Manage Profiles

In the Manage Profiles page, you can view the list of configured alert profiles and their attributes, such as alert type, alert severity, device/groups configured, etc. You can also enable, disable, export, and import alert profiles from this page.

Manage profile consolidates Profile Based Alerts and Correlation Alert Profiles under a single dropdown menu, allowing users to view and filter all profiles in one console based on their needs.

Filter Profiles

To filter alert profiles based on the status (Enabled/Disabled/All), click on the dropdown menu next to Showing and select the required category.

For example, if you want to view all your disabled alerts, you can simply select Disabled in the Showing field. All your disabled alerts will be displayed on the screen.

Export/Import Alert Profiles

Log360 Cloud enables you to export or import your configured alert profiles in the form of an XML file.

To export alert profiles, follow the steps given below.

1. Navigate to the Manage Profiles page under the Alerts tab.
2. Select the required Alert profiles to be exported by ticking the corresponding boxes.
3. Click on the icon and select Export.

   

4. Now the alert profile will be exported to your download location in the form of an XML file.

To import alert profiles, follow the steps given below.

1. Navigate to the Manage Profiles page under the Alerts tab.
2. Click on the icon and select Import.
3. Select the location of the XML file and click on Import.
4. The alert profile will be imported from your download location to Log360 Cloud.

What are Sigma rules?

Sigma is a text-based format for describing security events in log data, which simplifies security threat detection.

Log360 Cloud allows you to import these rules in the Alerts tab.

From Alerts:

• Navigate to the Alerts tab, and select Manage Profiles. Choose the Import option.



• Log360 Cloud supports importing Sigma rules from YML files.



• During the import process, you will have the option to map fields and the log type associated with the Sigma rule. Click Save.



• Click Save to finalize the import process. Log360 Cloud will store the imported Sigma rule profile along with its defined criteria.

Filtering alerts using Alert Profiles

To display the alerts of a particular alert profile, click on the number of alerts under the No. of Alerts column. Now the filter to display the alerts of the selected alert profile will automatically be applied in the Active Alerts page.

Edit Alert Profile:

To edit an existing alert profile, hover over the required alert profile and click on the icon. You will be directed to the Edit Alert Profile page. Here, you can make changes to the alert profile as required.

Delete Alert profiles

To delete an alert profile, select the alert profile and click on the icon. A pop-up will appear asking for confirmation. Click on yes to confirm the deletion.