flow
  Security Operations - QRadar Sightings Search flow is the implementation for the IBM QRadar integration launched by the Security Operations Integration - Sightings Search flow.
• Security Operations Integration - Splunk Sightings Search Flow
  Security Operations - Splunk Sightings Search flow is the implementation for the Splunk integration launched by the Security Operations Integration - Sightings Search flow.