> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/stream-catalogs.md).

# Stream Catalogs

{% hint style="danger" %}
**Please note**: To use this new feature, you must [update the Enginsight Loggernaut component](/docs/manual/english/installation-and-configuration/updates/enginsight-siem.md#updating-loggernaut) to **version 2.14.x**.
{% endhint %}

***

Stream catalogs group streams by predefined or custom topics, which makes it easier to manage the streams they contain.

You can use stream catalogs managed by Enginsight or create custom stream catalogs.

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Stream Catalogs** to show a list of all stream catalogs you use. These may be custom catalogs or imported managed catalogs. If you have not created a stream catalog or imported a managed stream catalog yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FU6dchfck4yh5uTi9ETJD%2FEnginsight-EN-SIEM-Stream-Catalogs-Full.jpg?alt=media&amp;token=b114aeb5-67b3-48e0-b62c-6384e8a8cabe" alt=""><figcaption></figcaption></figure>

The [stream catalog overview](#stream-catalogs-overview) provides information such as:

* whether a stream catalog is managed.
* which filter criteria were used to select the streams that a stream catalog contains.
* how many streams a catalog contains.

You can also [create new custom stream catalogs](#option-1-create-custom-stream-catalog) or [import managed stream catalogs](#option-2-browse-managed-catalogs).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Action</td><td>String</td><td>Filter for all streams that include a specific action, or exclude them from the results. All available actions are shown.</td></tr><tr><td>False Positives</td><td>String</td><td>Filter for all streams with a specific level of false-positive detections, or exclude them from the results. All available false-positive levels are shown.</td></tr><tr><td>Vendor</td><td>String</td><td>Filter for all streams related to a specific vendor, or exclude them from the results. All available vendors are shown.</td></tr><tr><td>Product</td><td>String</td><td>Filter for all streams related to a specific product, or exclude them from the results. All available products are shown.</td></tr><tr><td>Severity</td><td>String</td><td>Filter for all streams with a specific severity, or exclude them from the results. All available severity levels are shown.</td></tr><tr><td>Type</td><td>String</td><td>Filter for all streams of a specific type, or exclude them from the results. All available stream types are shown.</td></tr><tr><td>Managed</td><td>Boolean</td><td><p>Filter by whether a stream catalog is managed.<br><br>The following values are available:</p><ul><li><strong>True</strong>: The stream is managed by Enginsight.</li><li><strong>False</strong>: The stream is not managed.</li></ul></td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Deleting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items.

The <i class="fa-trash">:trash:</i> **Delete** button then appears in the upper-right corner. Click it and confirm the prompt by clicking **Remove**.

{% hint style="danger" %}
**Please note**: Deleted items cannot be recovered.
{% endhint %}

### Additional Actions for List Items

The following action is available for each list item:

<table><thead><tr><th width="210.0546875">Action</th><th>Description</th></tr></thead><tbody><tr><td>Highlight</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click the <strong>Favorite</strong> icon <i class="fa-square-star">:square-star:</i> to pin the corresponding stream catalog to the top of the table, regardless of the selected table sorting.</td></tr></tbody></table>

***

## Stream Catalogs: Overview

The stream catalog overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FPIXAKf6Xx3TnsGFWJQWY%2FEnginsight-EN-SIEM-Stream-Catalogs-Overview.jpg?alt=media&amp;token=f5b3c4af-036a-4f0f-8f25-2567ad5014f2" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.03125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the name of the stream catalog, an additional description, and assigned tags, if provided. The date and time it was created and the date and time it was last edited are also shown.<br></p><p>Managed stream catalogs are additionally tagged with the <strong>Managed</strong> label.<br></p><p>For managed stream catalogs and custom stream catalogs in which streams were selected using filter criteria, the corresponding filter criteria are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream catalog to navigate to the <a href="#stream-catalog-detail-view">catalog detail view</a>. There, you can view all streams that the catalog contains and adjust the catalog settings.</p></td></tr><tr><td>Streams</td><td>Shows the number of streams that the catalog contains.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the <strong>Open</strong> icon <i class="fa-arrow-up-right-from-square">:arrow-up-right-from-square:</i> next to the corresponding number to navigate to the <a href="#stream-catalog-detail-view">catalog detail view</a>. There, you can view all streams that the catalog contains and adjust the catalog settings.</td></tr></tbody></table>

***

## Adding a Stream Catalog

There are two ways to add a stream catalog. You can create custom stream catalogs or use stream catalogs managed by Enginsight.

### Option 1: Creating a Custom Stream Catalog

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Create Catalog** in the upper-right corner to [add a new custom stream catalog](/docs/manual/english/platform-usage/siem/stream-catalogs/add-stream-catalog.md).

### Option 2: Browsing Managed Catalogs

Here you can import managed stream catalogs to use predefined streams grouped by topic without any additional configuration effort. Streams contained in managed stream catalogs are maintained automatically and updated whenever changes are made.

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Browse Managed Catalogs** in the upper-right corner to show a list of all available managed stream catalogs and [import selected catalogs](/docs/manual/english/platform-usage/siem/stream-catalogs/import-managed-catalogs.md).

***

## Stream Catalog: Detail View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a stream catalog to navigate to the respective [catalog detail view](/docs/manual/english/platform-usage/siem/stream-catalogs/stream-catalog-detail-view.md). There, you can find a list of all [streams](/docs/manual/english/platform-usage/siem/stream-catalogs/stream-catalog-detail-view.md#stream-list) that the catalog contains and [adjust the catalog settings](/docs/manual/english/platform-usage/siem/stream-catalogs/stream-catalog-detail-view.md#catalog-settings).

***