Sysdig Sage

Sysdig Sage for Cloud Detection and Response

Sysdig Sage for Cloud Detection and Response (CDR) primarily targets users working in security operations responsible for incident response and forensics. It helps you reduce response time and speed up investigations. For example, Sysdig Sage for CDR can:

• Explain command lines
• Explain rules
• Interpret data
• Suggest areas to investigate for a particular issue
• Recommend next steps

Sysdig Sage’s multi-level conversation:

• Summarization: Offers top statistics for runtime security events based on various groupings such as policy name, rule, event type, severity, and more.
• Explainability: Provides in-depth information about specific security events.

Enable Sysdig Sage

To enable Sysdig Sage:

1. Log in to Sysdig Secure as an Admin.

2. Select Settings > Sysdig Sage | Activation and T&C.

If you are not an Admin, contact your Admin to enable Sysdig Sage for you.

To enable Sysdig Sage for another user, you must create a custom role and team:

Create a Custom Role for Sysdig Sage

To use Sysdig Sage, create a custom role and assign the required permissions:

1. Log in to Sysdig Secure as an Admin.

2. Select Settings > Roles.

3. Create a New Role for Sysdig Sage.

4. Grant the following permissions:

5. Click Save.

For more information about creating roles, see Create a Custom Role.

Next, you must create a team for Sysdig Sage Users.

Create a Team for Sysdig Sage

We recommend you create a team for Sysdig Sage users for ease of operations:

1. Select Settings > Teams.

2. Select Add team.

3. Configure the team and select Save.

For more information about team creation, see Create a Team.

Assign Users to the Sysdig Sage Role

Add users to the Team you set up for Sysdig Sage users and assign them the custom role you created for Sysdig Sage. See Assign a User to a Team for more information.

1. Log in to Sysdig Secure as an Admin.

2. Select Settings > Teams.

3. From the Teams page, select the team you configured.

4. In the Team Users tab, select Assign User.

5. For User, select the user from the drop-down. For Role, select the Sysdig Sage role you configured.

6. Select Save.

The user now has access to Sysdig Sage.

Get Started with Sysdig Sage

1. Log in to Sysdig Secure.

2. Click the Sysdig Sage icon on the top-right corner of the screen.

   

3. Enter your prompt.

   See Example Prompts for more information.

4. Optionally, you can perform the following operations:

   Operations	Settings
   Clear Chat
   Close the Sysdig Sage window
   Expand the Sysdig Sage window
   Minimize the Sysdig Sage window

Example Prompts