Overview

Once you’ve obtained an Onum account, just a few steps are needed to complete the installation, depending on the type of deployment you require. Onum supports flexible deployment options, including both on-premises and cloud environments.

In case you have any question regarding the deployment and installation process, please contact us.

Cloud Deployment

For cloud-based installations, either our Customer Success team or a partner will access Onum's internal tenant manager and create the new account. All the necessary infrastructure will be set up based on estimated usage metrics.

The deployment process is fully automated, ensuring quick and streamlined provisioning and configuration.

On-Premises Deployment

In on-premises deployments, either our Customer Success team or a partner will set up the new account. Appropriate access permissions are granted to allow Onum to perform the installation.

A validation script is run to confirm all prerequisites are met and connectivity is established, ensuring a smooth installation process. Once installed, you can access your tenant, start ingesting data, invite users, and take full advantage of Onum’s capabilities.

Hardware requirements

Hardware (per Virtual Machine):

• Distribution: Linux (Debian or Red Hat)

• Server Hardware: 16GB RAM and 8 CPU

• Disk Storage: 500GB

Access

In case of upcoming system maintenance, we kindly seek permission to access the customer infrastructure. We aim to ensure seamless operations and address any potential issues promptly.

Action

A unit of work performing a given operation on an event.

API

Application Programming Interface. A set of defined methods of communication among various components.

Cluster

Various distributors and workers can be grouped and contained within a cluster. You can have as many clusters as required per Tenant.

Data sink

Where the data is routed after being processed by Onum.

Data source

Where the data is generated before ingesting it into Onum, e.g. application server logs, firewall logs, S3 bucket, Kafka Topic, etc.

Distributor

This service receives and processes the Listener data before sending it on to workers within a cluster.

Event

An event represents semi-structured data such as a log entry. Events can be parsed so that structured data can be generated and eventually processed by the engine. Events are composed of fields, which are referred to as Field. An action that produces a new field will be referred to as outputField.

Label

Used to sort events coming from Listeners into categories or sets that meet given filters to be used in a Pipeline.

Listener

A Listener retrieves events in a given IP address and a port, routing the data to the Pipelines so that it can be processed.

Lookup

A lookup refers to searching for and retrieving information from a specific source or dataset, typically based on a key or reference.

Multitenancy

Multitenancy is an architecture in which tenants share the same underlying infrastructure, including databases and application code, but their data and configurations are kept separate to ensure privacy and security.

Pipeline

A sequence of Actions connected through inputs/outputs to process a stream of data. Data comes from the Listener and eventually is routed to a Datasink.

Role

A role is assigned to a user in order to control the access they have to certain or all Onum features. This way, we can personalise the experience for each user.

Tag

Tags can be assigned to Listeners, Pipelines or Data sinks in order to classify them or make them easier to find. This is particularly useful if you have a wide database and want to avoid lengthy searching for the resources you wish to use.

Tenant

A Tenant is a domain that contains a set of data in your organization. You can use one or various tenants and grant access to as many as required.

Worker

This service runs the Pipelines, receiving data from its distributor and contained within a Cluster.

Overview

Throughout the entire Onum platform, you can set a period to either narrow down or extend the data shown. You can either select a predefined period or apply a custom time range.

The related graph and resources will be automatically updated to display data from the chosen period. To remove a selected period, simply click the bin icon that appears next to the period to go back to the default time range (1 hour ago).

Predefined and Custom time ranges

As well as predefined time intervals, you can also define a custom time range. To do it, simply select the required starting and ending dates in the calendar.

Comparisons

The interesting thing about Onum is that you can directly see how much volume you have saved compared to past ingestions, telling you what is going well and what requires further streamlining.

The comparison is direct/equivalent, meaning all data shown is analyzed compared to the previously selected equivalent time range.

For example, if the time range is 1 hour, the calculation of differences will be carried out using the previous one hour before the current selection =

• Range selected: 10:00-11:00

• Comparison: 09:00-10:00

Again, let´s say you now wish to view data over the last 7 days. The percentages will be calculated by measuring the volume retrospectively two weeks ago with the previous week.

Quick Links

Most popular

Overview

The exponential growth of data ingestion volumes can lead to reduced performance, slow response times, and increased costs. With this comes the need to implement optimization strategies & volume reduction control. We help you cut the noise of large data streams and reduce infrastructure by up to 80%.

Gain deep insights from any type of data, using any format, from any source.

All of this...

@ the Edge

By collecting and observing that data at the edge, as close as possible to where it’s being generated, gain real-time observations and take decisive action to prevent network downtime, payment system failures, malware infections, and more.

Unlike most tools that provide data observation and orchestration, Onum is not a data analytics space, which is already served well by security information and event management (SIEM) vendors and other analytics tools. Instead, Onum sits as close as possible to where the data is generated, and well in front of your analytics platforms, to collect and observe data across every aspect of your hybrid network.

Start with the basics

These articles contain information on functionalities across the entire platform.

Welcome to Onum! This guide will help you start working with Onum, a powerful tool designed to enhance your data analysis and processing capabilities.

Accessing Onum

Once you get your Onum credentials, you only have to go to and enter them to access your Tenant.

A Tenant is a domain that contains a set of data in your organization. You can use one or various Tenants and grant access to as many as required. Learn more about working with Tenants .

Logging in

Once in , there are two ways to log in.

Log in with email address and password

Your password must be a minimum of 10 characters and include a combination of uppercase letters, lowercase letters, numbers, and symbols.

Navigating the Interface

When you access the Onum app, you'll see , where you can see an overview of the activity in your Tenant.

You can access the rest of the areas in Onum using the left panel.

Create Your First Listener

Onum receives any data through Listeners.

These are logical entities created within a Distributor, acting as the gateway to the Onum system. Configuring a Listener involves defining an IP address, a listening port, and a transport layer protocol, along with additional settings depending on the type of Listener specialized in the data it will receive.

Access the Listeners area to start working with them. Learn how to create your first Listener .

Create Your First Data Sink

Onum outputs data via Data sinks. Use them to define where and how to forward the results of your streamlined data.

Access the Data sinks area to start working with them. Learn how to create your first Data sink .

Build Your First Pipeline

Use Pipelines to start transforming your data and build a data flow. Pipelines are made of the following components:

Learn more about Pipelines .

Use cases

Do you want to check the essential steps in Onum through specific Pipelines? Explore the most common use cases in .

Overview

If your Onum installation is deployed in our Cloud, the configuration settings of a Listener would be slightly different from Listeners defined in an On-Premise deployment:

• Cloud Listeners do not have the TLS configuration settings in their creation form, as the connection is already secured.

• Cloud Listeners have an additional step in their creation process: Network configuration. Use these details to configure your data source to communicate with Onum. Click Download certificate to get the required certificate for the connection. You can also download it from the Listener details once it is created.

Learn more about the configuration steps of each Listener type .

Important Considerations

You must consider the following indications before using Cloud Listeners:

• Cloud Listener endpoints are created in Onum's DNS. This process is usually fast, and Listeners are normally available immediately. However, note that this may last up to 24-48 hours, depending on your organization's DNS configuration.

• Cloud Listener endpoints require Mutual TLS (mTLS) authentication, which means that your data input must be able to process a TLS connection and be authorized with a certificate.

• Your data input must use the Server Name Indication (SNI) method, which means it must send its hostname in the TLS authentication process. If SNI is not used, the certificate routing will fail, and data will not be received, even if the certificate is valid.

If your organization's software cannot meet points 2 and 3, you can use an intermediate piece of software to ensure the client-Onum connection, such as Stunnel.

Easy, flexible deployment in any environment while keeping them as close as possible to where the data is produced delivers unparalleled speed and efficiency, enabling you to cut the infrastructure you have dedicated to orchestration by up to 80%.

The Onum infrastructure consists of:

• Distributor: this is the service that hosts the Listener before forwarding it to Workers.

• Worker: this is the service that runs the Pipelines, receiving data from its Distributor and contained within a Cluster.

• Cluster: a container grouping Distributors and Workers. You can have as many clusters as required per Tenant.

Listeners are hosted within Distributors and are placed as close as possible to where data is generated. The Distributor pulls tasks from the data queue passing through the pipeline and distributes it to the next available worker in a Cluster. As soon as a Worker completes a task it becomes available again, and the Distributor in turn will assign it the next task from the queue.

The installation process creates the Distributor and all Workers for each data source in the cluster.

How it works

Deployment types

The Onum Platform supports any deployment type ― including on-premises, the Onum public cloud, or your own private cloud.

In a typical SaaS-based deployment, most processing activities are conducted in the Cloud.

Client-side components can be deployed on a Linux machine or on a Kubernetes cluster for easy, flexible deployment in any environment. Onum supports all major cloud environments, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

Delivery methods

Onum supports all major standards such as Netflow, Syslog, and Kafka to orchestrate data streams to any desired destination, including popular data analytics tools such as Splunk and Devo, as well as storage environments such as S3.

Description

This operation converts a string composed of values separated by a specific separator into a list of comma-separated values (data type listString).

Data types

These are the input/output expected data types for this operation:

Input data

- String of separated values to be transformed. You must enter the separator in the parameter below.

Output data

- Resulting values after transforming them into a list of comma-separated values.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to convert a series of strings representing values separated by / into a list of comma-separated values:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose String to list.

3. Set Separator to /.

4. Give your Output field a name and click Save. The values in your input field will be transformed into a comma-separated list. For example:

The default tab that opens when in the Pipeline area is the Listeners tab, which shows all Listeners in your Tenant, as well as their labels.

Use the search bar to find a specific Listener or Label.

Edit a Listener

You can edit a label from the list by clicking the ellipses next to its name and selecting Edit.

This will open the Listener Configuration and Labels for you to modify.

Create Listener

If the Listener you wish to use in the Pipeline does not already exist, you can create it directly from this view using the Create Listener button in the bottom right of the tab. This will open the Listener Configuration window.

Add a Listener to your Pipeline

Go to Building a Pipeline to learn step by step.

Although there are only a limited number of types available for use, the integration possibilities are endless. Alternatively, you can contact us to request a Listener type.

Click a Listener to see how to configure it.

Overview

When opening Onum, the Home area is the default view. Here you can see an overview of all the activity in your Tenant.

Use this view to analyze the flow of data and the change from stage to stage of the process. Here you can locate the most important contributions to your workflow at a glance.

Metrics

The Home view shows various infographics that provide insights into your data flow. Some Listeners or Data Sinks may be excluded from these metrics if they are duplicates or reused.

Sankey Diagram

Each column of the Sankey diagram provides information and metrics on the key steps of your flow.

You can see how the data flows between:

1. Listeners: each Listener in your Tenant.

2. Clusters: the Distributor/Worker group receives the Listener data and forwards it to Pipeline.

3. Labels: the operations and criteria used to filter out the data to be sent on to Pipelines.

4. Pipelines: the Pipelines used to obtain desired data and results.

5. Data sinks: the end destination for data having passed through Listener › Cluster › Label › Pipeline.

Hover over a part of the diagram to see specific savings.

Show Metrics

You can narrow down your analysis even further by selecting a specific node and selecting Show metrics.

View Details

Click a node and select View details to open a panel with in-depth details of the selected piece.

From here, you can go on to edit the selected element.

Hide/Show Columns

You can choose which columns to view or hide using the eye icon next to its name.

Add New Elements

You can add a new Listener, Label, Pipeline or Data sink using the plus button next to its name.

You can also create all of the aforementioned elements using the Create new button at the top-right:

Overview

This action offers automatic integration with models available on the Replicate platform, whether publicly accessible or privately deployed. This component simplifies accessing and utilizing a wide array of models without manual integration efforts.

Integrating Onum with replicate.com can offer several benefits, enhancing the platform's capabilities and the value it delivers:

• Access to a Broad Range of Models

• Ease of Model Deployment

• Scalability

• Continuous Model Updates

• Cost-Effective AI Integration

• Rapid Prototyping and Experimentation

• Enhanced Data Privacy and Security

Ports

These are the input and output ports of this Action:

Configuration

Where to find these values

It is possible to use all the public models from related to process natural language.

To fill in the values, you need to utilize the information about the user and model from Replicate.com and execute a copy/paste. The following image illustrates how to locate the required parameters on the Replicate.com model website.

Just in case, if the version does not appear, choose the Cog tag and copy the version like in the following picture.

A version identifies every model and requires a set of input parameters.

Description

This operation converts values between different units of length or distance.

Data types

These are the input/output expected data types for this operation:

Input data

- Values whose unit of length you want to transform. They must be strings representing numbers.

Output data

- Resulting values after transforming them to the selected unit of length.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to convert a series of events from meters into yards:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Convert distance.

3. Set Input units to Metres (m).

4. Set Output units to Yards (yd).

5. Give your Output field a name and click Save. The unit of length of the values in your input field will be transformed. For example:

Overview

Essentially, Onum receives any data through Listeners. These are logical entities created within a Distributor, acting as the gateway to the Onum system. Due to this, configuring a Listener involves defining an IP address, a listening port, and a transport layer protocol, along with additional settings depending on the type of Listener specialized in the data it will receive.

A Push type of Listener passively sources data without explicitly requesting, whereas a Pull type is where the user actively requests data from an external source.

Click the Listeners tab on the left menu for a general overview of the Listeners configured in your Tenant and the events generated.

• The graph at the top plots the volume ingested by your listeners. Click Events to see the events in for all your Listeners, or Bytes to see a bar graph representing the bytes in. Learn more about this graph in this article.

  • Use the Stack Listeners toggle to view each individual Listener on your graph and its metrics.

• Hover over a point on the chart to show a tooltip containing the Events and Bytes OUT for the selected time, as well as a percentage of how much increase/decrease has occurred between the previous lapse of time and the one currently selected.

At the bottom, you have a list of all the Listeners in your Tenant. You can switch between the Cards view, which shows each Listener in a card, and the Table view, which displays Listeners listed in a table. Learn more about the cards and table views in this article.

Narrow Down Your Data

There are various ways to narrow down what you see in this view:

Add Filters

Add filters to narrow down the Listeners you see in the list. Click the + Add filter button and select the required filter type(s). You can filter by:

• Name: Select a Condition (Contains, Equals, or Matches) and a Value to filter Listeners by their names.

• Type: Choose the Listener type(s) you want to see in the list.

• Version: Filter Listeners by their version.

• Created by: Selecting this option opens a User drop-down where you can filter by creator.

• Updated by: Selecting this option opens a User drop-down where you can filter by the last user to update a pipeline.

The filters applied will appear as tags at the top of the view.

Select a Time Range

If you wish to see data for a specific time period, this is the place to click. Go to this article to dive into the specifics of how the time range works.

Select Tags

You can choose to view only those Listeners that have been assigned the desired tags. You can create these tags in the Listener settings or from the cards view. Press the Enter key to confirm the tag, then Save.

To filter by tags, click the + Tags button, select the required tag(s) and click Save.

Create a Listener

Depending on your permissions, you can create a new Listener from this view.

There are several ways to create a new Listener:

From the Listeners view:

Within a Pipeline:

From the Home Page:

Configure a Listener

Configuring your Listener involves various steps. You can open the configuration pane by creating a new Listener or by clicking a Listener in the Listener tab or the Pipeline view and selecting Edit Listener in the pane that opens.

Alternatively, click the ellipses in the card or table view and select Edit.

01. Type

The first step is to define the Listener Type. Select the desired type in this window and select Configuration.

02. Configuration

The configuration is different for each Listener type. Check the different Listener types and how to configure them in this section.

03. Labels

Use Onum's labels to cut out the noise with filters and search criteria based on specific metadata. This way, you can categorize events sent on and processed in your Pipelines.

Learn more about labels in this article.

Overview

Use Onum's labels to cut out the noise with filters and search criteria based on specific metadata. This way, you can categorize the events that Listeners receive before being processed in your Pipelines.

As different log formats are being ingested in real-time, the same Listener may ingest different technologies. Labels are useful for categorizing events based on specific criteria.

When creating or editing a Listener, use Labels to categorize and assign filters to your data.

For most Listeners, you will see two main event categories on this screen:

• All Data - Events that follow the structure defined by the specified protocol, for example, Syslog events with the standard fields, or most of them.

• Unparsed - These are events that do not follow the structure defined in the selected protocol.

You can define filters and rules for each of these main categories.

What Are Labels Used For?

Once you've defined your labels to filter specific events, you can use them in your Pipelines.

Instead of using the whole set of events that come into your Listeners, you can use your defined labels to use only specific sets of data filtered by specific rules.

Creating Your First Label

When you create a new Listener, you'll be prompted to the Labels screen after configuring your Listener data.

From here, you have various options:

Create a new label

To create a new subset of data, select the + sign that extends directly from the All data or Unparsed bars. Be aware that if you select the + sign extending from the header bar, you will create a subheader.

Create a sub-label

You can create a branch from your primary header by clicking the plus button that extends from the main header. There is no limit to the amount that you can add.

Notice that the subheader shows a filter icon with a number next to it to indicate the string of filters applied to it already.

Duplicate your label

To duplicate a label, simply select the duplicate button in its row.

Delete a label

To delete a label, simply select the delete button in its row.

Once you have completed your chain, click Save.

Unlabeled

Any data that has not been assigned a label will be automatically categorized as unlabeled. This allows you to see the data that is not being processed by any Pipeline, but has not been lost.

This label will appear in the list of Labels for use in your Pipeline so that you can process the data in its unfiltered form.

Your Listener is now ready to use and will appear in the list.

Overview

The OCSF Action allows users to build messages in accordance with the Open Cybersecurity Schema Framework.

Ports

These are the input and output ports of this Action:

Configuration

Example

Let's say you have received drone flight logs in JSON format and wish to transform it to a OCSF-formatted JSON using the Drone Flights Activity [8001] schema.

{
  "drone_id": "DRONE-XT12",
  "operator": "alice.wong",
  "flight_id": "FL-20250602-0001",
  "start_time": "2025-06-02T08:00:00Z",
  "end_time": "2025-06-02T08:30:00Z",
  "status": "completed",
  "latitude": 40.7128,
  "longitude": -74.0060,
  "altitude_m": 150.0,
  "battery_level": 45,
  "vendor": "AeroFleet"
}

[
{
  "event_class": "drone_activity",
  "event_type_id": 8001,
  "time": "2025-06-02T08:00:00Z",
  "severity_id": 1,
  "message": "Drone flight FL-20250602-0001 completed successfully",
  "actor": {
    "user": {
      "name": "alice.wong"
    }
  },
  "drone_activity": {
    "drone_id": "DRONE-XT12",
    "flight_id": "FL-20250602-0001",
    "status": "completed",
    "start_time": "2025-06-02T08:00:00Z",
    "end_time": "2025-06-02T08:30:00Z",
    "location": {
      "latitude": 40.7128,
      "longitude": -74.0060,
      "altitude_m": 150.0
    },
    "battery_level": 45
  },
  "metadata": {
    "product": {
      "name": "DroneLogSystem",
      "vendor_name": "AeroFleet"
    }
  }
}
]

Description

This operation converts values between different units of speed.

Data types

These are the input/output expected data types for this operation:

Input data

- Values whose unit of speed you want to transform. They must be strings representing numbers.

Output data

- Resulting values after transforming them to the selected unit of speed.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to convert a series of events from kilometers per hour into miles per hour:

1. In your Pipeline, open the required Action configuration and select the input Field.

2. In the Operation field, choose Convert speed.

3. Set Input units to Kilometres per hour (km/h).

4. Set Output units to Miles per hour (mph).

5. Give your Output field a name and click Save. The unit of speed of the values in your input field will be transformed. For example:

200 Kilometres per hour (km/h) -> 124.2841804 Miles per hour (mph)

Overview

The Field Transformation action acts as a container that enables users to perform a wide range of operations on data, including encoding and decoding various types of encryption, format conversion, file compression and decompression, data structure analysis, and much more. The results are stored in new events fields.

In order to configure this action, you must first link it to a Listener or other Action. Go to to learn how to link.

Ports

These are the input and output ports of this Action:

Configuration

Example

Here is an example of a data set on the Bytes in/out from IP addresses.

We can use the field transformation operations to reduce the quantity of data sent.

We have a Syslog Listener, connected to a Parser.

Link the Parser to the Field Transformation action and open its configuration.

We will use the

Destination IP to Hex

Transform the Destination IP to hexadecimal to reduce the number of characters.

• Field>Parser: DESTINATION_IP_ADDRESS

• Operation: To IP Hex

• Output Field: DestinationIPAddessHex

Add a new field for Destination Host to CRC32

Codify the Destination Host as crc32 to transform the machine name into 8 characters.

• Field>Parser: DESTINATION_HOST

• Operation: Crc32

• Output field: DestinationHostCrc32

Description

This operation converts values between different units of mass.

Data types

These are the input/output expected data types for this operation:

Input data

- Values whose unit of mass you want to transform. They must be strings representing numbers.

Output data

- Resulting values after transforming them to the selected unit of mass.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to convert a series of events from kilograms into pounds:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Convert mass.

3. Set Input units to Kilogram (kg).

4. Set Output units to Pound (lb).

5. Give your Output field a name and click Save. The unit of mass of the values in your input field will be transformed. For example:

Description

This operation converts a list of comma-separated values (data type listString) into a string of values divided by a specific separator.

Data types

These are the input/output expected data types for this operation:

Input data

- List of comma-separated values.

Output data

- Resulting string of values divided by the given separator.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to convert a series of lists of comma-separated values into a single string representing those values separated by /:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose List to string.

3. Set Separator to /.

4. Give your Output field a name and click Save. The values in your input field will be transformed into a string with its values separated by the given character. For example:

Integrate with API Logs from the Cortex Platform using the Listener using the data Integration API.

Overview

The Actions tab shows all available actions to be assigned and used in your Pipeline. Use the search bar at the top to find a specific action. Hover over an action in the list to see a tooltip, as well as the option to View details.

To add an action to a Pipeline, drag it onto the canvas.

Action Versioning

We are constantly updating and improving Actions, therefore, you may come across old or even discontinued actions.

If there is an updated version of the Action available, it will show update available in its Definition, above the node when added to a Pipeline, and Details pane.

If you have added an Action to a Pipeline that is now discontinued, it will show as deactivated in the Canvas. You'll soon be able to see all the Actions with updates available in the Actions view.

Actions List

See this table to understand what each Action does, when to use it, and how to get the most value from your Pipelines. Click an Action name to see its article.

Overview

Use Pipelines to transform your events and build a data flow linking Actions from Listeners and to Data sinks.

Select the Pipelines tab at the left menu to visualize all your Pipelines in one place. Here's what you will find all the actions you can perform in this area:

• The graph at the top plots the data volume going through your Pipelines. The purple line graph represents the events in, and the blue one represents the events going out. Use the buttons above the graph to switch between Events/Bytes, and the Frequency slider bar to choose how frequently you want to plot the events/bytes in the chart.

• At the bottom, you will find a list of all the Pipelines in your tenant. You can switch between the Cards view, which shows each Pipeline in a card, and the Table view, which displays Pipelines listed in a table. Learn more about the cards and table views in this article.

Narrow Down Your Data

There are various ways to narrow down what you see in this view, both the Pipeline list and the informative graphs. To do it, use the options at the top of this view:

Add Filters

Add filters to narrow down the Pipelines you see in the list. Click the + Add filter button and select the required filter type(s). You can filter by:

• Name: Select a Condition (Contains, Equals, or Matches) and a Value to filter Pipelines by their names.

• Status: Choose the status(es) you want to filter by: Draft, Running, and/or Stopped. You'll only see Pipelines with the selected status(es).

• Created by: Filter for the creator of the Pipeline in the window that appears.

• Updated by: Filter for users to see the Pipeline they last updated.

The filters applied will appear as tags at the top of the view.

Select a Time Range

If you wish to see data for a specific time period, this is the place to click. Go to Selecting a Time Range to dive into the specifics of how the time range works.

Select Tags

You can choose to view only those Pipelines that have been assigned the desired tags. You can create these tags in the Pipeline settings or from the cards view. Press the Enter key to confirm the tag, then Save.

To filter by tags, click the + Tags button and select the required tag(s).

Metrics

Below the filters, you will see 3 metrics informing you about various components in your Pipelines.

Listeners

View the events per second (EPS) ingested by all Listeners in your Pipelines for the selected time range, as well as the difference in percentage compared to the previous lapse.

Data Sink

View the events per second (EPS) sent by all Data Sinks in your Pipelines for the selected time range, as well as the difference in percentage compared to the previous.

Data Volume

See the overall data volume processed by all Pipelines for the selected time range, and the difference in percentage with the previous.

Visualize Your Data In/Out

Select between In and Out to see the volume received or sent by your Pipelines for the selected time range. The line graph represents the Events and the bar graph represents Bytes.

Hover over a point on the chart to show a tooltip containing the Events and Bytes in/out for the selected time, as well as a percentage of how much increase/decrease has occurred since the previous lapse of time since the one currently selected.

You can also analyze a different time range directly on the graph. To do it, click a starting date in the map and drag the frame that appears until the required ending date. The time range above will be also updated.

Pipelines List

At the bottom, you have a list of all the Pipelines in your tenant.

Use the Group by drop-down menu at the right area to select a criterion to organize your Pipelines in different groups (Status or None). You can also use the search icon to look for specific Pipelines by name.

Use the bottoms at the left of this area to display the Pipelines as Cards or listed in a Table:

Cards View

In this view, Pipelines are displayed as cards that display useful information. Click a card to open the Pipeline detail view, or double-click it to access it.

This is the information you can check on each card:

• The percentage at the top left corner indicates the amount of data that goes out of the Pipeline compared to the total incoming events, so you can check how data is optimized at a glance. Hover over it to see the in/out data in bytes and the estimation over the next 24 hours.

• You can also see the status of the Pipeline (Running, Draft, or Stopped).

• Next to the status, you can check the Pipeline current version.

• Click the Add tag button to define tags for the Pipeline. To assign a new tag, simply type the name you wish to assign, make sure to press Enter, and then select the Save button. If the Pipeline has tags defined already, you'll see the number of tags next to the tag icon.

• Click the ellipses in the right-hand corner of the card to reveal the options to Edit, Copy ID, or Remove it.

Table view

In this view, Pipelines are displayed in a table, where each row represents a Pipeline. Click a row to open the Pipeline detail view, or double-click it to access it.

Click the cog icon at the top left corner to rearrange the column order, hide columns, or pin them. You can click Reset to recover the default configuration.

Pipeline detail view

Click a Pipeline to open its settings in the right-hand pane. Here you can see Pipeline versions and edit the Pipeline. Click the ellipses in the top right to Copy ID or Duplicate / Remove it.

The details pane is split into three tabs showing the Pipeline at different statuses:

Once you have located the Pipeline to work with, click Edit Pipeline to open it.

Duplicate a Pipeline

If you wish to use a Pipeline just like the one you are currently working on, click the ellipses in the Card or Table view and select Duplicate, or from the Configuration pane.

Create a Pipeline

Depending on your permissions, you can create a new Pipeline from this view. There are several ways to create a new Pipeline:

From the Pipelines view

From the Home page

This will open the new Pipeline, ready to be built.

Give your Pipeline a name and add optional Tags to identify it. You can also assign a Version in the top-right.

Keep reading to learn how to build a Pipeline from this view.

Build your Pipeline

See Building a Pipeline to learn step by step.

Description

This operation allows you to multiply the numbers in a list separated by a specified delimiter. This is useful for scaling data, performing simple arithmetic, or manipulating numerical datasets.

Data types

These are the input/output expected data types for this operation:

Input data

- Input string containing numbers to multiply, separated by a specified delimiter.

Output data

- The result of the multiplication.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to multiply a series of numbers in your input strings. They are separated by commas (,). To do it:

1. In your Pipeline, open the required Action configuration and select the input Field.

2. In the Operation field, choose Multiply Operation.

3. Set Delimiter to Comma.

4. Give your Output field a name and click Save. You'll get the multiplication of the numbers in your input data. For example:

2, 3, 5 -> 30

Description

This operation performs arithmetic subtraction between numbers separated by a specified delimiter. This operation is useful for calculations, data manipulation, and analyzing numerical differences.

Data types

These are the input/output expected data types for this operation:

Input data

- Input string containing numbers to subtract, separated by a specified delimiter.

Output data

- The result of the subtraction.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to get the subtraction of a series of numbers in your input strings. They are separated by commas (,). To do it:

1. In your Pipeline, open the required Action configuration and select the input Field.

2. In the Operation field, choose Subtract Operation.

3. Set Delimiter to Comma.

4. Give your Output field a name and click Save. You'll get the subtraction of the numbers in your input data. For example:

10, 5, 2 -> 3

Description

This operation compresses JSON data by removing unnecessary whitespace, line breaks, and formatting while retaining the full structure and functionality of the JSON. It is handy for reducing the size of JSON files or strings when storage or transfer efficiency is required.

Data types

These are the input/output expected data types for this operation:

Input data

- Strings representing the JSON data you want to optimize.

Output data

- Optimized versions of the JSON data in your input strings.

Example

Suppose you want to minify the JSON data in your input strings. To do it:

1. In your Pipeline, open the required Action configuration and select the input Field.

2. In the Operation field, choose Json Minify.

3. Give your Output field a name and click Save. Your JSON data will be optimized and formatted properly.

For example, the following JSON:

{
    "name": "John Doe",
    "age": 30,
    "isActive": true,
    "address": {
        "city": "New York",
        "zip": "10001"
    }
}

will be formatted like this:

{"name":"John Doe","age":30,"isActive":true,"address":{"city":"New York","zip":"10001"}}

Overview

Onum supports integration with . Select Apache Kafka from the list of Listener types and click Configuration to start.

Configuration

Now you need to specify how and where to collect the data and how to establish a connection with Apache Kafka.

Metadata

Enter the basic information for the new Listener.

Configuration

Now, add the configuration to establish the connection.

Authentication

Leave as None or select the authentication type to enable the settings:

Click Create labels to move on to the next step and define the required if needed.

Overview

This article outlines the more complex calculations that go on behind the graphs you see.

In the , , and views, you will see detailed metrics on your events and bytes in/out, represented in a graph at the top of these areas.

The line graph represents the events in/out, and the bar graph represents bytes in/on. Hover over a point on the chart to show a tooltip containing the events and bytes in for the selected time, as well as a percentage of how much increase/decrease has occurred since the previous lapse of time since the one currently selected.

Events

The values on the left-hand side represent the events in/out for the selected period.

Bytes

The values on the right-hand side represent the bytes in/out for the selected period.

Stacked view

By default, these graphs give an overview calculation of all the Listeners/Sinks in your Tenants. If you wish to see each Listener or Sink individually, use the Stack toggle.

Overview

This action enriches based on the evaluation of the LLaMa2 Chat model. This model offers a flexible, advanced prompt system capable of understanding and generating responses across a broad spectrum of use cases for text logs.

By integrating LLaMA 2, Onum not only enhances its data processing and analysis capabilities but also becomes more adaptable and capable of offering customized and advanced solutions for the specific challenges faced by users across different industries.

Ports

These are the input and output ports of this Action:

Configuration

Click Save to complete.

Overview

The Lookup action allows you to retrieve information from your uploaded lookups. To learn more about how to upload data, go to .

Ports

These are the input and output ports of this Action:

Configuration

Description

This operation is used to decode escape sequences in a string back to their original characters. Escaped strings are often used in programming, web development, or data transmission to represent special characters that cannot be directly included in text.

Data types

These are the input/output expected data types for this operation:

Input data

- String with escape characters.

Output data

- Resulting unescaped string.

Example

Suppose you want to unescape characters in a series of input strings. To do it:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Unescape string.

3. Give your Output field a name and click Save. All the escape characters will be removed. For example:

Description

This operation divides a list of numbers provided in the input string, separated by a specified delimiter.

Data types

These are the input/output expected data types for this operation:

Input data

- List of numbers you want to divide, separated by a specified delimiter.

Output data

- Result of the division of the numbers in your input string.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to divide a series of numbers in your input strings. They are separated by colons (:). To do it:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Divide Operation.

3. Set Delimiter to Colon.

4. Give your Output field a name and click Save. You'll get the division results. For example:

Onum offers you two different types of AI-powered assistants to help you build powerful Pipelines:

• - Build your Pipeline structure using this assistant.

• - Once you've defined your Pipeline structure, you can configure each Action settings using this assistant.

Overview

The Pipeline Assistant is an AI-powered chat feature designed to help users design and build their . Any configuration requested through the chat will be automatically applied. Simply enter the results you expect from your Pipeline and the AI will generate a Pipeline structure according to your needs.

To start using it, create a new Pipeline, drag a Listener, and just click this icon at the bottom left corner:

Examples

Here are some example use cases where we ask for help from the Pipeline Assistant. Check the prompts we use and the resulting configuration in each example picture.

Filter most common priorities

Send a report of aggregated data to Jira

Description

This operation calculates the median value of a set of numbers separated by a specified delimiter. The median is a statistical measure representing the middle value of a sorted dataset. It divides the data into two halves, with 50% of the data points below and 50% above the median.

Data types

These are the input/output expected data types for this operation:

Input data

- List of numbers separated by a specified delimiter.

Output data

- The result of the median.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to calculate the median a series of numbers in your input strings. They are separated by commas (,). To do it:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Median.

3. Set Delimiter to Comma.

4. Give your Output field a name and click Save. You'll get the median of the numbers in your input data. For example:

Description

This operation calculates the sum of a series of numbers provided as input, separated by a specified delimiter. It is a simple yet powerful tool for numerical data analysis, enabling quick summation of datasets or values.

Data types

These are the input/output expected data types for this operation:

Input data

- Input string containing numbers to sum, separated by a specified delimiter.

Output data

- The result of the total sum.

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Example

Suppose you want to get the sum of a series of numbers in your input strings. They are separated by commas (,). To do it:

1. In your Pipeline, open the required configuration and select the input Field.

2. In the Operation field, choose Sum Operation.

3. Set Delimiter to Comma.

4. Give your Output field a name and click Save. You'll get the sum of the numbers in your input data. For example:

Where the vendor is paloalto, it's product is cortex_xdr. For Cortex XDR, right now we have three different product types/endpoints:

Inside each of those endpoints we have the YAML file to configure.