Working with the investigations list
Note
This feature is in the Preview stage. To get access, contact tech support or your account manager.
This section describes how to work with the investigations list: filter investigations by date, search by name and tags, and sort by modification date.
Getting started
The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.
You need the ycem.editor role to use the service.
Opening the investigation list
To open the investigation list:
- Go to Security Deck.
- In the left-hand panel, select Yandex SIEM.
- Navigate to the Investigations tab.
The list displays all investigations for which you have access permissions.
Filtering by creation date
To filter investigations by creation date:
- Navigate to Investigations.
- Click the date filter.
- Select a period:
- Certain date.
- Date range.
- Apply the filter.
The list will refresh to only show investigations created within the selected period.
Searching by name or tag
To find an investigation:
- Navigate to Investigations.
- Enter your keywords in the search field.
- The results will be displayed automatically.
The system will search for keywords in the following fields:
- Investigation name.
- Investigation description.
- Tags.
Tip
Use tags for quick category-based searches, e.g., prod, security-incident, february-2024.
Sorting by modification date
To sort investigations:
- Navigate to Investigations.
- Click the Modified column header.
- Select the sort order:
- Ascending, i.e., from oldest to newest.
- Descending, i.e., from newest to oldest.
By default, investigations are sorted by modification date in descending order.
Viewing investigation information
The investigations list displays the following details for each investigation:
- Name: Brief description of the investigation's purpose.
- Creation date: Timestamp when the investigation was created.
- Last modified date: Timestamp of the most recent modification.
- Tags: Keywords to group and search for investigations.
To open an investigation, click its name in the list.