From 65b98b5c5217a6327ecb009100670c1aea571b62 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 10 Dec 2024 19:22:23 -0600 Subject: [PATCH] Fix Cloud SIEM links to classic and new UI --- .../cse/administration/create-a-custom-tag-schema.md | 2 +- docs/cse/administration/create-cse-actions.md | 2 +- .../cse/administration/create-cse-context-actions.md | 2 +- .../create-custom-threat-intel-source.md | 2 +- docs/cse/administration/create-use-network-blocks.md | 2 +- .../manage-custom-insight-resolutions.md | 2 +- .../administration/manage-custom-insight-statuses.md | 6 +++--- docs/cse/administration/mitre-coverage.md | 4 ++-- .../about-automation-service-and-cloud-siem.md | 2 +- docs/cse/automation/automations-in-cloud-siem.md | 4 ++-- .../cse/automation/cloud-siem-automation-examples.md | 10 +++++----- .../about-cse-insight-ui.md | 4 ++-- .../cse-heads-up-display.md | 4 ++-- .../ingestion-sources-for-cloud-siem/auth0.md | 2 +- .../aws-application-load-balancer.md | 2 +- .../aws-cloudtrail.md | 2 +- .../aws-guardduty.md | 2 +- .../aws-network-firewall.md | 2 +- .../ingestion-sources-for-cloud-siem/aws-vpc-flow.md | 2 +- .../ingestion-sources-for-cloud-siem/carbon-black.md | 2 +- .../check-point-firewall.md | 2 +- .../ingestion-sources-for-cloud-siem/cisco-asa.md | 2 +- .../ingestion-sources-for-cloud-siem/cisco-meraki.md | 2 +- .../corelight-zeek.md | 4 ++-- .../fortigate-firewall.md | 2 +- .../g-suite-alert-center.md | 2 +- .../google-workspace-apps-audit.md | 2 +- .../kemp-loadmaster.md | 2 +- .../linux-os-syslog.md | 2 +- .../microsoft-audit-office.md | 2 +- .../microsoft-azure-activity-log.md | 2 +- .../microsoft-windows.md | 2 +- .../nginx-access-logs.md | 2 +- .../ingestion-sources-for-cloud-siem/okta.md | 2 +- .../ingestion-sources-for-cloud-siem/onelogin.md | 2 +- .../ingestion-sources-for-cloud-siem/osquery.md | 2 +- .../palo-alto-firewall.md | 2 +- .../ingestion-sources-for-cloud-siem/sentinelone.md | 2 +- .../signal-sciences-waf.md | 4 ++-- .../symantec-proxy-secure-gateway-blue-coat-proxy.md | 2 +- .../symantec-proxy-secure-gateway.md | 2 +- .../ingestion-sources-for-cloud-siem/zscaler-nss.md | 2 +- .../zscaler-private-access.md | 2 +- docs/cse/ingestion/sumo-logic-ingest-mapping.md | 4 ++-- docs/cse/ingestion/view-mappers-for-product.md | 2 +- .../configuring-threatq-source-in-cse.md | 2 +- .../cse/integrations/enable-virustotal-enrichment.md | 2 +- .../integrations/integrate-cse-with-taxii-feed.md | 2 +- .../create-match-list.md | 2 +- .../custom-match-list-columns.md | 2 +- .../match-lists-suppressed-lists/suppressed-lists.md | 2 +- .../configure-custom-insight.md | 2 +- .../configure-entity-lookup-table.md | 2 +- .../create-an-entity-group.md | 4 ++-- .../create-custom-entity-type.md | 2 +- .../entity-criticality.md | 4 ++-- .../set-insight-generation-window-threshold.md | 2 +- .../tags-insights-signals-entities-rules.md | 12 ++++++------ .../view-manage-entities.md | 6 +++--- .../view-records-signal.md | 2 +- docs/cse/rules/about-cse-rules.md | 4 ++-- docs/cse/rules/before-writing-custom-rule.md | 2 +- docs/cse/rules/import-yara-rules.md | 2 +- docs/cse/rules/rule-tuning-expressions.md | 2 +- docs/cse/rules/write-aggregation-rule.md | 2 +- docs/cse/rules/write-chain-rule.md | 2 +- docs/cse/rules/write-first-seen-rule.md | 2 +- docs/cse/rules/write-match-rule.md | 2 +- docs/cse/rules/write-outlier-rule.md | 2 +- docs/cse/rules/write-threshold-rule.md | 2 +- docs/cse/schema/create-structured-log-mapping.md | 2 +- .../schema/username-and-hostname-normalization.md | 2 +- docs/cse/sensors/ingest-zeek-logs.md | 2 +- .../automation-service/about-automation-service.md | 2 +- 74 files changed, 97 insertions(+), 97 deletions(-) diff --git a/docs/cse/administration/create-a-custom-tag-schema.md b/docs/cse/administration/create-a-custom-tag-schema.md index 73afa06615..2fa1c48f19 100644 --- a/docs/cse/administration/create-a-custom-tag-schema.md +++ b/docs/cse/administration/create-a-custom-tag-schema.md @@ -21,7 +21,7 @@ For more information about tags in Cloud SIEM, see [Using Tags with Insights, Si ## Define a custom tag schema -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Tag Schemas**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Tag Schemas**. You can also click the **Go To...** menu at the top of the screen and select **Tag Schemas**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Tag Schemas**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Tag Schemas**. You can also click the **Go To...** menu at the top of the screen and select **Tag Schemas**. 1. On the **Tag Schemas** page, click **+Add Tag Schema**. 1. The **Add Tag Schemas** popup appears.
Create tag schema 1. **Key**. Enter an identifier for the tag you’re defining. It won’t appear in the UI for assigning tags to a content item, unless you leave the **Label** field blank. diff --git a/docs/cse/administration/create-cse-actions.md b/docs/cse/administration/create-cse-actions.md index bc8bded9f2..77db22c827 100644 --- a/docs/cse/administration/create-cse-actions.md +++ b/docs/cse/administration/create-cse-actions.md @@ -72,7 +72,7 @@ The notification sent by a Rule Action contains the name of the rule and the re ## Create an Action -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Actions**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Actions**. You can also click the **Go To...** menu at the top of the screen and select **Actions**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Actions**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Actions**. You can also click the **Go To...** menu at the top of the screen and select **Actions**. 1. On the **Actions** tab, click **+ Add Action**. 1. The **Add Action** popup appears.
Create Action dialog 1. **Name**. Enter a name that communicates what the Action does. diff --git a/docs/cse/administration/create-cse-context-actions.md b/docs/cse/administration/create-cse-context-actions.md index 67c2354e83..c94bf86c19 100644 --- a/docs/cse/administration/create-cse-context-actions.md +++ b/docs/cse/administration/create-cse-context-actions.md @@ -57,7 +57,7 @@ import Iframe from 'react-iframe';  ## Configure a Context Action -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Context Actions**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Context Actions**. You can also click the **Go To...** menu at the top of the screen and select **Context Actions**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Context Actions**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Context Actions**. You can also click the **Go To...** menu at the top of the screen and select **Context Actions**. 1. On the **Context Actions** tab click **+ Add Context Action**. 1. Create the context action.
Configure action 1. **Name**. Enter a name for the Context Action.  diff --git a/docs/cse/administration/create-custom-threat-intel-source.md b/docs/cse/administration/create-custom-threat-intel-source.md index 862b248f7b..d326d155d0 100644 --- a/docs/cse/administration/create-custom-threat-intel-source.md +++ b/docs/cse/administration/create-custom-threat-intel-source.md @@ -41,7 +41,7 @@ Rule authors can also write rules that look for threat intelligence information ### Create a threat intelligence source from Cloud SIEM UI -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. 1. Click **Add Source** on the **Threat Intelligence** page. 1. Click **Custom** on the **Add Source** popup. 1. On the **Add New Source** popup, enter a name, and if desired, a description for the source. diff --git a/docs/cse/administration/create-use-network-blocks.md b/docs/cse/administration/create-use-network-blocks.md index f73e929ebf..de2546dd82 100644 --- a/docs/cse/administration/create-use-network-blocks.md +++ b/docs/cse/administration/create-use-network-blocks.md @@ -65,7 +65,7 @@ When Cloud SIEM looks for the Network Block address `10.128.0.1`, it will ret Follow these instructions to create a Network Block using the Cloud SIEM UI. For information about creating multiple Network Blocks by file upload, see [Upload a CSV file of Network Blocks](#upload-a-csv-file-of-network-blocks). -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Network Blocks**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Network Blocks**. You can also click the **Go To...** menu at the top of the screen and select **Network Blocks**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Network Blocks**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Network Blocks**. You can also click the **Go To...** menu at the top of the screen and select **Network Blocks**. 1. On the **Create Network Block** popup: 1. **Address Block**. Enter a CIDR block that identifies a contiguous range of IP addresses. 1. **Label**. Enter a meaningful name for the Network Block. diff --git a/docs/cse/administration/manage-custom-insight-resolutions.md b/docs/cse/administration/manage-custom-insight-resolutions.md index 719a940237..ca34c8951a 100644 --- a/docs/cse/administration/manage-custom-insight-resolutions.md +++ b/docs/cse/administration/manage-custom-insight-resolutions.md @@ -22,7 +22,7 @@ You can define custom *sub-resolutions* for any of the built-in resolutions. Thi ## Create a custom sub-resolution -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Resolutions**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Resolutions**. You can also click the **Go To...** menu at the top of the screen and select **Insight Resolutions**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Resolutions**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Resolutions**. You can also click the **Go To...** menu at the top of the screen and select **Insight Resolutions**. 1. On the **Insight Resolutions** tab, click **+ Add Resolution**. 1. The **Add Insight Resolution** popup appears. 1. **Name**. Enter a meaningful name for the new resolution. diff --git a/docs/cse/administration/manage-custom-insight-statuses.md b/docs/cse/administration/manage-custom-insight-statuses.md index cbde112eae..8fe148d8fe 100644 --- a/docs/cse/administration/manage-custom-insight-statuses.md +++ b/docs/cse/administration/manage-custom-insight-statuses.md @@ -13,7 +13,7 @@ This page has information about creating and managing custom Insight statuses. To view Insight statuses: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. 1. This screenshot of the **Insight Statuses** tab shows the three Insight statuses that are preconfigured: * **New**. Insights that have not been worked on yet. * **In Progress**. Insights that are being investigated. If you want to create custom statuses to represent different types of "in progress" states, you can click the **Enabled** toggle to disable the default **In Progress** status to reduce confusion. @@ -25,7 +25,7 @@ Preconfigured Insight statuses cannot be edited or deleted. You can however crea To create a custom Insight status: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. 1. On the **Insight Statuses** tab, click **+ Add Status**. 1. On the **Add Insight Status** popup, enter a name and description for the status. 1. Click **Color** to select a color for the status. The color will appear on the status on the [Heads Up Display](/docs/cse/get-started-with-cloud-siem/cse-heads-up-display). @@ -41,7 +41,7 @@ To change the order that the statuses appear in the **Status** dropdown, you can To change the order of Insight statuses: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Statuses**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Statuses**. You can also click the **Go To...** menu at the top of the screen and select **Insight Statuses**. 1. On the **Insight Statuses** tab, each status that can be moved has a handle to the left of its name.
Reorder icons 1. To move a status to a different location on the list, use your mouse to drag it to the desired location. diff --git a/docs/cse/administration/mitre-coverage.md b/docs/cse/administration/mitre-coverage.md index 705c56160c..ec868f5a7d 100644 --- a/docs/cse/administration/mitre-coverage.md +++ b/docs/cse/administration/mitre-coverage.md @@ -37,9 +37,9 @@ Watch this micro lesson to learn about the MITRE ATT&CK Threat Coverage Explorer ## User interface -[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To open the MITRE ATT&CK Threat Coverage Explorer, in the top menu select **Content > MITRE ATT&CK Coverage**. +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To open the MITRE ATT&CK Threat Coverage Explorer, in the top menu select **Content > MITRE ATT&CK Coverage**. -[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To open the MITRE ATT&CK Threat Coverage Explorer, in the main Sumo Logic menu select **Cloud SIEM > MITRE ATT&CK Coverage**. You can also click the **Go To...** menu at the top of the screen and select **MITRE ATT&CK Coverage**. +[**New UI**](/docs/get-started/sumo-logic-ui). To open the MITRE ATT&CK Threat Coverage Explorer, in the main Sumo Logic menu select **Cloud SIEM > MITRE ATT&CK Coverage**. You can also click the **Go To...** menu at the top of the screen and select **MITRE ATT&CK Coverage**. MITRE Coverage page diff --git a/docs/cse/automation/about-automation-service-and-cloud-siem.md b/docs/cse/automation/about-automation-service-and-cloud-siem.md index c70d9b94a1..9df905bd6f 100644 --- a/docs/cse/automation/about-automation-service-and-cloud-siem.md +++ b/docs/cse/automation/about-automation-service-and-cloud-siem.md @@ -46,7 +46,7 @@ Before you can access the Automation Service from Cloud SIEM, you must first [co ::: 1. To access the Automation Service from Cloud SIEM: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**.
The list of available Cloud SIEM automations appears. Each automation runs a playbook.
Automations list + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**.
The list of available Cloud SIEM automations appears. Each automation runs a playbook.
Automations list 1. At the top of the screen, click **Manage Playbooks**.
Manage Playbooks menu option
The Automation Service screen displays:
Automation Playbook list :::note You can also launch the Automation Service by selecting **Automation** from the main menu:
Automation menu option in the nav bar
If you also have Cloud SOAR installed, a **Cloud SOAR** option appears instead, since all automation services are provided by Cloud SOAR when it installed in conjunction with Cloud SIEM. diff --git a/docs/cse/automation/automations-in-cloud-siem.md b/docs/cse/automation/automations-in-cloud-siem.md index 9258fcd21f..2ec0430d7f 100644 --- a/docs/cse/automation/automations-in-cloud-siem.md +++ b/docs/cse/automation/automations-in-cloud-siem.md @@ -82,7 +82,7 @@ If you configured the automation to [run manually](#run-an-automation-manually), ## View automations -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. 1. View the list of available automations. (If no automations display, you must first [create an automation](#create-an-automation)).
Automations list To view the automations that have run on Insights or Entities, see [View results of an automation](#view-results-of-an-automation). @@ -91,7 +91,7 @@ To view the automations that have run on Insights or Entities, see [View results The following procedure provides a brief introduction to how to create an automation. For detailed examples, see [Cloud SIEM Automation Examples](/docs/cse/automation/cloud-siem-automation-examples/). -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. 1. At the top of the **Automation** tab, click **+ Add Automation**. (To modify an existing automation, select the automation and click **Edit**.)
Automations list 1. In the **Add Automation** dialog, select a **Playbook** from the drop-down list. The playbook must be defined before associating it with an automation.
New Automation 1. Set the **Status**. Disabled automations will not run automatically and will not appear in any **Actions** or **Automations** menus. diff --git a/docs/cse/automation/cloud-siem-automation-examples.md b/docs/cse/automation/cloud-siem-automation-examples.md index e6692ab715..14ac607fe4 100644 --- a/docs/cse/automation/cloud-siem-automation-examples.md +++ b/docs/cse/automation/cloud-siem-automation-examples.md @@ -62,7 +62,7 @@ The following example shows how to add an enrichment to an Insight using the “ 1. To [test the playbook](/docs/platform-services/automation-service/automation-service-playbooks/#test-a-playbook), click the kebab button in the upper-right of the UI and select **Run Test**. 1. Click the **Publish** button (clipboard icon) at the bottom of the playbook view. The playbook should look like this:
Simple playbook for Insight enrichment 1. Create an automation in Cloud SIEM to run the playbook: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**. 1. At the top of the **Automation** tab, click **+ Add Automation**. 1. For **Playbook**, select the playbook you created in the previous steps. 1. For **Object (expects attributes for)**, select **Insight**. @@ -134,7 +134,7 @@ The following example shows how to configure a notification that sends an email 1. To [test the playbook](/docs/platform-services/automation-service/automation-service-playbooks/#test-a-playbook), click the kebab button in the upper-right of the UI and select **Run Test**. 1. Click the **Publish** button (clipboard icon) at the bottom of the playbook view. The playbook should look like this:
Playbook for notification 1. Create an automation in Cloud SIEM to run the playbook: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu of Cloud SIEM select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu of Cloud SIEM select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. 1. At the top of the **Automation** tab, click **+ Add Automation**. 1. For **Playbook**, select the playbook you created in the previous steps. 1. For **Object (expects attributes for)**, select **Insight**. @@ -238,7 +238,7 @@ The action uses [IP Quality Score](https://www.ipqualityscore.com/) to gather IP 1. To [test the playbook](/docs/platform-services/automation-service/automation-service-playbooks/#test-a-playbook), click the kebab button in the upper-right of the UI and select **Run Test**. 1. Click the **Publish** button (clipboard icon) at the bottom of the playbook view. The playbook should look like this:
Custom playbook for Insight enrichment 1. Create an automation in Cloud SIEM to run the playbook: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. 1. At the top of the **Automation** tab, click **+ Add Automation**. 1. For **Playbook**, select the playbook you created in the previous steps. 1. For **Object (expects attributes for)**, select **Insight**. @@ -278,7 +278,7 @@ The following example pulls together elements of the [Simple example](#simple-ex 1. Enter the **API Key**. See the [VirusTotal documentation](https://support.virustotal.com/hc/en-us/articles/115002100149-API) to learn how to obtain the API key. If you do not already have a VirusTotal account, you need to create one to get an API key. 1. Click **Save**.
Edit resource 1. Edit the Sumo Logic resource: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. 1. From the Automation screen, click **Manage Playbooks**. This opens the [Automation Service UI](/docs/platform-services/automation-service/about-automation-service/#automation-service-ui). 1. Click **Integrations** in the navigation menu. 1. Select **Sumo Logic**. @@ -361,7 +361,7 @@ The following example pulls together elements of the [Simple example](#simple-ex 1. To [test the playbook](/docs/platform-services/automation-service/automation-service-playbooks/#test-a-playbook), click the kebab button in the upper-right of the UI and select **Run Test**. 1. Click the **Publish** button (clipboard icon) at the bottom of the playbook view. The playbook should look like this:
Complex playbook 1. Create an automation in Cloud SIEM to run the playbook: - 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Cloud SIEM**. In the top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. 1. For **Playbook**, select the playbook you created in the previous steps. 1. For **Object (expects attributes for)**, select **Insight**. 1. For **Execution**, select **Manually Done**. diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md index 4378d96869..eb6372cef7 100644 --- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md +++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md @@ -11,9 +11,9 @@ This topic describes the Cloud SIEM UI for working with insights.  ## Insights list page -[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To open the insights page, click **Insights** at the top of the screen. +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To open the insights page, click **Insights** at the top of the screen. -[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To open the insights page, in the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. +[**New UI**](/docs/get-started/sumo-logic-ui). To open the insights page, in the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. By default, the **Insights** page presents all insights whose status is not “Closed”, in descending order by event time in a list view. If you’d like to see insights organized by their status, click the **Show Board** icon near the top right corner of the page. For information about the board view, see [Board view](#board-view). diff --git a/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md b/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md index c8fdcf505d..33266444db 100644 --- a/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md +++ b/docs/cse/get-started-with-cloud-siem/cse-heads-up-display.md @@ -8,9 +8,9 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This topic describes Cloud SIEM *Heads Up Display (HUD)*, the landing page for the Cloud SIEM UI. The HUD provides an at-a-glance overview of Insight status and activity. -[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM**. +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM**. -[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM > SIEM Overview**. You can also click **Go To...** at the top of the screen and select **SIEM Overview**. +[**New UI**](/docs/get-started/sumo-logic-ui). To access the HUD, in the main Sumo Logic menu select **Cloud SIEM > SIEM Overview**. You can also click **Go To...** at the top of the screen and select **SIEM Overview**. :::note Data on the HUD is generated by internal searches that may result in slightly different results than a [log search query](/docs/search/) for the same time period, because of the way each method calculates time periods. But these differences cancel out over time. So while there may be a small variance between numbers of Records, Signals, and Insights in a given time frame, the effect is only noticeable when viewing very small time slices, for example, under 30 minutes. If you need to get exact tracking for reporting or other use cases, use dashboards in apps like the [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/) app. diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0.md index eaf9077101..2c63c9a255 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0.md @@ -55,6 +55,6 @@ in Auth0 help.  In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for Auth0 and check the **Records** columns.
Record volume 1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for Auth0 security records.
Auth0 search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer.md index 1bd377c439..bde8e2e26f 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer.md @@ -70,6 +70,6 @@ It’s also possible to configure individual sources to forward to Cloud SIEM, a In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "AWS Application Load Balancer" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for AWS ALB Flow security records.
AWS ELB search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail.md index a62638ecff..153c1c8da6 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail.md @@ -46,7 +46,7 @@ It’s also possible to configure individual sources to forward to Cloud SIEM, a In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "CloudTrail" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for CloudTrail security records.
CloudTrail search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty.md index dc50894356..b79fc01692 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty.md @@ -75,6 +75,6 @@ In this step, you deploy the events processor. This will create the AWS resource In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "GuardDuty" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for GuardDuty security records..
GuardDuty search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall.md index b027c282dc..dee9863953 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall.md @@ -61,7 +61,7 @@ It’s also possible to configure individual sources to forward to Cloud SIEM, a In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "AWS Network Firewall " and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for AWS Network Firewall security records.
AWS Firewall search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow.md index 7e3dc775a3..6e501ecf2f 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow.md @@ -70,6 +70,6 @@ It’s also possible to configure individual sources to forward to Cloud SIEM, a In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "AWS VPC Flow" and check the **Records** columns.  1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for AWS VPC Flow security records. diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black.md index dbb435cb91..8ac8da19a6 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black.md @@ -75,6 +75,6 @@ In this step you configure Carbon Black Cloud to send log messages to an S3 buck In this step, you verify that your logs are successfully making it into Cloud SIEM. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 2. On the **Log Mappings** tab search for Carbon Black Cloud and check the **Records** columns. 3. For a more granular look at the incoming Records, you can also search Sumo Logic for Carbon Black Cloud Records.
A Carbon Black query diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall.md index b85d3f5659..ac65c7d96e 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall.md @@ -61,6 +61,6 @@ In this step you configure Check Point Firewall to send log messages to the Sumo In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "checkpoint" and check the **Records** columns. 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for Check Point Firewall security records.
Checkpoint search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa.md index 59b371146d..3ab5c7bed7 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa.md @@ -59,6 +59,6 @@ To configure Cisco ASA logging, follow the instructions in the [ASA Syslog Conf In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Cisco ASA" and check the **Records** columns. A list of mappers for Cisco ASA Syslog will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also use search the Sumo Logic platform for Cisco ASA security records.
Cisco ASA search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki.md index c22222cd55..191d10d5d8 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki.md @@ -60,6 +60,6 @@ Configure logging for Cisco Meraki as described in [Syslog Server Overview and In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Cisco Meraki" and check the **Records** columns. A list of mappers for Cisco Meraki will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also use search the Sumo Logic platform for Cisco Meraki security records.
Cisco Meraki search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md index b5a96cee38..de36b78a29 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek.md @@ -57,7 +57,7 @@ In this step you configure Zeek to send log messages to the Sumo Logic platform. In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the source category assigned to your source or collector you configured in [Step 1](#step-1-configure-collection). The mapping tells Cloud SIEM the information it needs to select the right mapper to process messages that have been tagged with that source category.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then and under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then and under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. 1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**. 1. On the **Add Ingest Mapping** popup: 1. **Source Category**. Enter the category you assigned to the HTTP Source or Hosted Collector in [Step 1](#step-1-configure-collection).  @@ -69,6 +69,6 @@ In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the so In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Zeek" and check the **Records** columns. 
Corelight record volume 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for Corelight Zeek security records.
Corelight search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall.md index acb30eb109..466bdf7ec5 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall.md @@ -69,6 +69,6 @@ Different parsers are required for CEF and JSON format logs. In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "FortiGate" and check the **Records** columns. A list of mappers for FortiGate will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for FortiGate security records.
Fortigate search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center.md index 6df6067331..b960ba0688 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center.md @@ -49,6 +49,6 @@ In this step, you configure an HTTP Source to collect G Suite Alert Center log m In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "G Suite Alert Center" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for G Suite Alert Center security records.
GSuite search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit.md index 090435c750..28f2fe0238 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit.md @@ -36,6 +36,6 @@ In this step, you configure an Google Workspace Apps Audit Source to collect Goo In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Google Workspace" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Google Workspace security records.
GSuite search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster.md index e0211d4d6e..a5441e39c7 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster.md @@ -62,6 +62,6 @@ While the linked document only focuses on unexpected reboot logs, the process fo In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Kemp" and check the **Records** column. A list of mappers for Kemp will appear and you can see if logs are coming in.  1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for Kemp security records.
Kemp search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog.md index a119cffa86..45c8553b73 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog.md @@ -86,6 +86,6 @@ In this step, you configure forwarding to the the Syslog Source. Follow the ins In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Linux OS" and check the **Records** columns. A list of mappers for Linux OS Syslog will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for Linux OS security records.
Search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office.md index 2a57376776..cc660651f7 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office.md @@ -41,6 +41,6 @@ In this step, you configure an Microsoft 365 Audit Source to collect Microsoft 3 In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for Office 365 and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Office 365 security records.
Office 365 audit search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log.md index bbae6229fa..7e1dad5187 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log.md @@ -53,6 +53,6 @@ In this step you configure Azure Activity Log to send log messages to the Sumo L In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Azure" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Azure security records.
Azure activity log search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows.md index 0dbed7c814..debc880d8c 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows.md @@ -60,6 +60,6 @@ In this step, you configure a Local Windows Event Log Source to collect Microsof In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Windows" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also use search the Sumo Logic platform for Windows security records.
Windows search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs.md index bb9495bfdb..b4a98102ab 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs.md @@ -64,6 +64,6 @@ Follow the Nginx [instructions](https://docs.nginx.com/nginx/admin-guide/monito In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Nginx" and check the **Records** columns. A list of mappers for Nginx will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for Nginx security records.
Nginix search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta.md index 50aa296955..446218b3db 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta.md @@ -32,6 +32,6 @@ In this step, you configure an Okta Source to collect Okta log messages. You can In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for Okta and check the **Records** columns. 1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for Okta security records.
Okta search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin.md index fd1758c3eb..98f74cec9a 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin.md @@ -55,6 +55,6 @@ the OneLogin knowledge base. You must use the SIEM (NDJSON) format. Use the **S In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "OneLogin" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for OneLogin security records.
OneLogin search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery.md index 1810d5f5b1..b1845dad9a 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery.md @@ -64,6 +64,6 @@ In this step you configure osquery to send log messages to Sumo Logic core platf In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab, search for *osquery* and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search Sumo Logic for osquery Records. diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall.md index f8f491cb88..1f681e431b 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall.md @@ -116,6 +116,6 @@ In this step, you configure Palo Alto Firewall to send log messages to the Sumo In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Palo Alto" and check the **Records**. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Palo Alto Firewall security records.
Palo Alto Firewall search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone.md index 0a4c68252f..9dc76db0ef 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone.md @@ -56,7 +56,7 @@ In this step you configure SentinelOne to send log messages to the Sumo Logic pl In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "SentinelOne" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for SentinelOne security records.
SentinelOne search   diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf.md index 7f1c477cd2..32dc91d527 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf.md @@ -57,7 +57,7 @@ For more information on Generic Webhooks refer to the [Generic Webhooks](https:/ In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the source category assigned to your source or collector you configured in [Step 1](#step-1-configurecollection). The mapping tells Cloud SIEM the information it needs to select the right mapper to process messages that have been tagged with that source category.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. 1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**. 1. On the **Add Ingest Mapping** popup: * **Source Category**. Enter the category you assigned to the HTTP Source or Hosted Collector in [Step 1](#step-1-configurecollection).  @@ -71,7 +71,7 @@ In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the so In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** page search for "Signal Sciences" and check the **Records** columns.
Signal Sciences record volume 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Signal Sciences WAF security records.   diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy.md index 1cb8bc05ab..3f6194e0f7 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy.md @@ -67,6 +67,6 @@ In this step, you configure ProxySG to forward access logs to the the Syslog S In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "ProxySG" and check the **Records** columns. A list of mappers for ProxySG will appear and you can see if logs are coming in. 1. For a more granular look at the incoming Records, you can also search Sumo Logic for ProxySG Records.
ProxySG search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway.md index 05c2f37264..66f23a3619 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway.md @@ -71,6 +71,6 @@ Instructions for sending access logs to a syslog server are available on the [Br In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "ProxySG" and check the **Records** columns. A list of mappers for ProxySG Syslog will appear and you can see if logs are coming in. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Proxy Secure Gateway security Records.
PSG search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss.md index c93484d350..2aa93b9068 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss.md @@ -60,6 +60,6 @@ In this step, you configure ZScaler NSS to send log messages to the Sumo Logic In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "Nanolog Streaming Service" and check the **Records** columns. 1. For a more granular look at the incoming Records, you can also search the Sumo Logic platform for ZScaler NSS security Records.
Zscaler NSS search diff --git a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access.md b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access.md index 5916bb69ec..d1b0b784f3 100644 --- a/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access.md +++ b/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access.md @@ -56,6 +56,6 @@ In this step you configure Zscaler Private Access to send log messages to Sumo L In this step, you verify that your logs are successfully making it into Cloud SIEM.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. On the **Log Mappings** tab search for "ZPA" and check the **Records** columns. 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for "ZPA" security records.
Zscaler search diff --git a/docs/cse/ingestion/sumo-logic-ingest-mapping.md b/docs/cse/ingestion/sumo-logic-ingest-mapping.md index 97282ac32d..c858b08fdf 100644 --- a/docs/cse/ingestion/sumo-logic-ingest-mapping.md +++ b/docs/cse/ingestion/sumo-logic-ingest-mapping.md @@ -73,7 +73,7 @@ When you fill out the **Add Ingest Mapping** page, for most of the supported mes For these formats, Cloud SIEM uses the values you configure for **Product**, **Vendor**, and **Event ID** (in addition to **Format**) to select the appropriate Cloud SIEM mapper to process the messages. To verify the correct values, you can go to the **Log Mapping Details** page for the mapper in the Cloud SIEM UI. To do so: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. The **Log Mappings** tab displays a list of mappers.
Log Mappings page 1. In the **Filters** area, you can filter the list of log mappings by typing in a keyword, or by selecting a field to filter by.
Log Mappings filters @@ -104,7 +104,7 @@ This table in this section is a quick reference to supplying values for each su In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the source category assigned to your source or collector you configured. The mapping tells Cloud SIEM the information it needs to select the right mapper to process messages that have been tagged with that source category.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. 1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**. 1. On the **Add Ingest Mapping** popup: 1. **Source Category**. Enter the category you assigned to the HTTP Source or Hosted Collector.  diff --git a/docs/cse/ingestion/view-mappers-for-product.md b/docs/cse/ingestion/view-mappers-for-product.md index 989f272c28..871bab98af 100644 --- a/docs/cse/ingestion/view-mappers-for-product.md +++ b/docs/cse/ingestion/view-mappers-for-product.md @@ -13,7 +13,7 @@ See the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-con Cloud SIEM may have more than one log mapping for a particular product. For example, there may be a separate mapping for each message type issued by a product. You can view the available mappings in the Cloud SIEM UI. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. In the **Filters** area, filter by **Output Vendor**, **Output Product**, or both. In the following screenshot, the list of mappings is filtered to display mappings for *Output Vendor is Proofpoint*. The list contains six mappings for two Proofpoint products: one for Proofpoint On Demand, and the rest for Targeted Attack Protection.
Proofpoint log mapping diff --git a/docs/cse/integrations/configuring-threatq-source-in-cse.md b/docs/cse/integrations/configuring-threatq-source-in-cse.md index ba803878ec..468f45c6ff 100644 --- a/docs/cse/integrations/configuring-threatq-source-in-cse.md +++ b/docs/cse/integrations/configuring-threatq-source-in-cse.md @@ -17,7 +17,7 @@ To do so, you simply configure a ThreatQ source in Cloud SIEM. You supply the in ## Configure a ThreatQ source -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. 1. On the **Threat Intelligence** page, click **Add Source**. 1. On the **Add New Source** page, click **Create** in the ThreatQ tile.
ThreatQ create icon 1. The **Add New Source** page updates.
ThreatQ Add New Source diff --git a/docs/cse/integrations/enable-virustotal-enrichment.md b/docs/cse/integrations/enable-virustotal-enrichment.md index a2f43415c8..54c113ba7f 100644 --- a/docs/cse/integrations/enable-virustotal-enrichment.md +++ b/docs/cse/integrations/enable-virustotal-enrichment.md @@ -36,7 +36,7 @@ VirusTotal enrichments are only added to Signals that are part of an Insight. ## Configure VirusTotal enrichment -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Enrichment**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Enrichment**. You can also click the **Go To...** menu at the top of the screen and select **Enrichment**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Enrichment**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Enrichment**. You can also click the **Go To...** menu at the top of the screen and select **Enrichment**. 1. On the **Enrichment** tab, select **VirusTotal** and click the **Edit** button. 2. On the **Edit VirusTotal** popup, enter your VirusTotal API Key, and click **Save**. diff --git a/docs/cse/integrations/integrate-cse-with-taxii-feed.md b/docs/cse/integrations/integrate-cse-with-taxii-feed.md index 43f38728b5..61ae228ac8 100644 --- a/docs/cse/integrations/integrate-cse-with-taxii-feed.md +++ b/docs/cse/integrations/integrate-cse-with-taxii-feed.md @@ -29,7 +29,7 @@ Cloud SIEM supports TAXII v1.1 and v1.2.  ## Configure the integration -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Threat Intelligence**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Threat Intelligence**. You can also click the **Go To...** menu at the top of the screen and select **Threat Intelligence**. 1. On the **Threat Intelligence** page, click **Add Source**. 1. On the **Add New Source** popup, click **TAXII Feed**.
TAXII Feed option 1. The **Add Source** page appears.
Add new source diff --git a/docs/cse/match-lists-suppressed-lists/create-match-list.md b/docs/cse/match-lists-suppressed-lists/create-match-list.md index 6aaa37e445..42b9e45338 100644 --- a/docs/cse/match-lists-suppressed-lists/create-match-list.md +++ b/docs/cse/match-lists-suppressed-lists/create-match-list.md @@ -81,7 +81,7 @@ Perform the steps below to create a Match List in Cloud SIEM. You can also create and manage Match Lists with Cloud SIEM's REST [API](/docs/cse/administration/cse-apis). ::: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Match Lists**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Match List**. You can also click the **Go To...** menu at the top of the screen and select **Match List**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Match Lists**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Match List**. You can also click the **Go To...** menu at the top of the screen and select **Match List**. 1. Click **Create**. 1. On the **New Match List** popup, enter the following: 1. **Name**. Name of the Match list. If you are creating a standard Match List, make sure the name matches the standard Match List name. For more information, see [Standard Match Lists](/docs/cse/match-lists-suppressed-lists/standard-match-lists#standard-match-lists). We recommend no embedded spaces in list names. For example, instead of *my list*, use *my_list*. diff --git a/docs/cse/match-lists-suppressed-lists/custom-match-list-columns.md b/docs/cse/match-lists-suppressed-lists/custom-match-list-columns.md index e5bb677563..4ebf56ba2c 100644 --- a/docs/cse/match-lists-suppressed-lists/custom-match-list-columns.md +++ b/docs/cse/match-lists-suppressed-lists/custom-match-list-columns.md @@ -20,7 +20,7 @@ If you create a Match List for which none of the existing Target Column options To see the custom columns that have been defined in your environment: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Match Lists**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Match List**. You can also click the **Go To...** menu at the top of the screen and select **Match List**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Match Lists**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Match List**. You can also click the **Go To...** menu at the top of the screen and select **Match List**. 1. On the **Match Lists** page, click **Custom Columns**.
Match lists 1. The **Custom Columns** page lists the custom columns that have been defined in your environment. diff --git a/docs/cse/match-lists-suppressed-lists/suppressed-lists.md b/docs/cse/match-lists-suppressed-lists/suppressed-lists.md index c3810e5d17..5755be5f52 100644 --- a/docs/cse/match-lists-suppressed-lists/suppressed-lists.md +++ b/docs/cse/match-lists-suppressed-lists/suppressed-lists.md @@ -72,7 +72,7 @@ A Suppressed List can contain up to 50,000 items. Perform the steps below to create a Suppressed List and add an indicator to it using the Cloud SIEM UI. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Suppressed Lists**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Suppressed Lists**. You can also click the **Go To...** menu at the top of the screen and select **Suppressed Lists**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Suppressed Lists**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Suppressed Lists**. You can also click the **Go To...** menu at the top of the screen and select **Suppressed Lists**. 1. Click **Create**.
Create a suppressed list 1. On the **New Suppressed List** popup, enter the following: 1. **Name**. Name of the Suppressed List. diff --git a/docs/cse/records-signals-entities-insights/configure-custom-insight.md b/docs/cse/records-signals-entities-insights/configure-custom-insight.md index 5d43e1f923..efc88d3b56 100644 --- a/docs/cse/records-signals-entities-insights/configure-custom-insight.md +++ b/docs/cse/records-signals-entities-insights/configure-custom-insight.md @@ -29,7 +29,7 @@ When the conditions of a Custom Insight configuration are met during the current To create a Custom Insight: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu, select **Content > Custom Insights**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Custom Insights**. You can also click the **Go To...** menu at the top of the screen and select **Custom Insights**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu, select **Content > Custom Insights**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Custom Insights**. You can also click the **Go To...** menu at the top of the screen and select **Custom Insights**. 2. Click **Create** on the **Custom Insights** page. 3. The **Configure the Custom Insight** popup appears.
Configure an Insight 4. In the **Name** field, enter a name for the Custom Insight. diff --git a/docs/cse/records-signals-entities-insights/configure-entity-lookup-table.md b/docs/cse/records-signals-entities-insights/configure-entity-lookup-table.md index f29c17bc13..68b4dd2e47 100644 --- a/docs/cse/records-signals-entities-insights/configure-entity-lookup-table.md +++ b/docs/cse/records-signals-entities-insights/configure-entity-lookup-table.md @@ -71,7 +71,7 @@ For instructions, see [Create a Lookup Table](/docs/search/lookup-tables/create- After you've [created your Entity Lookup Table](/docs/search/lookup-tables/create-lookup-table/) in the Sumo Logic Library, you can configure it in Cloud SIEM. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Normalization**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Normalization**. You can also click the **Go To...** menu at the top of the screen and select **Normalization**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Normalization**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Normalization**. You can also click the **Go To...** menu at the top of the screen and select **Normalization**. 1. On the **Normalization** tab, click **Lookup Tables**. 1. Select the lookup table. 1. The **Existing Lookup Table** popup appears. Following is an example.
Existing Lookup Table dialog diff --git a/docs/cse/records-signals-entities-insights/create-an-entity-group.md b/docs/cse/records-signals-entities-insights/create-an-entity-group.md index bdcbcad1b9..64c4752b60 100644 --- a/docs/cse/records-signals-entities-insights/create-an-entity-group.md +++ b/docs/cse/records-signals-entities-insights/create-an-entity-group.md @@ -46,7 +46,7 @@ It’s possible to define Entity Groups that overlap, in terms of the Entities t Follow these instructions to create an Entity Group based on Entity name or whether the Entity is within a specified range of IP addresses. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Groups**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Groups**. You can also click the **Go To...** menu at the top of the screen and select **Groups**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Groups**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Groups**. You can also click the **Go To...** menu at the top of the screen and select **Groups**. 1. On the **Entity Groups** page, click **+ Add Entity Group**. 1. The **Add Entity Group** popup appears. (In the screenshot below, values are already entered.)
Create an Entity Group based on attributes 1. **Name**. Enter a name for the Entity Group. @@ -81,7 +81,7 @@ Follow these instructions to create an Entity Group based on Entity name or whet Follow these instructions to create an Entity Group that corresponds to a group in an inventory service in your infrastructure. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Groups**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Groups**. You can also click the **Go To...** menu at the top of the screen and select **Groups**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Groups**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Groups**. You can also click the **Go To...** menu at the top of the screen and select **Groups**. 1. On the **Entity Groups** page, click **+ Add Entity Group**. 1. The **Add Entity Group** popup appears. (In the screenshot below, values are already entered.)
Create an Entity Group based on inventory 1. **Name**. Enter a name for the Entity Group. diff --git a/docs/cse/records-signals-entities-insights/create-custom-entity-type.md b/docs/cse/records-signals-entities-insights/create-custom-entity-type.md index 0378b03d51..fe862d86df 100644 --- a/docs/cse/records-signals-entities-insights/create-custom-entity-type.md +++ b/docs/cse/records-signals-entities-insights/create-custom-entity-type.md @@ -21,7 +21,7 @@ Just as for Entities of built-in types listed above—IP addresses, MAC addresse To create a custom Entity type: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Custom Types**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Custom Types**. You can also click the **Go To...** menu at the top of the screen and select **Custom Types**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Custom Types**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Custom Types**. You can also click the **Go To...** menu at the top of the screen and select **Custom Types**. 1. On the **Custom Entity Types** tab click **+ Add Custom Type**.  2. The **Add Custom Entity Type** popup appears.
Create custom Entity type 3. **Name**. Enter a meaningful name for the custom Entity type. The name can include alphanumeric characters and spaces. The name you enter will appear as the **Name** of the custom Entity type on the **Custom Entity Type** page.  diff --git a/docs/cse/records-signals-entities-insights/entity-criticality.md b/docs/cse/records-signals-entities-insights/entity-criticality.md index 337edfc3ba..e58e4bf8b8 100644 --- a/docs/cse/records-signals-entities-insights/entity-criticality.md +++ b/docs/cse/records-signals-entities-insights/entity-criticality.md @@ -30,7 +30,7 @@ You can configure both the detection window and the threshold Activity Score for ## Define a Criticality -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Criticality**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Criticality**. You can also click the **Go To...** menu at the top of the screen and select **Criticality**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Criticality**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Criticality**. You can also click the **Go To...** menu at the top of the screen and select **Criticality**. 1. On the **Criticality** tab, click **+ Add Criticality**.  1. The **Add Criticality** popup appears.
Create Entity Criticality dialog 2. **Name**. Enter a name.  @@ -41,7 +41,7 @@ You can configure both the detection window and the threshold Activity Score for You can associate a Criticality with one or more Entities.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Click **Entities** at the top of the screen.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Click **Entities** at the top of the screen.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. 1. Navigate to the Entity you want to assign a Criticality and click on it to display the **Entity Details** page.  2. On the **Entity Details** page, click the **Criticality** field to display a list of Criticalities.
Entity criticality details 3. Click a Criticality to apply it to the Entity. diff --git a/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md b/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md index 9824953253..4439c28ba9 100644 --- a/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md +++ b/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md @@ -13,7 +13,7 @@ By default, the detection window is 14 days, and the threshold Activity Score i To change the Insight generation settings: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Workflow** select **Detection**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu click **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Detection**. You can also click the **Go To...** menu at the top of the screen and select **Insight Detection**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Workflow** select **Detection**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu click **Configuration**, and then under **Cloud SIEM Workflow** select **Insight Detection**. You can also click the **Go To...** menu at the top of the screen and select **Insight Detection**.
Your current detection settings are displayed on the Insight Detection page.
Detection threshold settings 1. Enter values for **Detection Threshold** and **Signal Suppression**: * **Standard Threshold** diff --git a/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules.md b/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules.md index df7c68e8ee..54a3e495c2 100644 --- a/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules.md +++ b/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules.md @@ -63,14 +63,14 @@ difference is where you do the tagging.  ### UI for tagging a Rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. Navigate to a custom rule. 1. The UI for tagging is at the bottom of the **Then Create a Signal** area of the **Rule Editor**. 1. To add a tag, follow the instructions in [Add a schema key tag](#applya-schema-key-tag) or [Add a keyword tag](#apply-a-keyword-tag).
Tag a rule ### UI for tagging an Entity -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Click **Entities** at the top of the screen.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Click **Entities** at the top of the screen.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. 1. Navigate to the Entity to which you want to attach a tag. 1. The UI for tagging is at the bottom of the **Details** pane. 2. To add a tag, follow the instructions in [Add a keyword tag](#apply-a-keyword-tag).
Tag an Entity @@ -79,14 +79,14 @@ difference is where you do the tagging.  Note that in addition to tags that you manually assign to an Insight, an Insight will inherit any tags that were applied to the content that went into the Insight—the entity and the rule(s) or custom insight definitions that created the included signals—will automatically be inherited (and aggregated) by the Insight.  -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Click **Insights** at the top of the screen.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Insights**. You can also click the **Go To...** menu at the top of the screen and select **Insights**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Click **Insights** at the top of the screen.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Insights**. You can also click the **Go To...** menu at the top of the screen and select **Insights**. 1. Navigate to the Insight to which you want to attach a tag. 1. The UI for tagging is at the bottom of the **Details** pane. 1. To add a tag, follow the instructions in [Add a schema key tag](#applya-schema-key-tag) or [Add a keyword tag](#apply-a-keyword-tag).
Tag an Insight ### UI for tagging a custom Insight -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Custom Insights**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Custom Insights**. You can also click the **Go To...** menu at the top of the screen and select **Custom Insights**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Custom Insights**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Custom Insights**. You can also click the **Go To...** menu at the top of the screen and select **Custom Insights**. 1. Navigate to a custom Insight. 1. The UI for tagging is at the bottom of the **Then Create a Signal** area of the Insight Editor. 1. To add a tag, follow the instructions in [Add a schema key tag](#applya-schema-key-tag) or [Add a keyword tag](#apply-a-keyword-tag).
Tag a Custom Insight @@ -111,7 +111,7 @@ Note that in addition to tags that you manually assign to an Insight, an Insight ### Search Insights, Signals, or Entities by tag -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Near the top of the screen, click in the Cloud SIEM search area and then click the funnel icon.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Search Cloud SIEM**, and click the funnel icon. You can also click the **Go To...** menu at the top of the screen and select **Search Cloud SIEM**.
Funnel icon +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Near the top of the screen, click in the Cloud SIEM search area and then click the funnel icon.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Search Cloud SIEM**, and click the funnel icon. You can also click the **Go To...** menu at the top of the screen and select **Search Cloud SIEM**.
Funnel icon 1. Select **Insights**, **Signals**, or **Entities** from the **Sources** list.
Sources 1. Select **Tags** from the **Fields** list.
Tags field 1. Choose **contain** or **do not contain** from the **Operators** list.
Operators @@ -119,7 +119,7 @@ Note that in addition to tags that you manually assign to an Insight, an Insight ### Search Rules by tag -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. Click in the **Filters** area and select **Tags** from the **Fields** list.
Search rules by tag 1. Choose **contain** or **do not contain** from the **Operators** list.
Operators 1. Select a tag from either the **Schema Keys** or **Keyword Tags** list. If you select a tag from the **Schema Keys** list, you are prompted to select a value, and items that match are listed. If you select a tag from the **Keywords Tags** list, items that match are listed. Note that if an item has a Mitre-related tag, an icon appears next to it. Click the icon to view a Mitre page on the Tactic or Technique. diff --git a/docs/cse/records-signals-entities-insights/view-manage-entities.md b/docs/cse/records-signals-entities-insights/view-manage-entities.md index 3fdc2125dc..1cc38e833d 100644 --- a/docs/cse/records-signals-entities-insights/view-manage-entities.md +++ b/docs/cse/records-signals-entities-insights/view-manage-entities.md @@ -54,9 +54,9 @@ When a Signal is fired, if an Entity doesn’t already exist in Cloud SIEM for t ## About the Entities list page -[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To view Entities, click **Entities** at the top of the screen. +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view Entities, click **Entities** at the top of the screen. -[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To view Entities, in the main Sumo Logic menu select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. +[**New UI**](/docs/get-started/sumo-logic-ui). To view Entities, in the main Sumo Logic menu select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. Entities page @@ -136,7 +136,7 @@ or Criticality for one or more Entities. ### Update Entities from the UI -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). Click **Entities** at the top of the screen.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Click **Entities** at the top of the screen.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Entities**. You can also click the **Go To...** menu at the top of the screen and select **Entities**. 1. Note that there is a checkbox at the left end of each Entity row, and one above the Entities list. 
Entities page 1. Click the top checkbox to select all of the Entities on the page, or click the checkbox next to each Entity you want to update. 1. Note that once you select an Entity, three options appear at the top of the Entities list.
Update options diff --git a/docs/cse/records-signals-entities-insights/view-records-signal.md b/docs/cse/records-signals-entities-insights/view-records-signal.md index 9565c6cc63..20f99d0d2f 100644 --- a/docs/cse/records-signals-entities-insights/view-records-signal.md +++ b/docs/cse/records-signals-entities-insights/view-records-signal.md @@ -10,7 +10,7 @@ Cloud SIEM uses rules to evaluate incoming records, and when the conditions of   ## View record details -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To view signals, click **Signals** at the top of the screen.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To view Signals, in the main Sumo Logic menu select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view signals, click **Signals** at the top of the screen.
[**New UI**](/docs/get-started/sumo-logic-ui). To view Signals, in the main Sumo Logic menu select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**. 1. Select a signal. The signal's details display.
When you view the details page for a signal that was triggered by a threshold, aggregation, or chain rule, you’ll see a section that displays records that matched the rules conditions. These records will continue to be associated with the signal as long as the signal is available. 1. Click the plus sign (+) for a record to view its details. 1. Use the following to work with the records: diff --git a/docs/cse/rules/about-cse-rules.md b/docs/cse/rules/about-cse-rules.md index 742ccf43d0..7090dda5a9 100644 --- a/docs/cse/rules/about-cse-rules.md +++ b/docs/cse/rules/about-cse-rules.md @@ -9,9 +9,9 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; A Cloud SIEM rule is logic that fires based on information in incoming Records. When a rule fires, it creates a Signal. -[**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). To view Rules, in the top menu select **Content > Rules**. +[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To view Rules, in the top menu select **Content > Rules**. -[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). To view Rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +[**New UI**](/docs/get-started/sumo-logic-ui). To view Rules, in the main Sumo Logic menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. :::tip For a complete list of out-of-the-box rules, see [Rules](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/README.md) in the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md). diff --git a/docs/cse/rules/before-writing-custom-rule.md b/docs/cse/rules/before-writing-custom-rule.md index ac72fe56fa..7fea7c9327 100644 --- a/docs/cse/rules/before-writing-custom-rule.md +++ b/docs/cse/rules/before-writing-custom-rule.md @@ -40,7 +40,7 @@ Let’s say you’re going to write a rule that fires every time a successful Wi To find and review a log mapping: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu click **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu click **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. You can use the filter area at the top of the **Log Mappings** tab to search for a mapping by various options. The screenshot below shows the results when we enter the filter `Name matches wildcard pattern *4624`. A mapping matches. For the mapping, you can see how many times it’s been used in the last 24 hrs and also over the last 7 days. Select the mapping.
Selected mapping 1. Once you’ve opened the mapping, you’ll see the top of the page shows the Vendor, Product, and Event ID that is written to the Records produced by the mapping.
Mapping dialog 1. The **Fields** section of the page shows how raw message fields are mapped to Cloud SIEM schema attributes. In this mapping, `EventData.LogonProcessName` is mapped to `application`, `EventData.WorkstationName` is mapped to `device_hostname`, and so on. 
Fields on the mapping diff --git a/docs/cse/rules/import-yara-rules.md b/docs/cse/rules/import-yara-rules.md index 5f287d4ec4..689742f895 100644 --- a/docs/cse/rules/import-yara-rules.md +++ b/docs/cse/rules/import-yara-rules.md @@ -17,7 +17,7 @@ YARA rules are an open source framework for identifying malware. Cloud SIEM runs To import YARA rules: -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > File Analysis**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > File Analysis**. You can also click the **Go To...** menu at the top of the screen and select **File Analysis**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > File Analysis**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > File Analysis**. You can also click the **Go To...** menu at the top of the screen and select **File Analysis**. 1. Click **Add Source**. 1. On the **Add New Source** popup, click **Create** in the GitHub tile.
Create button 1. The **Add New Source** popup updates.
Add New Source dialog diff --git a/docs/cse/rules/rule-tuning-expressions.md b/docs/cse/rules/rule-tuning-expressions.md index e3d76bf911..a85bbd80b1 100644 --- a/docs/cse/rules/rule-tuning-expressions.md +++ b/docs/cse/rules/rule-tuning-expressions.md @@ -58,7 +58,7 @@ import Iframe from 'react-iframe';  ## Create a tuning expression -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rule Tuning**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rule Tuning**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rule Tuning**. You can also click the **Go To...** menu at the top of the screen and select **Rule Tuning**. 1. On the **Rule Tuning** page, click **Create**. 1. The **New Rule Tuning Expression** page appears.
Annotated expression diff --git a/docs/cse/rules/write-aggregation-rule.md b/docs/cse/rules/write-aggregation-rule.md index a4f61a5817..50d310ec74 100644 --- a/docs/cse/rules/write-aggregation-rule.md +++ b/docs/cse/rules/write-aggregation-rule.md @@ -55,7 +55,7 @@ import Iframe from 'react-iframe';  ## Create an Aggregation rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the **Aggregation** card. 1. In the rules editor: 1. **Name**. At the top of the Rules Editor, enter a name for the rule. Signals fired by the rule will have the same name as the rule. diff --git a/docs/cse/rules/write-chain-rule.md b/docs/cse/rules/write-chain-rule.md index e9d187f98b..8c03ddf419 100644 --- a/docs/cse/rules/write-chain-rule.md +++ b/docs/cse/rules/write-chain-rule.md @@ -35,7 +35,7 @@ import Iframe from 'react-iframe';  ## Create a Chain rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the Chain card.  1. In the rules editor: 1. **Name.** Enter a name for the rule. Signals fired by the rule will have this name. diff --git a/docs/cse/rules/write-first-seen-rule.md b/docs/cse/rules/write-first-seen-rule.md index 4ccc7ffa2d..63ae742bc2 100644 --- a/docs/cse/rules/write-first-seen-rule.md +++ b/docs/cse/rules/write-first-seen-rule.md @@ -59,7 +59,7 @@ The screenshot below shows a First Seen rule in the Cloud SIEM rules editor. For ## Create a First Seen rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the **First Seen** card. 1. In the rules editor: 1. **Name**. Enter a name for the rule. diff --git a/docs/cse/rules/write-match-rule.md b/docs/cse/rules/write-match-rule.md index 0c3fb86b0f..95c083b1e0 100644 --- a/docs/cse/rules/write-match-rule.md +++ b/docs/cse/rules/write-match-rule.md @@ -45,7 +45,7 @@ import Iframe from 'react-iframe';  ## Create a Match rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic, menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic, menu select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the **Match** card. 1. In the rules editor: 1. **Name**. Enter a name for the rule. diff --git a/docs/cse/rules/write-outlier-rule.md b/docs/cse/rules/write-outlier-rule.md index 532e5bbe2a..eed1705894 100644 --- a/docs/cse/rules/write-outlier-rule.md +++ b/docs/cse/rules/write-outlier-rule.md @@ -68,7 +68,7 @@ The screenshot below shows an Outlier rule in the Cloud SIEM rules editor. For a ## Create an Outlier rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the **Outlier** card. 1. In the rules editor: 1. **Name**. Enter a name for the rule. diff --git a/docs/cse/rules/write-threshold-rule.md b/docs/cse/rules/write-threshold-rule.md index e0cb1dead7..f28a948041 100644 --- a/docs/cse/rules/write-threshold-rule.md +++ b/docs/cse/rules/write-threshold-rule.md @@ -33,7 +33,7 @@ import Iframe from 'react-iframe';  ## Create a Threshold rule -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Content > Rules**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Rules**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. 1. On the **Create a Rule** page, click **Create** in the **Threshold** card.  1. In the rules editor: 1. **Name**. Enter a name for the rule. diff --git a/docs/cse/schema/create-structured-log-mapping.md b/docs/cse/schema/create-structured-log-mapping.md index 597f8af11b..be281d1da1 100644 --- a/docs/cse/schema/create-structured-log-mapping.md +++ b/docs/cse/schema/create-structured-log-mapping.md @@ -21,7 +21,7 @@ When you set up a log mapping, you supply the following information:   ## Step 1: Choose mapping type and name the mapping -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. 1. Click **+ Add Log Mapping** in the upper right side of the **Log Mappings** tab.
Log mappings page 1. Click the **Structured Mapping** tile on the **Create a Mapping** page. 
Structured mapping 1. On the **New Mapping** page, enter a name for the mapping.
New mapping page diff --git a/docs/cse/schema/username-and-hostname-normalization.md b/docs/cse/schema/username-and-hostname-normalization.md index a1b0872658..99d9dba999 100644 --- a/docs/cse/schema/username-and-hostname-normalization.md +++ b/docs/cse/schema/username-and-hostname-normalization.md @@ -54,7 +54,7 @@ If no name normalization configuration exists, the name attribute will consist o ## Configure entity normalization -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Normalization**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Normalization**. You can also click the **Go To...** menu at the top of the screen and select **Normalization**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Entities** select **Normalization**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Normalization**. You can also click the **Go To...** menu at the top of the screen and select **Normalization**. 1. Select the **Domain** tab. (For information about the **Lookup Tables** tab, see [Configure an Entity Lookup Table](/docs/cse/records-signals-entities-insights/configure-entity-lookup-table/)). 1. You can configure just **Username Normalization**, just **Hostname Normalization**, or both. We recommend you enable both.  1. Under **Normalization Formats** there are configuration options to normalize names from: diff --git a/docs/cse/sensors/ingest-zeek-logs.md b/docs/cse/sensors/ingest-zeek-logs.md index 34bbcaea90..e195cf0148 100644 --- a/docs/cse/sensors/ingest-zeek-logs.md +++ b/docs/cse/sensors/ingest-zeek-logs.md @@ -43,7 +43,7 @@ With this method, you use Corelight’s [json-streaming-logs](https://github.com After installing the `json-streaming-logs` package, follow these instructions to set up the Sumo Logic mapping. -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. 1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**.
Ingest mappings 1. On the **Add Ingest Mapping** tab: 1. **Source Category**. Enter the Source Category value you assigned to the Source you configured above in [Configure a Sumo Logic Source](#configure-a-sumo-logic-source). diff --git a/docs/platform-services/automation-service/about-automation-service.md b/docs/platform-services/automation-service/about-automation-service.md index 7adc414f58..b7c69c8a2e 100644 --- a/docs/platform-services/automation-service/about-automation-service.md +++ b/docs/platform-services/automation-service/about-automation-service.md @@ -57,7 +57,7 @@ Before you can access the Automation Service, you must first [configure role cap ### From Cloud SIEM -1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the Cloud SIEM top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**.
The list of available automations appears. Each automation runs a playbook.
Automations list +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the Cloud SIEM top menu select **Configuration**, and then under **Integrations** select **Automation**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Automation**. You can also click the **Go To...** menu at the top of the screen and select **Automation**.
The list of available automations appears. Each automation runs a playbook.
Automations list 1. At the top of the screen, click **Manage Playbooks**.
Manage Playbooks menu option 1. The Automation Service screen opens on the **Playbook** tab.
Playbook screen