This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Setting up Security Analytics

Before Security Analytics can begin generating findings and sending alerts, administrators must create detectors and make log data available to the system. Once detectors are able to generate findings, you can fine-tune your alerts to focus on specific areas of interest. The following steps outline the basic workflow for setting up components in Security Analytics.

1. Create threat detectors and alerts, and ingest log data. See Creating detectors for more information.
2. Consider creating correlation rules to identify connections between events and possible threats occurring in different logs throughout your system.
3. Inspect findings generated from detector output and create any additional alerts.
4. If desired, create custom rules to better focus detectors on high-priority concerns in your system. See Creating detection rules for more information.

Navigate to Security Analytics

1. To get started, select the top menu on the Dashboards home page and then select Security Analytics. The Overview page for Security Analytics is displayed.
2. From the options on the left side of the page, select Detectors to begin creating a detector.