From 91e432dbbada46f1bf0fed41b19da55b2781fbe1 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Wed, 9 Oct 2024 17:03:26 +0530 Subject: [PATCH 1/8] Kandji C2C source doc --- blog-service/2024-10-11-collection.md | 14 +++ cid-redirects.json | 1 + .../product-list/product-list-a-l.md | 2 +- .../index.md | 6 + .../kandji-source.md | 107 ++++++++++++++++++ sidebars.ts | 1 + static/files/c2c/kandji/example.json | 20 ++++ static/files/c2c/kandji/example.tf | 21 ++++ static/img/send-data/kandji-logo.png | Bin 0 -> 7308 bytes 9 files changed, 171 insertions(+), 1 deletion(-) create mode 100644 blog-service/2024-10-11-collection.md create mode 100644 docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md create mode 100644 static/files/c2c/kandji/example.json create mode 100644 static/files/c2c/kandji/example.tf create mode 100644 static/img/send-data/kandji-logo.png diff --git a/blog-service/2024-10-11-collection.md b/blog-service/2024-10-11-collection.md new file mode 100644 index 0000000000..c27a36cf25 --- /dev/null +++ b/blog-service/2024-10-11-collection.md @@ -0,0 +1,14 @@ +--- +title: Kandji C2C Source (Collection) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - collection + - kandji +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +We're excited to announce the release of our new cloud-to-cloud source for Kandji. This source helps you to collect threat details, devices list, device activities, and device details from the Kandji platform and ingests it into Sumo Logic. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source). diff --git a/cid-redirects.json b/cid-redirects.json index 751b7e7b2f..664dafbbd2 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -2612,6 +2612,7 @@ "/cid/19878": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source", "/cid/19879": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/knowbe4-api-source", "/cid/16323": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-source", + "/cid/13428": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source", "/cid/20172": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-vulnerability-management-source", "/cid/19880": "/docs/metrics/metrics-operators/predict", "/cid/19881": "/docs/metrics/metrics-operators/accum", diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md index 9613e661e5..56088c93d3 100644 --- a/docs/integrations/product-list/product-list-a-l.md +++ b/docs/integrations/product-list/product-list-a-l.md @@ -312,7 +312,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | :-- | :-- | :-- | | Thumbnail icon | [Kafka](https://kafka.apache.org/) | Apps:
- [Kafka](/docs/integrations/containers-orchestration/kafka/)
- [Kafka - OpenTelemetry](/docs/integrations/containers-orchestration/opentelemetry/kafka-opentelemetry/) | | Thumbnail icon | [Kaltura](https://corp.kaltura.com/) | Cloud SIEM integration: [Kaltura](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/c65f8f5f-ea11-4b41-858b-99731d306f81.md)
Collector: [Kaltura - Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kaltura-source/) | -| Thumbnail icon | [Kandji](https://www.kandji.io/) | Community app: [Kandji API Data Streamer](https://github.com/SumoLogic/sumologic-content/tree/master/Kandji) | +| Thumbnail icon | [Kandji](https://www.kandji.io/) | Collector: [Kandji - Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source/)
Community app: [Kandji API Data Streamer](https://github.com/SumoLogic/sumologic-content/tree/master/Kandji) | | Thumbnail icon | [Kaspersky](https://usa.kaspersky.com/) | Automation integrations:
- [Kaspersky CyberTrace](/docs/platform-services/automation-service/app-central/integrations/kaspersky-cybertrace/)
- [Kaspersky TIP](/docs/platform-services/automation-service/app-central/integrations/kaspersky-tip/)
Cloud SIEM integration: [KasperskyLab](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/8011e6fe-1e65-4603-aa2e-15c9b33cb0fd.md) | | Thumbnail icon | [Keeper Security](https://www.keepersecurity.com/) | Partner integration: [Keeper Security](https://docs.keeper.io/en/v/enterprise-guide/event-reporting/sumo-logic) | | Thumbnail icon | [Kela](https://www.kelacyber.com/) | Automation integrations:
- [Kela Darkbeast](/docs/platform-services/automation-service/app-central/integrations/kela-darkbeast/)
- [Kela RaDark](/docs/platform-services/automation-service/app-central/integrations/kela-radark/) | diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index ce5c97d6f8..864337e2c0 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -313,6 +313,12 @@ In this section, we'll introduce the following concepts:

Learn how to collect Audit Trail and Base Entry events from Kaltura platform.

+
+
+ icon

Kandji Source

 +

Learn how to collect threat details, devices list, device activities, and device details from the Kandji platform.

+
+
icon

KnowBe4 API Source

 diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md new file mode 100644 index 0000000000..2297c53dc8 --- /dev/null +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md @@ -0,0 +1,107 @@ +--- +id: kandji-source +title: Kandji Source +sidebar_label: Kandji +tags: + - cloud-to-cloud + - kandji-edr +description: The Kandji Source provides a secure endpoint to receive threat details, devices list, device activities, and device details from the Kandji platform. +--- +import CodeBlock from '@theme/CodeBlock'; +import ExampleJSON from '/files/c2c/kandji/example.json'; +import MyComponentSource from '!!raw-loader!/files/c2c/kandji/example.json'; +import TerraformExample from '!!raw-loader!/files/c2c/kandji/example.tf'; +import ForwardToSiem from '/docs/reuse/forward-to-siem.md'; +import useBaseUrl from '@docusaurus/useBaseUrl'; + +icon + +Kandji is the Apple device management and security platform that empowers secure and productive global work. With Kandji, Apple devices transform themselves into enterprise-ready endpoints, with all the right apps, settings, and security systems in place. Through advanced automation and thoughtful experiences, Kandji brings much-needed harmony to the way IT, InfoSec, and Apple device users work. + +## Data collected + +| Polling Interval | Data | +| :--- | :--- | +| 5 min | [Threat Details](https://api-docs.kandji.io/#d041043a-ea47-47d5-b6f1-234ef422494d) | +| 12 hours | [List Devices](https://api-docs.kandji.io/#78209960-31a7-4e3b-a2c0-95c7e65bb5f9) | +| 12 hours | [Device Activities](https://api-docs.kandji.io/#80710108-fbdb-4dfd-af84-50adf15c5a23) | +| 12 hours | [Device Details](https://api-docs.kandji.io/#efa2170d-e5f7-4b97-8f4c-da6f84ba58b5) | + +## Setup + +### Vendor configuration + +The Kandji source requires you to provide the Endpoint URL and Bearer Token. Follow the below steps to generate the required values: + +- To generate the **Endpoint URL**, follow the instructions mentioned in the [Kandji documentation](https://api-docs.kandji.io/#intro). +- To generate the **Bearer Token**, follow the instructions mentioned in the [Kandji documentation](https://support.kandji.io/support/solutions/articles/72000560412-kandji-api). + +### Source configuration + +:::note +Threat Details endpoint is only available for EDR customers. +::: + +When you create a Kandji Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector and Source](/docs/send-data/hosted-collectors/configure-hosted-collector). + +To configure Kandji Source: +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. +1. On the Collectors page, click **Add Source** next to a Hosted Collector. +1. Search for and select the **Kandji** icon. +1. Enter a **Name** to display for the Source in Sumo Logic. The description is optional. +1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`. +1. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate. Each field needs a name (key) and value. + * ![green check circle.png](/img/reuse/green-check-circle.png) A green circle with a check mark is shown when the field exists in the Fields table schema. + * ![orange exclamation point.png](/img/reuse/orange-exclamation-point.png) An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo Logic that does not exist in the Fields schema it is ignored, known as dropped. +1. In **Endpoint URL**, enter the endpoint URL collected from the Kandji platform. +1. In **Bearer Token**, enter the bearer token collected from the Kandji platform. +1. Select the **Collect Threat Details** checkbox to collect threat data. By default, **Collect Threat Details** checkbox will be selected. +1. The **Threat Details Interval** is set for 5 minutes hours by default. You can adjust it based on your needs. +1. In the Devices section, select the type of devices data: **Collect Devices**, **Collect Device Activities**, and/or **Collect Device Details**. +1. The **Devices Interval** is set for 12 hours hours by default. You can adjust it based on your needs. +1. When you are finished configuring the Source, click **Save**. + +## JSON schema + +Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [Use JSON to Configure Sources](/docs/send-data/use-json-configure-sources) for details. + +| Parameter | Type | Value | Required | Description | +|:--|:--|:--|:--|:--| +| schemaRef | JSON Object | `{"type":"Kandji"}` | Yes | Define the specific schema type. | +| sourceType | String | `"Universal"` | Yes | Type of source. | +| config | JSON Object | [Configuration object](#configuration-object) | Yes | Source type specific values. | + +### Configuration Object + +| Parameter | Type | Required | Default | Description | Example | +|:--|:--|:--|:--|:--|:--| +| name | String | Yes | `null` | Type a desired name of the source. The name must be unique per Collector. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_source`. | `"mySource"` | +| description | String | No | `null` | Type a description of the source. | `"Testing source"` +| category | String | No | `null` | Type a category of the source. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_sourceCategory`. See [best practices](/docs/send-data/best-practices) for details. | `"mySource/test"` +| fields | JSON Object | No | `null` | JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field `_siemForward` to enable forwarding to SIEM.|`{"_siemForward": false, "fieldA": "valueA"}` | +| requestEndpoint | String | Yes | `null` | The API URL to fetch the data from the Kandji EDR log source. | `https://SubDomain.api.kandji.io` | +| bearerToken | String | Yes | `null` | API Token created for the user account in the Kandji portal. | | +| pollingIntervalMin | Integer | Yes | 5 mins | Time interval (in minutes) after which the source will check for new data for API: Threat Details. | | +| pollingIntervalHour | Integer | Yes | 12 hours | Time interval (in hours) after which the source will check for new data for API: List Devices, Collect Activities, and Collect Details. | | +| collectThreatDetails | Boolean | No | `null` | Specify if we need to collect the tenant's threat details. | | +| collectDevices | Boolean | No | `null` | Specify if we need to collect the tenant's devices. | | +| collectDeviceActivities | Boolean | No | `null` | Specify if we need to collect the Device activity of the tenant. | | +| collectDeviceDetails | Boolean | No | `null` | Specify if we need to collect the Device details of the tenant. | | + +### JSON example + +{MyComponentSource} + +Download example + +### Terraform example + +{TerraformExample} + +Download example + +## FAQ + +:::info +Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. +::: \ No newline at end of file diff --git a/sidebars.ts b/sidebars.ts index 73ca7fde59..a4389c4367 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -435,6 +435,7 @@ module.exports = { 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/jfrog-xray-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/jumpcloud-directory-insights-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/kaltura-source', + 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/knowbe4-api-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/lastpass-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source', diff --git a/static/files/c2c/kandji/example.json b/static/files/c2c/kandji/example.json new file mode 100644 index 0000000000..d296ce5389 --- /dev/null +++ b/static/files/c2c/kandji/example.json @@ -0,0 +1,20 @@ +{ + "api.version": "v1", + "source": { + "config": { + "name": "Kandji", + "requestEndpoint": "https://sumo.api.kandji.io", + "bearerToken": "xxxxxxxxxxxxxxxxxxxxxxxx", + "collectThreatDetails": true, + "collectDevices": true, + "pollingIntervalMin": 5, + "pollingIntervalHour": 12, + "collectDeviceActivities": true, + "collectDeviceDetails": true +}, + "schemaRef": { + "type": "Kandji" + }, + "sourceType": "Universal" + } +} diff --git a/static/files/c2c/kandji/example.tf b/static/files/c2c/kandji/example.tf new file mode 100644 index 0000000000..7be17b855e --- /dev/null +++ b/static/files/c2c/kandji/example.tf @@ -0,0 +1,21 @@ +resource "sumologic_cloud_to_cloud_source" "kandji" { + collector_id = sumologic_collector.collector.id + schema_ref = { + type = "Kandji" + } + config = jsonencode({ + "name": "Kandji", + "requestEndpoint": "https://sumo.api.kandji.io", + "bearerToken": "xxxxxxxxxxxxxxxxxxxxxxxx", + "collectThreatDetails": true, + "collectDevices": true, + "pollingIntervalMin": 5, + "pollingIntervalHour": 12, + "collectDeviceActivities": true, + "collectDeviceDetails": true + }) +} +resource "sumologic_collector" "collector" { + name = "my-collector" + description = "Just testing this" +} \ No newline at end of file diff --git a/static/img/send-data/kandji-logo.png b/static/img/send-data/kandji-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..1e2b77e1fda09c7cd694d7cfef246b696672d140 GIT binary patch literal 7308 zcmb7oWmH_t(&*qb_z)lo2{32~1O^Z89yB;4Xn?_GaCZ+D+}$Msf)m^c?h@QJxbr6G zo_Fq9?|py1UaPulcb9ZmcURTgA&T;nIG7}u0000-T1xCa0!Jah42X{Cl@(@s007J) zQ&CYxX;D##qMfy|sf7^$AQcjqfT5_oL)_EiHvWQ$dj6S}ZQFM9w%(v0{m)q&kVAAP8-}S@N z_2Gi`<_7>B=7(=wL}~ztTr3Uf{QQ$xPbaI5C;(^M8x=6Ja>CkGy1Xpp-zIz4*nEUG z@~O#Epy>SQ@ljoQ9gEckAk+rzIc0M(1!jocp((uSLk4`u>)T@-AW*P-(asJUgS21L za@!_L(sFx-j_MWD^2L5;#sTmp4a89+3mHRPBsihqQ3^MR1E!oq(DpmuyipFkBrpzDuIGN-TDw|`kEc(Y?ZCISi|K?C zhRF1?H73N6K@64dd^4XDpA_sCa7phzW$9>=b==23t=B=S{9c5GY{DhH-4VU>$+q1@ zBWj0~vm@qAaaIRJz-b;>A2aKb_ZnR39^*|lJ}ieBnY?15zwY~dNEU>ZSf)R4LSR~0 z>gCfr4R_QfpPe0NZQ-qmqS8)@BRqV?%j;C*f&&VxA z+0W?QS4CG-fQ?tSh7-$$!eknKAYGqzTF^NV=|!%eN+*ps5^}Vz4&W0g-b9YfKaFW9 z8u;W(<+C^IfuLtE!NUej9o_xixZZuYJoh|Jc?yf7!JZzRwK^Dp>C}*rkgBSBZ+U=x zI*Rv|9;XRA(0joFP=2^9O*1=QU)1Q2BnH8Q2@%1N`1P;{eQ<05Osy!+C|>xe?ZVg^ z$j%T@E=3v?g`tf{5fIvH{FPM2yLlPFg&pDZBomy9_Oy-22F2c&>=^&dNBEc^-1k!N zr7z^Am``C8eJ;*(A>$~VPX7gnH61=?fI%h~9hgA)J&dNBjNVr!3lk=&f^v_X=EEd1 zoyoKb;0dh!{?myi z`U$EFic9<*!S#o0*6S}Pwd<0EK+Hf)3$*ffvjCX@HcTg?Zo;C_sZili)6lL^Ny3WP zxUW}YvE!QJu4JxdFk+cr<0vYr@YARC=ad(a{qjC{xUnz)6iPTcNf5 z?!^4~{EB=Hc)=#kPcUOce2`k@6ld9~R>z!*R(2`Y8T}Ef z6SX?zpRC8fz`cLuxe+cBJ1bo^<9;VCn<5w zs>PGSB|%d%Qx8)vQ$MGyEo3d7Ipa8;EMC_L)Rb41k&u>j_m9GssRM>g#W^J`y7G5|HvFg)QMO5mzXt~Jn zDY$v+@m8sS({57K`Joe_L;6eR7x)*^F9mmd4+0M}4+)P05A~~>EB!mq;ZV|Q%u^DLtYc+p3Ne%nH)Xc5T@Nvv>5V#vW7Ca?&-76l=5lx=mlr58Ulg*f; zF1{436b9~Q?^-pWGAuFdA$El>{IIc!zR&g*Zw~uR4AphF44I3WpxKJ=hi)+OKMx8C z3*{xa40zF5wi?j|Uv=t=Jeg@CZAx&*d*FQd+N!EZ@0`AzteDIkyPaIeVawIWU-ZUQ zte02~sQc=c=1A@#iXhgG&WMtO{<{E9262L;L@u=q_R0VXPg1z^xnIE3w{F%Snvk1) zYqK5lhWZ^CZq>i39q8heMd&UzNLb4~B)5J4VUAZpRsK%%QafE$$Mjd@xzb+BDaYyb zCf?oht*E8X2cO*KL-Yh3H!rbAy1Q?NIS1WoFItFBuqvKv62%dDyxt_zeeAm_ILV;p zq_Nngv!$D@dfup6UGEfj8{d%^npdBPqP=BpInzC(R(G&?kvCrvHyd}bD7-+iII2#j z@vBf!K^pUiFd!t9W7?$#y4W~ur9$L)(^?2>+5 zJ-kok&W_9{dbh)a8Ro^4#bL!QWCWzUyf0nr%DTVhZw7Zq$7t25Y4N(-kB$x*>hvV< z4(?q{kMD&=_^pktK|Mom^Df0&L#DnAesL(kmOtQ;H^=YK@^~#NEJ+hk zm~@+0;T!LHOYYlMr%OyKxOI8qX)evb13Nwkrd+&Lcr<>T-@y%v2-J?KP3B4CNom}4 zNIP;o`r$mkcM->%%KO%p_{{!X;_O#rIR zjIZcsasBc}Am|7DUg!R8Mj*cjSL+MsYspP=UG&oorSv%dX-^%tPi*#%GbVMXUF}c( zpk2@&Nz4b8JNPuintH**$<^K_>}-44yl*e$ZI`v`5}B*XWx2x}=l#Ch>dQ59Ou=GL zzPpg?qI>wn*4EmE zs7NFLGz5i&00E>I|IiXhbO4mU#*qPlAX5P9-#qdN{HOh?h5yL>2cyIU0x%F?1PE}> zME-|6Dih@&+6*xV5LOnImPTM@LpviQD>%&B-fWWPkA0AhlqMViAg1{PNYd}Aj}iK( zOjR`OHRNP@46QAh^gme}7%@3p+WgT2;B)3dkd{XF`VePJ3oAH}Ge6~D96Sj6&oGn{ z@)wJ}IX|U_oFYWj+Rg~V$;8aWOeuf~fk61|J{j}87nAr~9P!0Z3A4Ai;ekS(oSc}P z*qE&COrR{>+}u!RRwyegBZ7kw?qX%H@62cgr}~eQ|EovL2ySR+YGZF|Z3X$GSKq+e z!JeOz@{gf^+JDw*xe~;^L;eSv5EyxG` zv-5v>;y-TwYZT#U0ZcyVKW8R@i5k9Gi8#iWreX>z2#mO7e>Dz7Pltd%7y-a!Dvrum z2y84ZCamI&w6Bc;Ba*{UpD~0gl@`t@b_SDn1rjNJ%bKC$+{dI0ZDydS*I=G;6SWAI z@%2TM##af~!}w-!wCK&#(xibR*Po%H})Qpi?FskwOkWJfq`eh-T z-o(hV5XLKwBv9we5fN`tE*d!ln@=K&7LeJedfCv379TEzg+v=g>|Q#EYJmH{RxSZL zJKa)nJ=+GS33wzk=`=|l{c6q$C1Q9#Ut?KhI-ajm{(+lb<7?&=pqakK`L{1C8(WcR z5N@oXmuJOK*pA2bNkF=Qhm3mphb;KkP|*^NOl+oFnU+#d1ZmOxJekb^$_eOM_`q;bS~R$DS3I~){Y3gW3#E!q?sy{NTC*4 z%p}+A-)lYMlf|lVfFTB`1xe*I2}kGgN=H|jb}jP3Zk5TfScOh==Xdkz3CW#b&5cqr zG6XN)S`m)D5A6uT!*Uhvmw_%zhiT&fOdsnqzBW!mbDSutPPy&l|UnPR95kWkP^ z5L%?P#CaTcV{kA!06;r`Zi zf96|xPc(x%Q;eE#cO-d*0O!y>L7320BIH#>yvCN@>~Wfq*TY>F!e!$P4tv`(-wgfX zwUsWX#sOj4{DSFkMKX8B3zW^wiVGgLhSE~ZCX2-pCzW?`Fn?0ig-XI=fJ(}3CuZIR89Uh+FdfMhj)m$9l+|QnBXht; zAVC`-OTuW1Qh)N3`&*~E8p{_y)A{GwY)d`Q_NF6qD~!_~3M3I~_+8madF-X!G6S%l z<}2k$jMmw%N%16V9rV%3YNFhZ5zS?W2TDm8XC-{hXz{$)V${@d74Ul4*Ai4g5+I2e zdSc)&RAu}#8|MY*6{`-{1i$N9X5PC50^o*fHn`_ke);LcN(V+VrzJ@mpG!>C)^E{I z4St)0No$hI<@3xUnWVgqBeAcQKR9tFi==Q`!fr1PRH|X4u*iG(QBNef{llHh+;{VY zoWifhKa<(*)}=Or>K#_W4*9vcBZwtG>;w%3obOF5KR(<$Bp;WW`wOuappJR;(~Qe*%3J+hNn?q~8mv(&-d=31?QiRJ z=UPWfqM%JGbF8*7m=(#jzu4FG?K)Lnz8bLL_mQIQ1o|+KG`n5WE8df_yAw`?eo7WJ zCbjGeCF*xN8N+aAraq2>h11%^AogCet0{k93Ofk+#g>F3q8knd;!@wmyImdz7-W0k z65zb#Qsj>B)srN+!Ug6u14~JP{=UZ4F4re{S~a*Yx$rso@udZ)&JiwCc6H?;qEm!S z<@hYVm4FONxC>E_e$BmR3?5R9Nn|mU=rp@In6E9;uC+Sbon)AL}xXBtZn%W29kOlFC$UBvOnKdt-W_V;}eo_<~1Hn{0iwv zT5NDAp=2>rl1CeuLf9`740H}`OQS~W z-BX|+jrmxvw9gyuRyr1z=;am)ADC7+0njh#OUT@_)LlrbY!iw;fALOXnmAUYaJnA` z9(~E#-8HZMXP8^?O3M7F+!5U6f8qq*( zC2jK37>r&v{dUwIX*u^^0goHHo<`Xu*5VXIJTFLMGbuLWD)cnO8t9K>C~`U7)F-{n z{Pm(_v5o?t2a}+UV1;U_#Y<3aiGML@$=iUbeMz^)^RPRA+m{U#UK=)HR;t*A!6p46hB6iuTqY>oedRk{>q=Rnc`X3;Z3nm6-8Q! zClFDa4rBh%e(z#Q4ODtso6K?5DonT7wKa z&*V43pb@ex!T31HiN=hZzdaIVxuVy=FTC-VwRj-_dc5#Mg1=0EUS8g{R#*3XZvyWW zdiU)fUmCZQb?I%RGB|#fa)CVcBZ`>iDqce4n5)llzpWg^y!2QV5mO89!bkAuT{j;+ zQI)>Rwh8)uu_|sjMEtTv6djL`3p^j&0RVKTKNZJ8s9AVF6yjF-(bdnatmpIoR zPgIOf`b=2atv6U^1Ovn>!%jtkHLk+k_3nmRVA~I@LOdZVMqnC1WGYtZ+}0E&?yOKI z@QC91Qtv1z5mzT*W=11CGSb{?gx~FA`Tq8jQ+Ro0#V0rzsG_E3 z_KWH1)2DpySNM%iM^hhar!XCG6crTkL_|c6*Lv{EGPK>>5f>?v&17i#XUf}mW5chv z_GhcOoDN^Mx3`bX&erGNOc6T5;T?#jt?cZW%KbKC$T9c6+L4!*9$nx{WwKgq2-x0+ zO-xQwFf!sGZrAr40bZv=F>!IU8tbKqxjC)T?$J@Dl09whuXT0LUMZwk*IZS`j&lf! zi;LGe9wg@nX0_PfoSA+yF){p^%+daQ%fo7+PCw4@huI`OOY{DGtwMF!a&AFEPJVuO zevwU9&_I7b0o9_2QT(k}1Nt^1F9e5&cTP;i8awj1Uom51VSRJhQ_K1?bai%C{Y=_w z=?7!#+4W(q=e_IxV&l{6>+9p+zmvw(%gdQQG&zHZ)A>_Qos!<7o{#28uBNlP?tfID z2HfAAV@+4+N}8G$spfQubgzzGUHx9Gv)_sF4l3d1DZanIPfSc~U0hb&eag&n_m7Ces#Fx&fM8JV%M zvCF%YCCTkngu{24k!NQ+<6ievH6a2E^R?EaQ&WNY`Lt&j7opK1!|kKyYu%rLK%jR^ zOG_OtDGznN1hNq!3${=^dfxaz(Pyx!JdwMCu1|-cpUs&9@N?c{>&eQ>3T3io(Yt}^ zRFW@WzHAk)$4V!1eXPW>U_e?0N-xi^G1wRY-Sug#V{W+1!x+7FV-476xbhojwQ3_JaKjpTxnyZ$U2w2&r zM~PZ-?S|l}p+mae5^+U>rgYkgmM#3}buLFzbc_I$T(-8h2GW)l@_OqUM=2Rvf{mF0D#jKk_S&0_&)NIx%DM6E zsK#>s7?EYT+uk)UNSVmQAqTVkDVku(WUTWU3myFf11TOQgVuQfg9^KX6gOq90YnJt z?87WO-~E_j2e3VLu&|IF_gvY0HO>=W=~uqd!GIAJ-_7QLB!eubTL|Bz4k!be#V^}j zX5g}qv#Ai$Al+R3&Y96L!YnCe&O1k>J4zZ+wFK}U0|;M|Y!iA4iwtKj*g}-@l%{eL zkPSonZGt19nb(+;$u{HMm5}1&X@Lly`&Q1n}eZEB2X@iA?wheA} zE4b1JvWg!w-JEq$Cj8hvJpEhNb&LCQch~IOYqRTn(GS_=e9nrwem0U`7qLC=t}3@F z+{l_|Tne&h=jT2t<$QZX@FQViVJ^r0M6Q4a{SI{72BA{ Date: Thu, 10 Oct 2024 12:16:43 +0530 Subject: [PATCH 2/8] Update blog-service/2024-10-11-collection.md Co-authored-by: Kim (Sumo Logic) <56411016+kimsauce@users.noreply.github.com> --- blog-service/2024-10-11-collection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blog-service/2024-10-11-collection.md b/blog-service/2024-10-11-collection.md index c27a36cf25..a891587473 100644 --- a/blog-service/2024-10-11-collection.md +++ b/blog-service/2024-10-11-collection.md @@ -11,4 +11,4 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; icon -We're excited to announce the release of our new cloud-to-cloud source for Kandji. This source helps you to collect threat details, devices list, device activities, and device details from the Kandji platform and ingests it into Sumo Logic. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source). +We're excited to announce the release of our new cloud-to-cloud source for Kandji. This source helps you to collect threat details, device lists, activity logs, and device information from the Kandji platform, and ingest them into Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source). From 18de20d2ff526d67761f2b3e4eea67432a47f99e Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 10 Oct 2024 12:16:54 +0530 Subject: [PATCH 3/8] Update static/files/c2c/kandji/example.json Co-authored-by: Kim (Sumo Logic) <56411016+kimsauce@users.noreply.github.com> --- static/files/c2c/kandji/example.json | 36 ++++++++++++++-------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/static/files/c2c/kandji/example.json b/static/files/c2c/kandji/example.json index d296ce5389..6b30c21267 100644 --- a/static/files/c2c/kandji/example.json +++ b/static/files/c2c/kandji/example.json @@ -1,20 +1,20 @@ { - "api.version": "v1", - "source": { - "config": { - "name": "Kandji", - "requestEndpoint": "https://sumo.api.kandji.io", - "bearerToken": "xxxxxxxxxxxxxxxxxxxxxxxx", - "collectThreatDetails": true, - "collectDevices": true, - "pollingIntervalMin": 5, - "pollingIntervalHour": 12, - "collectDeviceActivities": true, - "collectDeviceDetails": true -}, - "schemaRef": { - "type": "Kandji" - }, - "sourceType": "Universal" - } + "api.version": "v1", + "source": { + "config": { + "name": "Kandji", + "requestEndpoint": "https://sumo.api.kandji.io", + "bearerToken": "xxxxxxxxxxxxxxxxxxxxxxxx", + "collectThreatDetails": true, + "collectDevices": true, + "pollingIntervalMin": 5, + "pollingIntervalHour": 12, + "collectDeviceActivities": true, + "collectDeviceDetails": true + }, + "schemaRef": { + "type": "Kandji" + }, + "sourceType": "Universal" + } } From c0b98c67f1224ed3f6b42694edf2d31bb098ffa2 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 10 Oct 2024 12:17:23 +0530 Subject: [PATCH 4/8] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md --- .../cloud-to-cloud-integration-framework/kandji-source.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md index 2297c53dc8..64f409a553 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md @@ -59,6 +59,7 @@ To configure Kandji Source: 1. The **Threat Details Interval** is set for 5 minutes hours by default. You can adjust it based on your needs. 1. In the Devices section, select the type of devices data: **Collect Devices**, **Collect Device Activities**, and/or **Collect Device Details**. 1. The **Devices Interval** is set for 12 hours hours by default. You can adjust it based on your needs. +1. **Processing Rules**. Configure any desired filters, such as allowlist, deny list, hash, or mask, as described in [Create a Processing Rule](/docs/send-data/collection/processing-rules/create-processing-rule). 1. When you are finished configuring the Source, click **Save**. ## JSON schema From b45df2c872d68a7f033b398dbf20ebae3e25c846 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 10 Oct 2024 12:37:27 +0530 Subject: [PATCH 5/8] Update docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md --- .../cloud-to-cloud-integration-framework/kandji-source.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md index 64f409a553..d6f111d5d3 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md @@ -56,7 +56,7 @@ To configure Kandji Source: 1. In **Endpoint URL**, enter the endpoint URL collected from the Kandji platform. 1. In **Bearer Token**, enter the bearer token collected from the Kandji platform. 1. Select the **Collect Threat Details** checkbox to collect threat data. By default, **Collect Threat Details** checkbox will be selected. -1. The **Threat Details Interval** is set for 5 minutes hours by default. You can adjust it based on your needs. +1. The **Threat Details Interval** is set for 5 minutes by default. You can adjust it based on your needs. 1. In the Devices section, select the type of devices data: **Collect Devices**, **Collect Device Activities**, and/or **Collect Device Details**. 1. The **Devices Interval** is set for 12 hours hours by default. You can adjust it based on your needs. 1. **Processing Rules**. Configure any desired filters, such as allowlist, deny list, hash, or mask, as described in [Create a Processing Rule](/docs/send-data/collection/processing-rules/create-processing-rule). From f19d53cf2ccaa8e04c48516889e98793d7ea4231 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 11 Oct 2024 14:58:09 +0530 Subject: [PATCH 6/8] Update kandji-source.md --- .../cloud-to-cloud-integration-framework/kandji-source.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md index d6f111d5d3..94bbdaf0d6 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md @@ -101,8 +101,12 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Mana Download example +## Limitation + +- While retrieving threats, the source can face data loss due to API limitations and improper pagination support. If you face any such discrepancies, contact [Sumo Logic Support](https://support.sumologic.com/support/s/). + ## FAQ :::info Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. -::: \ No newline at end of file +::: From 2535e310d8619c1f721e2a58407ec7d55cb95afb Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Fri, 11 Oct 2024 15:50:53 +0530 Subject: [PATCH 7/8] Update kandji-source.md --- .../cloud-to-cloud-integration-framework/kandji-source.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md index 94bbdaf0d6..02451317ed 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/kandji-source.md @@ -42,6 +42,10 @@ The Kandji source requires you to provide the Endpoint URL and Bearer Token. Fol Threat Details endpoint is only available for EDR customers. ::: +:::info +While retrieving threats, the source can face data loss due to API limitations and improper pagination support. If you face any such discrepancies, contact [Sumo Logic Support](https://support.sumologic.com/support/s/). +::: + When you create a Kandji Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector and Source](/docs/send-data/hosted-collectors/configure-hosted-collector). To configure Kandji Source: @@ -101,10 +105,6 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Mana Download example -## Limitation - -- While retrieving threats, the source can face data loss due to API limitations and improper pagination support. If you face any such discrepancies, contact [Sumo Logic Support](https://support.sumologic.com/support/s/). - ## FAQ :::info From 02ed6f37d3c82dc849bfba674827065fe968a9ce Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 15 Oct 2024 15:19:02 -0500 Subject: [PATCH 8/8] Change release note date --- .../{2024-10-11-collection.md => 2024-10-15-collection.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename blog-service/{2024-10-11-collection.md => 2024-10-15-collection.md} (100%) diff --git a/blog-service/2024-10-11-collection.md b/blog-service/2024-10-15-collection.md similarity index 100% rename from blog-service/2024-10-11-collection.md rename to blog-service/2024-10-15-collection.md