To perform bulk translation of your content, follow these steps:
Create a custom repository
Create a custom repository for the content you're going to import.
Go to Threat Detection Marketplace > Repositories.
Click Add Repository.
In the modal that appears, configure Repository Details:
Give your repository a meaningful name
Enable the Share to Company switch if you want other members of your team to have access to this repository
Provide an optional description
Optionally, set a Data Plane associated with this repository. This setting will not prevent interaction with other Data Planes.
In the Additional Access Settings, enable the Share to SOC Prime switch if you want to grant SOC Prime access to your repository and set the sharing period.
Note:
You need a Manager role to configure this setting
You can enable or disable this setting at any time by editing the repository settings. So, for example, you can first import your content into the repository and then share the repository to SOC Prime
Click Apply.
Your repository is created. You can check and manage it from the Repositories page.
Import content into custom repository
Go to Threat Detection Marketplace > Search.
Click Import Content.
The Import Content modal appears. In the Import To dropdown select the repository you've created for importing your content.
Click Browse File to select the XML file with content you've exported from your SIEM.
Wait until the file is ready and click Import.
The file is parsed. Once the parsing is done, click Finish.
The content is imported. Your repository with imported content is displayed.
Run bulk translation
Start the bulk translation flow in one of two following ways:
Open your repository, select certain content items with checkboxes, and click Translate To in the bulk actions menu that appears. Note that in this way you can select only those content items that are currently displayed on the screen.
On the Repositories page, click the tree dots icon next to the repository and select Bulk Translate. Note that in this way all supported content from the repository will be translated.
In the Bulk Translation Settings modal that appears, check the source and target formats are correct and click Translate. Each translation will be stored together with its source in your custom repository.
Once the bulk translation is done, the Translation Results modal appears. Click Finish.
The Search page with your repository is displayed. Each content item that was run through bulk translation process has a translation status on the right:
Translated – the content item was successfully translated and saved.
Partial – the content was partially translated and saved. This means that some components of the source, such as functions, could not be translated into the target. You can check the list of these components in the comment in the target code.
Failed - the content failed to translate. You can check the reason in the error message.
Click the status to open the content item's page in Threat Detection Marketplace or hover over the status and click Go to Uncoder in the tooltip that appears to open the content item directly in Uncoder AI.
Review the translation results
Once the translation is done, review its results from the repository with translated content. For each content item:
Hover over the translation status and click Go to Uncoder in the tooltip that appears to open the content item directly in Uncoder AI.
The source and the target are opened in Uncoder AI. Review the translation. Note that:
Unsupported functions in Partial translations are listed in the comment
For Failed translations, the error message contains the reason why it was impossible to translate the source
Once you've reviewed the translation, save it and change the translation status to Reviewed:
For the target format, click Save As > Update to my Rule.
In the Save As Update menu that appears, change the translation status to Reviewed and click Save.
The new translation status will be displayed on the Search page for this content item.