> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/streams.md).

# Streams

In the context of the Enginsight SIEM, streams are managed or custom log filters that allow you to selectively filter and show raw logs from the [data lake](/docs/manual/english/platform-usage/siem/data-lake.md).

Depending on the selected view, the streams overview provides an overview of all custom streams and/or streams imported from managed stream catalogs.

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Streams** to show a list of all custom streams by default. If you have not yet saved or created a stream, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FSjbbCRvLZT7Age1Iy5dy%2FEnginsight-EN-SIEM-Streams-Tab%20My%20Streams.jpg?alt=media&amp;token=3f0a3aad-46e2-4d5e-96e1-af18835162bd" alt=""><figcaption></figcaption></figure>

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-filter">:filter:</i> **My Streams** in the upper-right corner to expand a submenu that allows you to switch between the different stream overviews.

The following stream overviews are available:

* [My Streams](#my-streams-overview): Shows a list of all custom streams.
* [Imported Streams](#imported-streams-overview): Shows a list of all imported streams managed by Enginsight, including the stream catalogs to which the streams are assigned.
* [All Streams](#all-streams-overview): Shows a list of all custom and managed streams.

You can also [create new streams](#add-stream).

***

## Navigation

Each stream overview is divided into two areas. The left side contains a [filter list](#left-side-filter-list), while the right side contains a [list of all available streams](#right-side-stream-list) that you can customize based on the selected filters.

### Left Side: Filter List

<div align="left"><figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FGzpS72mJ3PXbfsidUeYD%2FEnginsight-EN-SIEM-Streams-Filter%20List.jpg?alt=media&amp;token=254b70b9-7f75-4537-9d5b-591bff1a39fe" alt="" width="200"><figcaption></figcaption></figure></div>

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a filter item to apply the corresponding filter to the stream list on the right side.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list to view additional entries.

### Right Side: Stream List

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

#### Filtering the List

<details>

<summary>Available Filters: My Streams</summary>

<table><thead><tr><th width="171.03515625">Parameter</th><th width="140.8359375">Type</th><th>Description</th></tr></thead><tbody><tr><td>Incident Detection</td><td>Boolean</td><td><p>Filter for all streams for which the automatic incident detection is enabled, or for those for which it is not.<br><br>The following values are available:</p><ul><li><strong>True</strong>: Automatic incident detection is enabled.</li><li><strong>False</strong>: Automatic incident detection is not enabled.</li></ul></td></tr><tr><td>Severity</td><td>String</td><td>Filter for all streams with a specific severity, or exclude them from the results. All available severity levels are shown.</td></tr></tbody></table>

</details>

<details>

<summary>Available Filters: Imported Streams</summary>

<i class="fa-filter-list">:filter-list:</i> The filters available here correspond to the [filter list](#left-side-filter-list) on the left side of the view.

</details>

<details>

<summary>Available Filters: All Streams</summary>

<i class="fa-filter-list">:filter-list:</i> The filters available here correspond to the [filter list](#left-side-filter-list) on the left side of the view.

</details>

#### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

#### Deleting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items.

The <i class="fa-trash">:trash:</i> **Delete** button then appears in the upper-right corner. Click it and confirm the prompt by clicking **Delete Permanently**.

{% hint style="danger" %}
**Please note**: Deleted items cannot be recovered.
{% endhint %}

#### Further Actions for List Items

The following action is available for each list item:

<table><thead><tr><th width="210.0546875">Action</th><th>Description</th></tr></thead><tbody><tr><td>Highlight</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click the <strong>Favorite</strong> icon <i class="fa-square-star">:square-star:</i> to pin the respective stream to the top of the table, regardless of the selected table sorting.</td></tr></tbody></table>

***

## My Streams: Overview

The **My Streams** overview is structured as a table.

<div align="left"><figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FUaJ9M5Tyu7r7ZUv2tWz3%2FEnginsight-EN-SIEM-Streams-Tab%20My%20Streams-Overview.jpg?alt=media&amp;token=2e44989d-8e4b-45a3-92ce-9803776dfefb" alt=""><figcaption></figcaption></figure></div>

The following information is shown:

<table><thead><tr><th width="199.9296875">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td>Shows the name of the custom stream, an additional description, and assigned tags, if provided.<br><br>The date and time it was created and the date and time it was last edited are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream to navigate to the respective <a href="#stream-edit-view">edit view</a>. There, you can adjust the configured settings and delete the stream.</td></tr><tr><td>Incidents</td><td><p>Shows whether the automatic incident detection is enabled for the respective stream.</p><p></p><p>When the automatic incident detection is enabled, a green <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:green;">:bell-ring:</i> is shown. When the automatic incident detection is disabled, a gray <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:$info;">:bell-ring:</i> is shown.</p></td></tr></tbody></table>

***

## Imported Streams: Overview

The **Imported Streams** overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FzJ8dlb8F0sZ4LeOowrXw%2FEnginsight-EN-SIEM-Streams-Tab%20Imported%20Streams.jpg?alt=media&amp;token=44046983-b0a6-4046-b883-347fd89ee8ec" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="199.9296875">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td>Shows the name of the custom stream, an additional description, and assigned tags, if provided.<br><br>The date and time it was created and the date and time it was last edited are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream to navigate to the respective <a href="#stream-edit-view">edit view</a>. There, you can adjust the configured settings and delete the stream.</td></tr><tr><td>Catalog</td><td>Shows the name of the custom stream catalog that contains the stream.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a catalog to navigate to the respective <a href="/docs/manual/english/platform-usage/siem/stream-catalogs/stream-catalog-detail-view.md#catalog-settings">edit view</a>. There, you can adjust the configured settings and delete the catalog.</td></tr><tr><td>Events</td><td><p>Shows whether the automatic incident detection is enabled for the respective stream.</p><p></p><p>When the automatic incident detection is enabled, a green <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:green;">:bell-ring:</i> is shown. When the automatic incident detection is disabled, a gray <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:$info;">:bell-ring:</i> is shown.</p></td></tr></tbody></table>

***

## All Streams: Overview

The **All Streams** overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FV3G9OJ5iKx33AjTgEbtU%2FEnginsight-EN-SIEM-Streams-Tab%20All%20Streams.jpg?alt=media&amp;token=25befe1d-be0a-4740-a5fc-ff5625d3acc2" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="199.9296875">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td>Shows the name of the custom stream, an additional description, and assigned tags, if provided.<br><br>The date and time it was created and the date and time it was last edited are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream to navigate to the respective <a href="#stream-edit-view">edit view</a>. There, you can adjust the configured settings and delete the stream.</td></tr><tr><td>Events</td><td><p>Shows whether the automatic incident detection is enabled for the respective stream.</p><p></p><p>When the automatic incident detection is enabled, a green <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:green;">:bell-ring:</i> is shown. When the automatic incident detection is disabled, a gray <strong>alert bell</strong> icon <i class="fa-bell-ring" style="color:$info;">:bell-ring:</i> is shown.</p></td></tr></tbody></table>

***

## Adding a Stream

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Stream** in the upper-right corner to [create a new stream](/docs/manual/english/platform-usage/siem/advanced-settings/streams/add-stream.md).

***

## Stream: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream to navigate to the corresponding edit view. There, you can adjust the [configured settings](/docs/manual/english/platform-usage/siem/advanced-settings/streams/add-stream.md#general-settings) and delete the stream.

{% hint style="warning" %}
**Please note**: The settings of streams managed by Enginsight can be adjusted only to a limited extent.
{% endhint %}

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Open in Data Lake</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-water">:water:</i> <strong>Open in Data Lake</strong> to show the respective stream in the <a href="/docs/manual/english/platform-usage/siem/data-lake.md">data lake</a>.</td></tr><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list view.</td></tr><tr><td>Delete</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Delete</strong> and confirm the prompt by clicking <strong>Delete</strong> to delete all configured settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Deleted settings cannot be recovered.</p></div></td></tr></tbody></table>

***