Sysdig Sage

Sysdig Sage is an AI cloud security assistant that helps you use Sysdig Secure CNAPP with multi-step conversations. You can ask questions in regular language about your runtime events from the Events Feed, or how to query your Inventory resources with SysQL. Sysdig Sage is currently available for CDR and Search.

Enable Sysdig Sage

To enable Sysdig Sage:

  1. Log in to Sysdig Secure as an Admin.

  2. Select Settings > Sysdig Sage | Activation and T&C.

If you are not an Admin, contact your Admin to enable Sysdig Sage for you.

To enable Sysdig Sage for another user, you must create a custom role and team:

Create a Custom Role for Sysdig Sage

To use Sysdig Sage, create a custom role and assign the required permissions:

  1. Log in to Sysdig Secure as an Admin.

  2. Select Settings > Roles.

  3. Create a New Role for Sysdig Sage.

  4. Grant the following permissions:

PermissionsSettings
Sage: Full Access

Events: Read only

Captures and Investigate: Custom

  1. Click Save.

For more information about creating roles, see Create a Custom Role.

Next, you must create a team for Sysdig Sage Users.

Create a Team for Sysdig Sage

We recommend you create a team for Sysdig Sage users for ease of operations:

  1. Select Settings > Teams.

  2. Select Add team.

  3. Configure the team and select Save.

For more information about team creation, see Create a Team.

Assign Users to the Sysdig Sage Role

Add users to the Team you set up for Sysdig Sage users and assign them the custom role you created for Sysdig Sage. See Assign a User to a Team for more information.

  1. Log in to Sysdig Secure as an Admin.

  2. Select Settings > Teams.

  3. From the Teams page, select the team you configured.

  4. In the Team Users tab, select Assign User.

  5. For User, select the user from the drop-down. For Role, select the Sysdig Sage role you configured.

  6. Select Save.

The user now has access to Sysdig Sage.

Get Started with Sysdig Sage

  1. Log in to Sysdig Secure.

  2. Click the Sysdig Sage icon on the top-right corner of the screen.

  3. Enter your prompt.

    See Example Prompts for more information.

  4. Optionally, you can perform the following operations:

    OperationsSettings
    Clear Chat

    Close the Sysdig Sage window

    Expand the Sysdig Sage window

    Minimize the Sysdig Sage window

Disable Sage

As an account administrator, you can disable Sage from Settings > Sysdig Sage | Activation and T&C. Once disabled, Sage will be deactivated for all users in your account.

To remove specific users:

  1. Navigate to Settings > Teams.
  2. Select the team you created for Sage users.
  3. Click the Team Users tab and locate individual users for removal.
  4. Select the three-dot menu on each row and click Remove user.