Create Dataset from Sigma

This introductory article describes how to define the basic settings for a Dataset sourced from Sigma.

PREREQUISITES:

1. Create New Dataset

Access New > Datasets > Create New

Enter the basics:

  1. Select the measurement interval that applies to the level of aggregation that you want in your result set
  2. Define if Dataset is to be searchable
  3. Input a descriptive phrase in Name
  4. Specify Category to place the Dataset 

Proceed to Data tab to define details

2. Define Details

  1. Select the Sigma Data Source
  2. Specify Data collection trigger that will be used to collect data for Dataset
  3. Select Element to be used as a basis for Dataset
  4. Input an SQL Plugin Command that selects the data to be fetched from Sigma
    • Specify fields to be fetched in Plugin Command in the following format "fields = comma-separated column names" OR leave it blank to pull all data
  5. [Validate]
    • If the statement is valid, the Validation Rows Preview section pops up at the bottom of the screen.
    • You can also open it by clicking Show validation rows under the Plugin command box.
  6. [Enable & View] to proceed to Dataset Viewer