}){kind=icon}
Learn how to collect Zeek (Bro) logs and ingest them to Cloud SIEM.
+}){kind=icon}
Learn how to collect Log Sensor status and data to support troubleshooting efforts.
Learn how to collect Zeek (Bro) logs and ingest them to Cloud SIEM.
-})
1. On the **Create Sumo Logic Mapping** page:
1. **Source Category**. Enter the Source Category value you assigned to the Source you configured above in [Configure a Sumo Logic Source](#configure-a-sumo-logic-source).
- 1. **Format**. Choose Bro/Zeek JSON.
- 1. **Event ID**. Enter *_path*.
+ 1. **Format**. Choose **Bro/Zeek JSON**.
+ 1. **Event ID**. Enter `{_path}`.
1. **Enabled**. Use the slider to enable the mapping if you’re ready to receive Zeek logs.
1. Click **Create**.})
@@ -141,3 +103,44 @@ Perform these steps for each of the FERs.
1. **Scope**. Click **Specific Data**.
1. **Parse Expression**. Enter the parse expression shown in the table above for the field the rule will extract.
1. Click **Save**.})
+
+
+## Unsupported collection method: Network Sensor
+
+:::caution End-of-Life
+This section describes using the Cloud SIEM Network Sensor. [Network Sensor has reached its end of life](/docs/cse/sensors/network-sensor-end-of-life/). Instead, use Zeek. For more information, see [Supported collection method: Sumo Logic Source](#supported-collection-method-sumo-logic-source) above.
+:::
+
+You can use Cloud SIEM’s Network Sensor to collect Zeek logs and upload them to an HTTP Source on a Sumo Logic Hosted Collector. This method ensures that supported Bro policies are enabled and that the supported Bro output format is configured. It also results in the creation of Cloud SIEM Records from the raw Zeek log messages. For instructions, see [Network Sensor Deployment Guide](/docs/cse/sensors/network-sensor-deployment-guide).
+
+The Network Sensor extracts files observed over cleartext protocols that match selected MIME types. You can configure what types will be extracted using the [extracted_file_types](/docs/cse/sensors/network-sensor-deployment-guide) property in the Network Sensor’s configuration file, `trident-sensor.cfg`. By default the sensor will upload password-protected zip files and the following types of executables:
+
+* `application/x-dosexec`
+* `application/x-msdownload`
+* `application/x-msdos-program`
+
+:::note
+YARA [file analysis](/docs/cse/rules/import-yara-rules) is supported only for files extracted by the Network Sensor. If you use your own Zeek deployment and ingest logs using a Sumo Logic Source you can't also upload extracted files.
+:::
+
+### Filtering Zeek logs
+
+This section describes two methods you can use to filter the logs that the Network Sensor sends to Cloud SIEM.
+
+* You can configure a Berkeley Packet Filter (BPF) filter using the [filter](/docs/cse/sensors/network-sensor-deployment-guide) parameter in Network Sensor’s configuration file, `trident-sensor.cfg`. This is the most efficient filtering mechanism as it is performed before Network Sensor processing.
+
+ The value of the `filter` parameter is an expression that begins with `not`. This example expression ensures the that the Network Sensor won't process any traffic involving host `a.b.c.com` or host `d.e.f.com`:
+
+ `not ( host a.b.c.com ) and not ( host d.e.f.com )`
+
+ For information about BPF filter syntax, see https://biot.com/capstats/bpf.html.
+
+* You can also filter by Zeek log type using the [skipped_log_types](/docs/cse/sensors/network-sensor-deployment-guide) property in `trident-sensor.cfg`. The default value of `skipped_log_types` is:
+
+ ```
+ dpd,weird,syslog,pe,tunnel,communication,conn-summary,known_hosts,software,stdout.stderr,loaded_scripts,ntp
+ ```
+
+ You can add additional Zeek log types to the list to exclude them.
+
+The BPF filter is applied before `skipped_log_types`. So, given the example BPF filter above, if you add `dns` to the `skipped_log_types` value, you won't ingest logs related to traffic involving hosts `a.b.c.com` or `d.e.f.com`, and you won't ingest DNS data.
\ No newline at end of file
diff --git a/docs/cse/sensors/log-sensor-troubleshooting.md b/docs/cse/sensors/log-sensor-troubleshooting.md
index cd64f64b1d..4cb9dd2d34 100644
--- a/docs/cse/sensors/log-sensor-troubleshooting.md
+++ b/docs/cse/sensors/log-sensor-troubleshooting.md
@@ -4,8 +4,9 @@ title: Log Sensor Troubleshooting
description: Learn how to collect Log Sensor status and data to support troubleshooting efforts.
---
-
+:::caution end-of-life
The Cloud SIEM Log Sensor has reached end of life and is no longer supported. Please migrate to a Sumo Logic Hosted Collector or Installed Collector. For more information, see the [end of life notice](https://app.getbeamer.com/cloudsiementerprise/en/end-of-life-notice-_-cloud-siem-enterprise-sensors).
+:::
The Cloud SIEM Log Sensor collects log data and sends it to the legacy Cloud SIEM server. (The Log Sensor does not send log data to the Sumo Logic platform. Sumo Logic collectors serve that purpose.)
diff --git a/docs/cse/sensors/network-sensor-deployment-guide.md b/docs/cse/sensors/network-sensor-deployment-guide.md
index add358f4b4..3f7bb23e45 100644
--- a/docs/cse/sensors/network-sensor-deployment-guide.md
+++ b/docs/cse/sensors/network-sensor-deployment-guide.md
@@ -6,6 +6,11 @@ description: Learn about Network Sensor deployment planning, standard sensor pla
---
import useBaseUrl from '@docusaurus/useBaseUrl';
+import SensorEOL from '../../reuse/cloud-siem-network-sensor-eol.md';
+
+:::caution end-of-life
+