Getting started with Yandex SIEM

In this tutorial, you will create an investigation and run your first KQL (Kusto Query Language) query.

Getting startedGetting started

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the ycem.editor role to use the service.

Create an investigationCreate an investigation

1. Go to Security Deck.
2. In the left-hand panel, select Yandex SIEM.
3. Navigate to the Investigations tab.
4. Click New investigation.
5. Enter a name for your investigation, e.g., Failed login analysis.
6. Under Description, add a description: Searching for failed console login attempts within the last 30 minutes.

Create a queryCreate a query

1. In the query editor, enter the following KQL query:

   Events
   | project event_class, ['time']
   | limit 1
   

   This query:

   • Selects events from the Events table.
   • Displays the event_class and time fields.
   • Limits the result to a single entry.

2. Set the time period to Last 30 minutes.

3. Click the query run button.

Analyze the resultsAnalyze the results

After the query is completed, the results are displayed in a table with the following fields:

• event_class: Event class.
• time: Event time.

This is an example of a simple query which checks service performance. For more complex analysis, use additional queries and filters.

What's nextWhat's next

• Learn more about investigations and queries.
• Learn how to manage investigations.
• Explore working with queries.
• Review the KQL reference.