From c5db550e836734ab287e8581cbb76ab00489999b Mon Sep 17 00:00:00 2001 From: Yair Leiferman Date: Mon, 25 Nov 2024 16:36:36 -0600 Subject: [PATCH 1/3] CONN-3897 Enable universal connector source with CID 25633 --- cid-redirects.json | 1 + ...based-source.md => universal-connector-source.md} | 12 +++++------- sidebars.ts | 1 + 3 files changed, 7 insertions(+), 7 deletions(-) rename docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/{config-based-source.md => universal-connector-source.md} (99%) diff --git a/cid-redirects.json b/cid-redirects.json index 292fafdf0d..6ae71e24db 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -2019,6 +2019,7 @@ "/cid/10226": "/docs/integrations/containers-orchestration/opentelemetry/activemq-opentelemetry", "/cid/25631": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source", "/cid/25632": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source", + "/cid/25633": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source", "/cid/25634": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source", "/cid/25635": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source", "/cid/25636": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source", diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md similarity index 99% rename from docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md rename to docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md index 709ee2878e..3ba7b7ed78 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md @@ -1,5 +1,5 @@ --- -id: config-based-source +id: universal-connector-source title: Universal Connector sidebar_label: Universal Connector description: Learn how to set up a Universal Connector to collect data into the Sumo Logic environment. @@ -9,12 +9,6 @@ import CodeBlock from '@theme/CodeBlock'; import ForwardToSiem from '/docs/reuse/forward-to-siem.md'; import useBaseUrl from '@docusaurus/useBaseUrl'; - - - - -

Beta

- With our Universal Connector cloud source, you can collect log data from vendor APIs with a modular configuration. The goal of this source is for Sumo Logic to expand the configuration modules over time giving greater compatibility with vendor APIs, but to acknowledge complex APIs will still require a specific cloud source and not be compatible with this source. ## Setup @@ -441,6 +435,8 @@ The syntax for this function requires a timestamp format as a single argument. R | :------------------------------------------------------------- | :---------------------------------- | | `{{ .WindowEndUTC "2006-01-02T15:04:05Z" }}` | `2024-03-07T20:15:56Z` | | `{{ .WindowEndUTC "2006-01-02T15:04:05.999999Z07:00" }}` | `2024-03-07T20:15:56.905571Z` | +| `{{ .WindowEndUTC "epoch" }}` | `1709842556` | +| `{{ .WindowEndUTC "epochMilli" }}` | `1709842556000` | | `lessThan:{{ .WindowEndUTC "2006-01-02T15:04:05.999Z07:00" }}` | `lessThan:2024-03-07T20:15:56.905Z` | ### WindowEndLocation @@ -506,6 +502,8 @@ We recommend using [this code snippet](https://goplay.tools/snippet/WTFe5ZLU9PO) | :-------------------- | :------------------------------- | :------------------------------------ | | RFC 3339 | `2024-02-01T16:07:57Z` | `2006-01-02T15:04:05Z07:00` | | RFC 3339 Nano Seconds | `2024-02-01T16:07:57.541468757Z` | `2006-01-02T15:04:05.999999999Z07:00` | +| Epoch | `1706803677` | `epoch` | +| Epoch in Milliseconds | `1706803677000` | `epochMilli` | ## FAQ diff --git a/sidebars.ts b/sidebars.ts index 9dce30781d..5653f2f45f 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -467,6 +467,7 @@ module.exports = { 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/trellix-mvisio-epo-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/trend-micro-source', + 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/webex-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source', 'send-data/hosted-collectors/cloud-to-cloud-integration-framework/zendesk-source', From 886c017f4a19af03a42d9b8b204e811d127d78ae Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 26 Nov 2024 10:41:12 -0600 Subject: [PATCH 2/3] Add to index page and product list --- docs/integrations/product-list/product-list-m-z.md | 2 +- .../cloud-to-cloud-integration-framework/index.md | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/integrations/product-list/product-list-m-z.md b/docs/integrations/product-list/product-list-m-z.md index d11fe3f7a1..bd9a3b46ee 100644 --- a/docs/integrations/product-list/product-list-m-z.md +++ b/docs/integrations/product-list/product-list-m-z.md @@ -160,7 +160,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | Thumbnail icon | [Strimzi](https://strimzi.io/) | App: [Strimzi Kafka](/docs/integrations/containers-orchestration/strimzi-kafka/) | | Thumbnail icon | [Stripe](https://stripe.com/) | Webhook: [Stripe](/docs/integrations/webhooks/stripe/) | | Thumbnail icon | [Sucuri](https://sucuri.net/) | Cloud SIEM integration: [Sucuri](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/cdfd2ba0-77eb-4e11-b071-6f4d01fda607.md) | -| Thumbnail icon | [Sumo Logic](https://www.sumologic.com/) | Apps:
- [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/)
- [Sumo Logic Audit App](/docs/integrations/sumo-apps/audit/)
- [Sumo Logic Data Volume App](/docs/integrations/sumo-apps/data-volume/)
- [Sumo Logic Enterprise Audit Apps](/docs/integrations/sumo-apps/enterprise-audit/) (multiple apps)
- [Sumo Logic Enterprise Search Audit App](/docs/integrations/sumo-apps/enterprise-search-audit/)
- [Sumo Logic Infrequent Data Tier App](/docs/integrations/sumo-apps/infrequent-data-tier/)
- [Sumo Logic Log Analysis QuickStart App](/docs/integrations/sumo-apps/log-analysis-quickstart/)
- [Sumo Logic Security Analytics App](/docs/integrations/sumo-apps/security-analytics/)
Automation integrations:
- [Automation Tools](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-automation-tools/)
- [Basic Tools](/docs/platform-services/automation-service/app-central/integrations/basic-tools/)
- [ESMTP](/docs/platform-services/automation-service/app-central/integrations/esmtp/)
- [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools/)
- [Incident Tools](/docs/platform-services/automation-service/app-central/integrations/incident-tools/)
- [IMAP](/docs/platform-services/automation-service/app-central/integrations/imap/)
- [Mail Tools](/docs/platform-services/automation-service/app-central/integrations/mail-tools/)
- [POP3](/docs/platform-services/automation-service/app-central/integrations/pop3/)
- [SMTP V3](/docs/platform-services/automation-service/app-central/integrations/smtp-v3/)
- [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/)
- [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/)
- [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/)
- [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/)
- [Sumo Logic Notifications](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications/)
- [Sumo Logic Notifications by Gmail](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications-by-gmail/)
- [Triage Tools](/docs/platform-services/automation-service/app-central/integrations/triage-tools/)
- [ZIP Tools](/docs/platform-services/automation-service/app-central/integrations/zip-tools/)
Cloud SIEM integration: [Sumo Logic](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/34A5019C-7BEC-4BF8-A3B7-C38D567126C6.md)
Community app: [Cloud Security Posture Management (CSPM) for Sumo Logic](https://github.com/SumoLogic/sumologic-content/tree/master/CSPM) | +| Thumbnail icon | [Sumo Logic](https://www.sumologic.com/) | Apps:
- [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/)
- [Sumo Logic Audit App](/docs/integrations/sumo-apps/audit/)
- [Sumo Logic Data Volume App](/docs/integrations/sumo-apps/data-volume/)
- [Sumo Logic Enterprise Audit Apps](/docs/integrations/sumo-apps/enterprise-audit/) (multiple apps)
- [Sumo Logic Enterprise Search Audit App](/docs/integrations/sumo-apps/enterprise-search-audit/)
- [Sumo Logic Infrequent Data Tier App](/docs/integrations/sumo-apps/infrequent-data-tier/)
- [Sumo Logic Log Analysis QuickStart App](/docs/integrations/sumo-apps/log-analysis-quickstart/)
- [Sumo Logic Security Analytics App](/docs/integrations/sumo-apps/security-analytics/)
Automation integrations:
- [Automation Tools](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-automation-tools/)
- [Basic Tools](/docs/platform-services/automation-service/app-central/integrations/basic-tools/)
- [ESMTP](/docs/platform-services/automation-service/app-central/integrations/esmtp/)
- [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools/)
- [Incident Tools](/docs/platform-services/automation-service/app-central/integrations/incident-tools/)
- [IMAP](/docs/platform-services/automation-service/app-central/integrations/imap/)
- [Mail Tools](/docs/platform-services/automation-service/app-central/integrations/mail-tools/)
- [POP3](/docs/platform-services/automation-service/app-central/integrations/pop3/)
- [SMTP V3](/docs/platform-services/automation-service/app-central/integrations/smtp-v3/)
- [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/)
- [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/)
- [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/)
- [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/)
- [Sumo Logic Notifications](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications/)
- [Sumo Logic Notifications by Gmail](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications-by-gmail/)
- [Triage Tools](/docs/platform-services/automation-service/app-central/integrations/triage-tools/)
- [ZIP Tools](/docs/platform-services/automation-service/app-central/integrations/zip-tools/)
Cloud SIEM integration: [Sumo Logic](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/34A5019C-7BEC-4BF8-A3B7-C38D567126C6.md)
Collector: [Universal Connector](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source)
Community app: [Cloud Security Posture Management (CSPM) for Sumo Logic](https://github.com/SumoLogic/sumologic-content/tree/master/CSPM) | | Thumbnail icon | [Superwise](https://superwise.ai/) | Webhook: [Superwise](/docs/integrations/webhooks/superwise/) | | Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/)
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/)
Cloud SIEM integration: [Symantec](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/64c7f49c-f95a-4f4a-8540-56ec5fb1d96b.md)
Community app: [Sumo Logic for Symantec WSS](https://github.com/SumoLogic/sumologic-content/tree/master/Symantec/WSS) | | Thumbnail icon | [Sysdig](https://sysdig.com/) | Cloud SIEM integration: [Sysdig](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/c4de0854-e718-45e1-a4c8-63623755aa43.md) | diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index 02f6f13390..fa5dd949d8 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -492,6 +492,12 @@ In this section, we'll introduce the following concepts: Thumbnail icon

Trend Micro

Learn how to collect alert details from Trend Micro platform.

+ +
+
+ Thumbnail icon

Universal Connector Source

 +

Learn how to set up a Universal Connector to collect data into the Sumo Logic environment.

+
From 08894e56c105cc1ea95d00783743139e5fd0a883 Mon Sep 17 00:00:00 2001 From: Yair Leiferman Date: Tue, 26 Nov 2024 10:56:06 -0600 Subject: [PATCH 3/3] Update schema name --- .../universal-connector-source.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md index 3ba7b7ed78..52257a4be9 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source.md @@ -307,8 +307,8 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma | Parameter | Type | Value | Required | Description | | :--------- | :---------- | :-------------------------------------------- | :------- | :------------------------------- | -| schemaRef | JSON Object | `{"type":"Config Based"}` | Yes | Define the specific schema type. | -| sourceType | String | `"Config Based"` | Yes | Type of source. | +| schemaRef | JSON Object | `{"type":"Universal Connector"}` | Yes | Define the specific schema type. | +| sourceType | String | `"Universal Connector"` | Yes | Type of source. | | config | JSON Object | [Configuration object](#configuration-object) | Yes | Source type specific values. | ### Configuration Object