Security Analytics—additional updates following 2.5 release

[cwillum]

Signed-off-by: cwillum cwmmoore@amazon.com

Description

Some updates didn't make it into 2.5. These are follow up changes and some refinements.

Issues Resolved

Reordered some field mapping documentation to treat automatic mapping first and pending mapping second, changed language in the Alert setup section of detection creation, and other small refinements.

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[alicejw1]

Nice work!

[alicejw1]

Suggested change

The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. You can select the criteria (rules, rule severity, and tags) in any combination to define a trigger. Once a trigger is defined, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.

The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. You can select the criteria such as rules, rule severity, and tags in any combination to define a trigger. Once a trigger is defined, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.

[cwillum]

I agree, it's a little clunky like that. These three criteria, however, are the only three criteria. So "such as" doesn't work. But I've run them into the sentence to address the problem you point out.
"You can select rule names, rule severity, and tags in any combination to define a trigger."
Thanks.

[Naarcha-AWS]

Echoing what Alice said but with a different suggestion:

Suggested change

	The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. You can select the criteria (rules, rule severity, and tags) in any combination to define a trigger. Once a trigger is defined, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.
	The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. Detection rule criteria includes the following:
	- Rules
	- Rule severity
	- Tags
	After defining the trigger, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.

[cwillum]

This is just a basic description of what is to follow. Each of the three configuration settings are addressed separately in step two of Alert setup (immediately below this). I don't really want to make a big deal about these three settings at this point - I just want to make the process familiar and then mention each in detail in the steps.
Generally for alert setup you make selections for the rule criteria and configure a notification if you want a notification. The specific steps are covered in material that follows. It doesn't really make sense to emphasize these here, not emphasize the steps for notifications, and then re-emphasize the rule criteria in steps a few lines later.

[cwillum]

Thanks Alice.

[cwillum]

I agree, it's a little clunky like that. These three criteria, however, are the only three criteria. So "such as" doesn't work. But I've run them into the sentence to address the problem you point out.
"You can select rule names, rule severity, and tags in any combination to define a trigger."
Thanks.

[Naarcha-AWS]

A couple comments, but looks good.

[Naarcha-AWS]

Echoing what Alice said but with a different suggestion:

Suggested change

	The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. You can select the criteria (rules, rule severity, and tags) in any combination to define a trigger. Once a trigger is defined, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.
	The third step in creating a detector involves setting up alerts. Alerts are configured to create triggers that, when matched with a set of detection rule criteria, send a notification of a possible security event. Detection rule criteria includes the following:
	- Rules
	- Rule severity
	- Tags
	After defining the trigger, the alert setup lets you choose the channel on which to be notified and provides options for customizing a message for the notification.