> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/streams/add-stream.md). # Add Stream Click **Add Stream** in the upper-right corner of the [Streams overview](/docs/manual/english/platform-usage/siem/advanced-settings/streams.md#my-streams-overview) to create a new stream. The **SIEM** → **Streams** → **Add** view opens.

After configuring all settings, click **Add Stream** to save and create the new stream. Click **Back** to return to the list view. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Stream**, all configured settings will be permanently lost. {% endhint %} *** ## Navigation The view for adding a stream is divided into two areas. The left side contains various [settings](#left-side-of-the-view). Depending on the selected tab, the right side contains the following views: * [Tab: Result Preview](#tab-result-preview) * [Tab: Incidents](#tab-incidents) * [Tab: Incident Detection](#tab-incident-detection) * [Tab: Final Data Query](#tab-final-data-query) *** ## Left Side of the View On the left side, you can configure various settings for your stream. ### General Settings Here you can configure various basic settings.

The following options are available:

Option	Description
Name	Enter a meaningful name for the stream.
Description	Provide a more detailed description of the stream. This field is optional.
Tags	Assign tags to the stream. This field is optional. Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text input to find tags in the list more quickly. You can also enter new custom tags. Press Enter to confirm your input. Click the Remove icon next to an added tag to remove it from the Tags field.
Severity	Select a severity for SIEM incident that are triggered by the stream. The default severity is Medium. Click the Severity field to expand a list of all available severity levels, then select a severity. The following severity levels are available: Critical: An incident triggered by the stream has very high criticality. High: An incident triggered by the stream has high criticality. Medium: An incident triggered by the stream has medium criticality. Low: An incident triggered by the stream has low criticality. Informational: An incident triggered by the stream is for informational purposes only.

*** ### Search Filter Here you create the actual stream by adding one or more search filters that are used to filter the log entries in the [data lake](/docs/manual/english/platform-usage/siem/data-lake.md).

#### Text Search Click the **Text Search** field to enter specific fields, values, or complete data queries.

#### Adding a Filter Click **+ Add Search Filter** to open a new window where you can create a new filter. As soon as you select a field in the **Field Name** input field, a **Result Preview** is also shown on the right side of the window. It shows the values that are available for the selected field.

Click the **List** icon above the result preview on the right to enable filter-based search and show only values that are available within the currently applied filter rules. Click the **Globe** icon above the result preview on the right to disable filter-based search and show all available values for the selected field. The following filter options are available on the left side of the window:

Option	Description
Field Name	Shows the complete field name and the field type of the field for which you are configuring the settings.
Operator	Select the operator that should apply to the filter. The default operator is Equals. Click the Operator field to expand a list of all available options. The following options are available: Equal: Shows only log entries in which the value in the field exactly matches the specified value. Unequal: Shows only log entries in which the value in the field does not match the specified value. Exists: Shows only log entries in which the field exists. Not Exists: Shows only log entries in which the field does not exist.

Option

Description

Field Name

Shows the complete field name and the field type of the field for which you are configuring the settings.

Operator

Select the operator that should apply to the filter.

The default operator is Equals.

Click the Operator field to expand a list of all available options.

The following options are available:

Equal: Shows only log entries in which the value in the field exactly matches the specified value.
Unequal: Shows only log entries in which the value in the field does not match the specified value.
Exists: Shows only log entries in which the field exists.
Not Exists: Shows only log entries in which the field does not exist.

The following fields are shown only if you select **Equal** or **Unequal** as the **Operator**.

Option	Description
Value	Enter the field value to which the operator should be applied. Click the Plus icon next to the Value field to add additional field values to the filter. OR Click an available value in the Result Preview on the right to add it directly to the filter on the left. Click a value again to remove it from the selection. Added values are indicated by a pink bar. Click the Delete icon next to an added value in the Value field to remove it.
Logical Link	This option is visible only if you specify two or more values. Select how the specified values should be combined. The default logical link is Or. The following options are available: Or: At least one of the values entered above must exist in the corresponding field of a log entry. And: All values entered above must be exist in the corresponding field of a log entry.
Exact Match	Define whether the spelling of the values entered above must exactly match the values in the actual log entries, including capitalization. When this option is enabled, only log entries with an exact, case-sensitive match are shown. This option is enabled by default.
Case Insensitive	Define whether the spelling of the values entered above should match the values in the actual log entries without considering capitalization. When this option is enabled, only log entries that match regardless of capitalization are shown. This option is disabled by default.
Regular Expression	Define whether you want to use regular expressions to define field values for filtering. When this option is enabled, you can use regular expressions in the Value field. This option is disabled by default.

Click **Add Filter** to apply the filter to the stream. Click **Close** to return to the stream settings without applying the filter. #### Editing Applied Filters After adding a filter, it is shown in the [search filters](#search-filter) section below the **Text Search** field.

You have several options for editing it. \--------------- **Option 1: Editing the Filter Operator** Click an operator in the filter string to change it.

The following options are available:

Operator	Description
= (Equal) or ≠ (Unequal)	Click the operator to expand a list of all available options, then select the desired option. Only operators that are not currently applied to the filter are shown. The following options are available: = (Equal): Shows only log entries in which the value in the field exactly matches the defined value. ≠ (Unequal): Shows only log entries in which the value in the field does not match the defined value. Other: Select this option to choose an operator other than = (equal) or ≠ (unequal). The advanced filter settings window opens, where you can edit the configured filter settings.
Exists or Does Not Exist	Click the Exists or Does Not Exist operator to open the advanced filter settings window, where you can edit the configured filter settings.

Operator

Description

= (Equal)

≠ (Unequal)

Click the operator to expand a list of all available options, then select the desired option.

Only operators that are not currently applied to the filter are shown.

The following options are available:

= (Equal): Shows only log entries in which the value in the field exactly matches the defined value.
≠ (Unequal): Shows only log entries in which the value in the field does not match the defined value.
Other: Select this option to choose an operator other than = (equal) or ≠ (unequal). The advanced filter settings window opens, where you can edit the configured filter settings.

Exists

Does Not Exist

Click the Exists or Does Not Exist operator to open the advanced filter settings window, where you can edit the configured filter settings.

\--------------- **Option 2: Editing the Filter Connection** A logical operator is visible only if you have applied at least two filters. Click the logical operator between two filters to expand the available options, then select an option. {% hint style="info" %} The default filter combination is **AND**. {% endhint %}

The following logical operators are available: * **AND**: All applied filters must match a log entry for it to be shown. * **OR**: At least one of the applied filters must match a log entry for it to be shown. \--------------- **Option 3: Editing the Filter Expression** Click the **Edit** icon on the right side of the filter string. You can then edit the filter expression manually using raw query syntax.

After making all changes, click **Apply** to apply the filter. {% hint style="warning" %} **Please note:** When you combine more than two filters and switch between **AND** and **OR**, place the filter logic that should be evaluated first in parentheses to define the evaluation order. In the following example, the search first checks for SSH and security notifications before evaluating the date: `(gen.product:"SSH" AND gen.facility:"security/authorization messages") OR gen.timestamp:"2026-01-28"` {% endhint %} \--------------- **Option 4: Removing a Filter** Click the **Remove** icon next to an applied filter to delete it. *** ### Stream Combination In the **Stream Combination** section, you can combine the stream you are currently creating with existing streams to enable more complex data lake queries. Click **+ Add Stream Combination** to combine the current stream with one or more existing streams.

Two or more conditions can be connected using the **AND** or **OR** operator. You can also add a subcondition to a condition. {% hint style="info" %} Conditions and subconditions can be nested. This is shown graphically as a hierarchical condition tree. {% endhint %} The following options are available:

Option	Description
Operators	Select how you want to connect two or more streams. The following operators are available: AND: The applied filters from both the first and the second stream must match for log entries to be shown in the data lake. OR: The applied filters from at least one stream must match for log entries to be shown in the data lake.
Event Stream	Select the first stream that you want to combine with the stream you are currently creating. Click the Event Stream field to expand a list of all available streams, then select a stream. Alternatively, use the free-text input to find streams in the list more quickly. Click the Remove icon to remove a selected stream from the Event Stream field. Click the Delete icon to remove the entire Event Stream field from the condition tree.
Requirement	Add another stream to the stream combination. Click Requirement to show another Event Stream field. Click the Event Streams field to expand a list of all available streams, then select a stream. Alternatively, use the free-text input to find streams in the list more quickly. Click the Remove icon to remove a selected stream from the Event Stream field. Click the Delete icon to remove the entire Event Stream field from the condition tree.
Subrequirement	Add a subcondition to a stream combination condition. The subcondition must match for log entries to be shown in the Data Lake. Click Subrequirement to show additional options. A subordinate branch opens in the condition tree. Configure it as described in the Requirement row.

*** ### Global Exceptions Here you can [add global exceptions](#global-exceptions) to the stream. These exceptions are excluded from the final data query for the stream. {% hint style="danger" %} **Please note**: Before you can add a global exception here, you must first create it under **SIEM** → **Advanced Settings** → [Global Exceptions](/docs/manual/english/platform-usage/siem/advanced-settings/global-exceptions.md). {% endhint %}

Click **Add Global Exception** to show the **Global Exceptions** input field. Click the **Global Exceptions** field to expand a list of all available global exceptions, then select a global exception from the list. Click the **Delete** icon at the end of an input field to remove the corresponding global exception. *** ## Right Side of the View On the right side, you can use tabs to switch between four different views: * [Tab: Result Preview](#tab-result-preview) * [Tab: Incidents](#tab-incidents) * [Tab: Incident Detection](#tab-incident-detection) * [Tab: Final Data Query](#tab-final-data-query) *** ### Tab: Result Preview This tab shows a real-time preview of all log entries from the [data lake overview](/docs/manual/english/platform-usage/siem/data-lake.md#data-lake-log-overview) that match your current [search filters](#search-filter) and, if specified, [stream combinations](#stream-combination).

You can change the displayed time period as follows:

Defining Start and End Time

Click **Start Time** or **End Time** in the upper-right corner to define the start or end time for the displayed data. The date picker opens. #### Relative Time Period Set a **Relative Time Period** manually. You can also select a relative time range from one of the **templates**.

Click the field with the default setting **Days Ago** to expand a list of all available time units, then select a time unit. Enter the number of seconds, minutes, hours, days, or weeks you want to display in the numeric field. The default value is **1**. Click **Apply** to confirm your settings. #### Absolute Time Period Select a date from the calendar view.

Optionally, click **Time** to set an exact time in 24-hour format using the dial. First select an hour. The dial then switches to the minute view. Select the minutes accordingly. Click **Apply** to confirm your settings.

Click **Refresh** to retrieve the latest log entries based on the [search filters](#search-filter) applied to the stream. Click **Show More** below a log preview to display all fields and values of the corresponding log entry.

Click a field value within a log entry to add a filter for that value. The [Add Filter](#add-filter) window opens with the selected value already entered. Added filters are displayed in the [Search Filters](#search-filter) section. *** ### Tab: Incidents This tab contains a list of all SIEM incidents that were triggered based on the respective stream. {% hint style="info" %} When you create a new stream, this view is empty. {% endhint %}

The incidents view is structured as a table. The following information is shown:

Column	Description
Severity	Shows the incident severity based on the respective stream settings.
Event Started	Shows the date and time when the incident was first detected.
Event Ended	Shows the date and time when the incident ended.
Hosts	Shows the host that was affected by the incident.
Created at	Shows the date and time when the corresponding list entry was created.

Click the **Refresh** icon in the upper-right corner of the list to refresh the incidents view. *** ### Tab: Incident Detection This tab contains various settings related to the automatic SIEM incident detection. If the automatic incident detection is enabled for a stream, incidents triggered by the stream are shown under **SIEM** → [Incidents](/docs/manual/english/platform-usage/siem/incidents.md) and on the [Incidents tab](#tab-incidents). {% hint style="warning" %} **Please note**: To receive notifications about triggered incidents, you must first create an Alert of the **Stream (SIEM)** type under **Alerts** → [Add Alert](/docs/manual/english/platform-usage/alerts/overview/add-alert.md#alert-type). {% endhint %} {% hint style="danger" %} **Please note**: To use this new feature, you must [update the Enginsight Loggernaut component](/docs/manual/english/installation-und-konfiguration/updates/enginsight-siem.md#updating-loggernaut) to **version 2.14.x**. {% endhint %} Select the checkbox next to **Enable Incident Detection** to enable the automatic incident detection for the stream. Additional settings are shown.

#### Incident Delay Define a time period during which no additional alert notifications are sent for the same incident to prevent an alert flood. Click **Add Delay** to show the fields for defining an incident delay.

The following options are available:

Option	Description
Value	Enter a time value as an integer. Alternatively, use the and buttons to increase or decrease the value.
Unit	Select a time unit. The default time unit is Minutes. Click the Unit field to expand a list of all available time units, then select a unit from the list. The following time units are available: Seconds Minutes Hours Days Weeks

Option

Description

Value

Enter a time value as an integer. Alternatively, use the and buttons to increase or decrease the value.

Unit

Select a time unit.

The default time unit is Minutes.

Click the Unit field to expand a list of all available time units, then select a unit from the list.

The following time units are available:

Seconds
Minutes
Hours
Days
Weeks

Click the **Delete** icon next to the input fields to remove the defined incident delay. #### Grouping Select a log field based on which log entries in the data lake that have the same value are grouped and shown as a single incident. This prevents a separate incident from being triggered for each log entry, which would otherwise create a flood of incidents of the same type. Click **Add Group** to show a field for defining a grouping.

Click the **Field Name** field to expand a list of all available log fields, then select a log field from the list. Alternatively, use the free-text input to find log fields in the list more quickly. Click the **Delete** icon next to an input field to remove the specified grouping. #### Detection Period Define a specific time period during which incidents based on the stream may be triggered and shown. Click **Add Schedule** to show fields for defining a detection period. Different options are available depending on whether you select the [Time Window](#time-window) tab or the [Expert Mode](#expert-mode) tab. {% tabs %} {% tab title="Time Window" %} This section is visible only if you select the **Time Window** tab under **Detection Period**.

The following options are available:

Option	Description
From	Enter the start time of the detection period. The default time is 08:00. Click the From field and use the dial to set an exact time in 24-hour format. First select an hour. The dial then switches to the minute view. Select the minutes accordingly.
To	Enter the end time of the detection period. The default time is 18:00. Click the To field and use the dial to set an exact time in 24-hour format. First select an hour. The dial then switches to the minute view. Select the minutes accordingly.
Weekdays	Select the weekdays for the detection period. Selected weekdays are highlighted in pink color. The default weekdays are Monday, Tuesday, Wednesday, Thursday, and Friday. Click a weekday abbreviation to select it. Click the abbreviation again to deselect it.

Option

Description

From

Enter the start time of the detection period.

The default time is 08:00.

Click the From field and use the dial to set an exact time in 24-hour format. First select an hour. The dial then switches to the minute view. Select the minutes accordingly.

Enter the end time of the detection period.

The default time is 18:00.

Click the To field and use the dial to set an exact time in 24-hour format. First select an hour. The dial then switches to the minute view. Select the minutes accordingly.

Weekdays

Select the weekdays for the detection period. Selected weekdays are highlighted in pink color.

The default weekdays are Monday, Tuesday, Wednesday, Thursday, and Friday.

Click a weekday abbreviation to select it. Click the abbreviation again to deselect it.

{% endtab %} {% tab title="Expert Mode" %} This section is visible only if you select the **Expert Mode** tab under **Detection Period**.

Enter a detection period as a cron expression. Click the **Cron Expression** field and enter a cron expression manually. Alternatively, click the **Expand** icon in the **Cron Expression** field. The [time interval selection](broken://pages/1a2835a8cf2a7cb175e6eba1e6087256626d3632#time-interval-selection) opens, allowing you to create a custom time window. #### Time Interval Selection #### Time Interval Selection

The following options are available:

Option	Description
Time Zone	Define the time zone that you want to use for the selected time interval. Click the Time Zone field to expand a list of all available time zones, and select a time zone.
Cron Expression (Vixie/Unix)	Shows the defined interval as a cron expression. The cron expression is updated automatically whenever you configure a time interval manually. Click the Cron Expression field to edit the cron expression manually.
Next Execution (Local Time Zone)	Shows the exact date and time of the next execution in your browser’s local time zone.
Description	Shows the defined interval for recurring execution as a plain-language description.
Time Interval Selection	Define a custom execution interval. Select the relevant minutes, hours, days of the month, months, or days of the week.

{% endtab %} {% endtabs %} Click the **Delete** icon next to an input field to remove the specified time window. *** ### Tab: Final Data Query This tab shows the final data query for the stream as a raw syntax expression. {% hint style="info" %} The final data query cannot be edited. {% endhint %}

***