Summarize search results with Aurora Security Assistant

Generate an Aurora Security Assistant (ASA) summary of your Data Explorer search results, including a plain-language narrative, potential visualizations, and recommended actions.

When using the Aurora Security Assistant (ASA) query builder to search with natural language, a summary card and suggested widgets appear automatically alongside your results.

When running searches manually using the Query Builder or , summaries and widgets are not generated automatically. Click Summarize to generate an ASA summary and choose which components to create.

The ASA summary can include the following components:

Summary Card
When using the ASA query builder, a formatted natural language summary automatically displays with your search results, highlighting key domains, IP addresses, and timeframes detected in the data.
Narrative Summary
A plain-language explanation of your search results that highlights key trends, patterns, or anomalies detected in the data.
Visualizations
Visual representations of your data. When using the ASA query builder, pie or line charts may be generated if the returned dataset supports visualization. When using the Query Builder or and clicking Summarize, ASA suggests charts, tables, or metrics to represent the data, allowing you to choose which widgets to create. If the result set is large, intelligent sampling is used and noted in the summary.
Recommended Actions
Contextual next steps suggested by ASA when potential security risks or configuration gaps are identified.
Note: The ASA summary respects your current role-based access control (RBAC) permissions and any active data masking policies.
  1. Run an analyzed log search.
  2. In the Search Results section, click Summarize.
    The ASA summary displays inline below the search results, presenting the narrative summary, any generated visualizations, and recommended next steps.
  3. Optional: To save a generated visualization to a dashboard, click Save to Dashboard on the widget.
    Promoted widgets retain their underlying query and can be refreshed at any time.