To investigate what activity triggered an AI Engine (AIE) event, you can drill into a selected event from a Dashboard. All associated data is available for further analysis on the Analyze page.
To drill into a selected AIE event:
-
From the Analyzer grid on a Dashboard, click and select an AIE event row.
-
In the Details & Actions pane, click the AIE Drill Down button.
A search is initiated in the task menu.
When using an Events Dashboard, searches are initiated through the AIE Cache drilldown service.
When using a Data Indexer (DX) Dashboard, searches are initiated using the LogID values in the SourceLogID metadata field to pull back the exact logs that triggered the AIE event.
When the search is finished, click the Completed: All Results link in the taskbar. The Analyze page opens with charts and grids that display more information about the associated AIE event.
SourceLogID Field in AIE Event Drilldown
When an AIE rule triggers, the resulting AIE Event contains a SourceLogID field that stores references to the specific source logs that caused the event to fire. This field acts as a bridge between the correlated event and its underlying raw log data.
SourceLogID Event Creation
When an AIE rule evaluates incoming logs and detects a match, the system captures the log identifiers of all triggering logs in the SourceLogID field of the generated AIE Event.
Drilldown Process
When an analyst clicks the AIE Drill Down button on an AIE event from a DX Data Dashboard:
-
The system extracts the SourceLogID values from the highlighted AIE Event.
-
These IDs are automatically used to construct a search query. For example,
logId:("1a012351-dd04-4644-a6b4-bea4f935608b","78a49a18-f748-4d7f-b6ea-4fe7234e90a2") -
The search retrieves the exact source logs that triggered the correlation rule.
-
Results are displayed in a new Analyze page.