From 33101783bf05f6ce5bf3c4076e6fc89a0f976b43 Mon Sep 17 00:00:00 2001 From: sumoanema Date: Thu, 9 Jan 2025 22:33:56 +0530 Subject: [PATCH 01/21] Doc for postgresql ST with some correction in doc for postgresql app --- .../opentelemetry/postgresql-opentelemetry.md | 4 +- .../source-templates/postgresql.md | 105 ++++++++++++++++++ 2 files changed, 107 insertions(+), 2 deletions(-) create mode 100644 docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md diff --git a/docs/integrations/databases/opentelemetry/postgresql-opentelemetry.md b/docs/integrations/databases/opentelemetry/postgresql-opentelemetry.md index 03f94f2d3d..df506bf35a 100644 --- a/docs/integrations/databases/opentelemetry/postgresql-opentelemetry.md +++ b/docs/integrations/databases/opentelemetry/postgresql-opentelemetry.md @@ -19,7 +19,7 @@ This app supports PostgreSQL version 9.6+. We use the OpenTelemetry collector for PostgreSQL metric collection and for collecting PostgreSQL logs. -The diagram below illustrates the components of the PostgreSQL collection for each database server. OpenTelemetry collector runs on the same host as PostgreSQL, and uses the [PostgreSQL receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/postgresqlreceiver) to obtain PostgreSQL metrics, and the [Sumo Logic OpenTelemetry Exporter](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/sumologicexporter) to send the metrics to Sumo Logic. MySQL logs are sent to Sumo Logic through a [filelog receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/filelogreceiver). +The diagram below illustrates the components of the PostgreSQL collection for each database server. OpenTelemetry collector runs on the same host as PostgreSQL, and uses the [PostgreSQL receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/postgresqlreceiver) to obtain PostgreSQL metrics, and the [Sumo Logic OpenTelemetry Exporter](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/sumologicexporter) to send the metrics to Sumo Logic. PostgreSQL logs are sent to Sumo Logic through a [filelog receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/filelogreceiver). Schematics @@ -107,7 +107,7 @@ import SetupColl from '../../../reuse/apps/opentelemetry/set-up-collector.md'; ### Step 2: Configure integration -In this step, you will configure the yaml file required for Mysql collection. +In this step, you will configure the yaml file required for PostgreSQL collection. Below is the required input: diff --git a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md new file mode 100644 index 0000000000..54655344c6 --- /dev/null +++ b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md @@ -0,0 +1,105 @@ +--- +id: postgresql +title: PostgreSQL Source Template +sidebar_label: PostgreSQL +description: Learn about the Sumo Logic PostgreSQL source template for OpenTelemetry. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + + + + + +

Beta

+ +Thumbnail icon Thumbnail icon + +The PostgreSQL source template creates an OpenTelemetry configuration that can be pushed to a remotely managed OpenTelemetry collector (abbreviated as otelcol). By creating this source template and pushing the config to the appropriate OpenTelemetry agent, you can ensure collection of PostgreSQL logs and metrics to Sumo Logic. + +## Fields creation in Sumo Logic for PostgreSQL + +If not already present, the following [Fields](/docs/manage/fields/) are created as part of source template creation. + +- **`sumo.datasource`**. Fixed value of **postgresql**. +- **`deployment.environment`**. This is a user-configured field set at the time of collector installation. It identifies the environment where the host resides, such as `dev`, `prod`, or `qa`. +- **`db.cluster.name`**. User configured. Enter a uniquely identifiable name for your PostgreSQL cluster to show in the Sumo Logic dashboards. +- **`db.node.name`**. Includes the value of the hostname of the machine which is being monitored. + +## Prerequisites + +### For metrics collection + +The PostgreSQL metrics [receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/postgresqlreceiver) collects metrics by querying the PostgreSQL [statistics collector](https://www.postgresql.org/docs/13/monitoring-stats.html). + +The monitoring user which is used in the source template must be granted permission to SELECT permission for [pg_stat_database](https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-DATABASE-VIEW). + +### For logs collection + +Configure logging in PostgreSQL: + +1. Locate your local PostgreSQL postgresql.conf configuration file in the database data_directory. For more information, see the [PostgreSQL File Locations documentation](https://www.postgresql.org/docs/9.1/static/runtime-config-file-locations.html). By default it's located in `/var/lib/pgsql//data/postgresql.conf`. You can run SHOW config_file command inside your server's psql shell to get the location. After determining the location of conf file, modify the PostgreSQL postgresql.conf configuration file logging parameters +2. Connect to the database server (using SSH) in a terminal window. +3. Open `postgresql.conf` configuration file. +4. Under the ERROR REPORTING AND LOGGING section of the file, use the following config parameters. For more information on the following parameters, [click here](https://www.postgresql.org/docs/12/static/runtime-config-logging.html). + ```sql + log_destination = 'stderr' + logging_collector = on + log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log' + log_truncate_on_rotation = off + log_rotation_age = 1d + log_min_duration_statement = 250 + log_connections = on + log_duration = on + log_hostname = on + log_timezone = 'UTC' + log_min_messages = 'WARNING' + log_line_prefix = '%m [%p] %q%u@%d ' + ``` +5. Save the `postgresql.conf` file and restart the postgresql server: + ```sh + sudo service postgresql restart + ``` +Ensure that the otelcol has adequate permissions to access all log file paths. Execute the following command: + +```bash +sudo setfacl -R -m d:u:otelcol-sumo:r-x,u:otelcol-sumo:r-x,g:otelcol-sumo:r-x +``` + +import LogsCollectionPrereqisites from '../../../../reuse/apps/logs-collection-prereqisites.md'; + +## Source template configuration + +You can follow the below steps to set a remotely managed OpenTelemetry collector and push the source template to it. + +### Step 1: Set up remotely managed OpenTelemetry collector + +import CollectorInstallation from '../../../../reuse/apps/opentelemetry/collector-installation.md'; + + + +### Step 2: Configure the source template + +In this step, you will configure the yaml required for PostgreSQL collection. Below are the inputs required for configuration: + +- **Name**. Name of the source template. +- **Description**. Description for the source template. +- **Error Log Path**. Enter the path of the error log file for your PostgreSQL instance. +- **Endpoint**. Enter the url of the server which needs to be monitored. Default endpoint is `localhost:5432`. +- **UserName**. Enter the PostgreSQL username. +- **Password Environment Variable Name**. Enter the PostgreSQL password environment variable name. +- **Fields/Metadata**. You can provide any customer fields to be tagged with the data collected. By default, Sumo Logic tags `_sourceCategory` with the value otel/postgresql user needs to provide the value for `db.cluster.name`. + +import OtelLogAdvanceOption from '../../../../reuse/apps/opentelemetry/logs-advance-option-otel.md'; + + + +**Processing Rules**. You can add **processing rules** for logs/metrics collected. To learn more, refer to [Processing Rules](../processing-rules/index.md). + +### Step 3: Push the source template to the desired remotely managed collectors + +import DataConfiguration from '../../../../reuse/apps/opentelemetry/data-configuration.md'; + + \ No newline at end of file From be109b3422fea86556296ef3524c5ba6283c92f7 Mon Sep 17 00:00:00 2001 From: sumoanema Date: Thu, 9 Jan 2025 22:39:40 +0530 Subject: [PATCH 02/21] Rearranging folder structure and adding a note for metric collection support in different version of otel agent and postgresql --- .../source-templates/{ => postgresql}/postgresql.md | 4 ++++ 1 file changed, 4 insertions(+) rename docs/send-data/opentelemetry-collector/remote-management/source-templates/{ => postgresql}/postgresql.md (95%) diff --git a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md similarity index 95% rename from docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md rename to docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md index 54655344c6..e5caf107fc 100644 --- a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql.md +++ b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md @@ -36,6 +36,10 @@ The PostgreSQL metrics [receiver](https://github.com/open-telemetry/opentelemetr The monitoring user which is used in the source template must be granted permission to SELECT permission for [pg_stat_database](https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-DATABASE-VIEW). +:::note +For SumoLogic OpenTelemetry collector version below 0.116 metric collection will work only for PostgreSQL version 16 and below. With Sumo Logic OpenTelemetry collector version 0.116 and above metric collection will work for Postgresql version 17 as well. +::: + ### For logs collection Configure logging in PostgreSQL: From 8de16f81410fa430110e6290ac1acf32f2bbc18d Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Thu, 9 Jan 2025 12:22:42 -0800 Subject: [PATCH 03/21] Correct file names, links, sidebars --- .../source-templates/postgresql/changelog.md | 9 ++++++++ .../postgresql/{postgresql.md => index.md} | 22 +++++++++---------- sidebars.ts | 10 +++++++++ 3 files changed, 30 insertions(+), 11 deletions(-) create mode 100644 docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog.md rename docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/{postgresql.md => index.md} (88%) diff --git a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog.md b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog.md new file mode 100644 index 0000000000..70a05787f0 --- /dev/null +++ b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog.md @@ -0,0 +1,9 @@ +--- +id: changelog +title: Changelog +description: Changelog for PostgreSQL source template for OpenTelemetry. +--- + + + + diff --git a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index.md similarity index 88% rename from docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md rename to docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index.md index e5caf107fc..577f226526 100644 --- a/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/postgresql.md +++ b/docs/send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index.md @@ -1,5 +1,5 @@ --- -id: postgresql +slug: /send-data/opentelemetry-collector/remote-management/source-templates/postgresql title: PostgreSQL Source Template sidebar_label: PostgreSQL description: Learn about the Sumo Logic PostgreSQL source template for OpenTelemetry. @@ -9,7 +9,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; - + @@ -32,12 +32,12 @@ If not already present, the following [Fields](/docs/manage/fields/) are created ### For metrics collection -The PostgreSQL metrics [receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/postgresqlreceiver) collects metrics by querying the PostgreSQL [statistics collector](https://www.postgresql.org/docs/13/monitoring-stats.html). +The PostgreSQL metrics [receiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/postgresqlreceiver) collects metrics by querying the PostgreSQL [statistics collector](https://www.postgresql.org/docs/13/monitoring-stats.html). The monitoring user which is used in the source template must be granted permission to SELECT permission for [pg_stat_database](https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-DATABASE-VIEW). :::note -For SumoLogic OpenTelemetry collector version below 0.116 metric collection will work only for PostgreSQL version 16 and below. With Sumo Logic OpenTelemetry collector version 0.116 and above metric collection will work for Postgresql version 17 as well. +For SumoLogic OpenTelemetry collector version below 0.116 metric collection will work only for PostgreSQL version 16 and below. With Sumo Logic OpenTelemetry collector version 0.116 and above metric collection will work for PostgreSQL version 17 as well. ::: ### For logs collection @@ -72,7 +72,7 @@ Ensure that the otelcol has adequate permissions to access all log file paths. E sudo setfacl -R -m d:u:otelcol-sumo:r-x,u:otelcol-sumo:r-x,g:otelcol-sumo:r-x ``` -import LogsCollectionPrereqisites from '../../../../reuse/apps/logs-collection-prereqisites.md'; +import LogsCollectionPrereqisites from '../../../../../reuse/apps/logs-collection-prereqisites.md'; ## Source template configuration @@ -80,7 +80,7 @@ You can follow the below steps to set a remotely managed OpenTelemetry collector ### Step 1: Set up remotely managed OpenTelemetry collector -import CollectorInstallation from '../../../../reuse/apps/opentelemetry/collector-installation.md'; +import CollectorInstallation from '../../../../../reuse/apps/opentelemetry/collector-installation.md'; @@ -89,21 +89,21 @@ import CollectorInstallation from '../../../../reuse/apps/opentelemetry/collecto In this step, you will configure the yaml required for PostgreSQL collection. Below are the inputs required for configuration: - **Name**. Name of the source template. -- **Description**. Description for the source template. +- **Description**. Description for the source template. - **Error Log Path**. Enter the path of the error log file for your PostgreSQL instance. - **Endpoint**. Enter the url of the server which needs to be monitored. Default endpoint is `localhost:5432`. - **UserName**. Enter the PostgreSQL username. - **Password Environment Variable Name**. Enter the PostgreSQL password environment variable name. - **Fields/Metadata**. You can provide any customer fields to be tagged with the data collected. By default, Sumo Logic tags `_sourceCategory` with the value otel/postgresql user needs to provide the value for `db.cluster.name`. -import OtelLogAdvanceOption from '../../../../reuse/apps/opentelemetry/logs-advance-option-otel.md'; +import OtelLogAdvanceOption from '../../../../../reuse/apps/opentelemetry/logs-advance-option-otel.md'; -**Processing Rules**. You can add **processing rules** for logs/metrics collected. To learn more, refer to [Processing Rules](../processing-rules/index.md). +**Processing Rules**. You can add **processing rules** for logs/metrics collected. To learn more, refer to [Processing Rules](../../processing-rules/index.md). ### Step 3: Push the source template to the desired remotely managed collectors -import DataConfiguration from '../../../../reuse/apps/opentelemetry/data-configuration.md'; +import DataConfiguration from '../../../../../reuse/apps/opentelemetry/data-configuration.md'; - \ No newline at end of file + diff --git a/sidebars.ts b/sidebars.ts index 0bd9418bff..2910c60de4 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -203,6 +203,16 @@ module.exports = { 'send-data/opentelemetry-collector/remote-management/source-templates/nginx/changelog', ] }, + { + type: 'category', + label: 'PostgreSQL', + collapsible: true, + collapsed: true, + link: {type: 'doc', id: 'send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index'}, + items:[ + //'send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog', + ] + }, { type: 'category', label: 'RabbitMQ', From b2ec7f4facb18363effe0f6283a4cf3c6d3fdc03 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Thu, 9 Jan 2025 12:36:14 -0800 Subject: [PATCH 04/21] Uncomment postgresql source template docs --- sidebars.ts | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/sidebars.ts b/sidebars.ts index 2910c60de4..e43d7880e4 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -203,16 +203,16 @@ module.exports = { 'send-data/opentelemetry-collector/remote-management/source-templates/nginx/changelog', ] }, - { - type: 'category', - label: 'PostgreSQL', - collapsible: true, - collapsed: true, - link: {type: 'doc', id: 'send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index'}, - items:[ + //{ + //type: 'category', + //label: 'PostgreSQL', + //collapsible: true, + //collapsed: true, + //link: {type: 'doc', id: 'send-data/opentelemetry-collector/remote-management/source-templates/postgresql/index'}, + //items:[ //'send-data/opentelemetry-collector/remote-management/source-templates/postgresql/changelog', - ] - }, + //] + //}, { type: 'category', label: 'RabbitMQ', From 2b2fad330bb5814034b2aca10910f57ac7535d97 Mon Sep 17 00:00:00 2001 From: sumoanema Date: Wed, 22 Jan 2025 23:25:43 +0530 Subject: [PATCH 05/21] ST with secrets - postgresql updated. Mysql and elasticsearch doc added --- .clabot | 3 +- blog-cse/2024/12-31.md | 4 +- blog-csoar/2024/12-31.md | 6 +- blog-service/2023/12-31.md | 2 +- cid-redirects.json | 16 ++- .../generate-cse-signals.md | 73 ++++++------ docs/api/access-keys.md | 4 +- docs/api/account-management.md | 5 +- docs/api/app-management.md | 4 +- docs/api/archive-ingestion.md | 4 +- docs/api/cloud-siem-enterprise.md | 4 +- docs/api/cloud-soar.md | 4 +- docs/api/collector-management/index.md | 3 +- docs/api/connections-management.md | 3 +- docs/api/content-management.md | 3 +- docs/api/content-permissions.md | 3 +- docs/api/dashboard.md | 3 +- docs/api/dynamic-parsing.md | 4 +- docs/api/field-extraction-rules.md | 4 +- docs/api/field-management.md | 4 +- docs/api/folder-management.md | 3 +- docs/api/health-events.md | 4 +- docs/api/ingest-budget-v2.md | 4 +- docs/api/log-search-estimated-usage.md | 4 +- docs/api/log-searches.md | 4 +- docs/api/logs-data-forwarding.md | 4 +- docs/api/lookup-tables.md | 4 +- docs/api/metrics-query.md | 4 +- docs/api/metrics-searches-v2.md | 3 +- docs/api/metrics-searches.md | 4 +- docs/api/metrics-transformation-rules.md | 3 +- docs/api/monitors-management.md | 4 +- docs/api/muting-schedules.md | 4 +- docs/api/organizations-management.md | 3 +- docs/api/partition-management.md | 4 +- docs/api/password-policy.md | 3 +- docs/api/policies-management.md | 4 +- docs/api/role-management-v2.md | 3 +- docs/api/role-management.md | 4 +- docs/api/saml-configuration.md | 3 +- docs/api/scan-budget.md | 8 ++ docs/api/scheduled-views.md | 4 +- docs/api/search-job.md | 29 +++-- docs/api/service-allowlist.md | 3 +- docs/api/service-map.md | 4 +- docs/api/slo-management.md | 4 +- docs/api/span-analytics.md | 4 +- docs/api/token-management.md | 4 +- docs/api/tracing.md | 4 +- docs/api/user-management.md | 6 +- .../integrations/insight-enrichment-server.md | 2 +- .../security-incident-response-integration.md | 2 +- docs/cse/schema/index.md | 6 - docs/cse/schema/parser-editor.md | 4 +- .../cse/schema/parser-troubleshooting-tips.md | 28 ----- .../account-settings-preferences.md | 4 - docs/get-started/index.md | 2 +- docs/get-started/sumo-logic-ui-classic.md | 1 - docs/get-started/sumo-logic-ui.md | 1 - .../cis-aws-foundations-benchmark.md | 4 +- .../global-intelligence-guardduty.md | 2 +- .../amazon-aws/guardduty-benchmark.md | 2 +- .../app-development/jfrog-xray.md | 2 +- .../jfrog-artifactory-opentelemetry.md | 14 +-- .../opentelemetry/jira-opentelemetry.md | 18 +++ .../opentelemetry/jmx-opentelemetry.md | 2 +- .../opentelemetry/puppet-opentelemetry.md | 15 +++ .../opentelemetry/linux-opentelemetry.md | 16 +++ .../opentelemetry/windows-opentelemetry.md | 15 +++ .../containers-orchestration/activemq.md | 6 +- .../docker-community-edition.md | 4 +- .../containers-orchestration/kafka.md | 6 +- .../containers-orchestration/kubernetes.md | 2 +- .../containers-orchestration/rabbitmq.md | 2 +- docs/integrations/databases/cassandra.md | 2 +- docs/integrations/databases/couchbase.md | 4 +- docs/integrations/databases/elasticsearch.md | 2 +- docs/integrations/databases/mariadb.md | 2 +- docs/integrations/databases/memcached.md | 2 +- docs/integrations/databases/mongodb.md | 2 +- docs/integrations/databases/mysql.md | 2 +- .../opentelemetry/couchbase-opentelemetry.md | 2 +- docs/integrations/databases/oracle.md | 2 +- docs/integrations/databases/postgresql.md | 2 +- docs/integrations/databases/redis.md | 4 +- .../host-process-metrics.md | 2 +- .../microsoft-graph-identity-protection.md | 27 ++++- .../microsoft-azure/sql-server.md | 2 +- .../opentelemetry/linux-opentelemetry.md | 14 +++ .../windows-json-opentelemetry.md | 16 +++ .../product-list/product-list-a-l.md | 2 +- .../product-list/product-list-m-z.md | 2 +- docs/integrations/saas-cloud/armis.md | 28 ++++- docs/integrations/saas-cloud/asana.md | 28 ++++- .../integrations/saas-cloud/cisco-umbrella.md | 15 ++- .../saas-cloud/digital-guardian-arc.md | 28 ++++- docs/integrations/saas-cloud/docusign.md | 28 ++++- docs/integrations/saas-cloud/dropbox.md | 28 ++++- .../saas-cloud/druva-cyber-resilience.md | 28 ++++- docs/integrations/saas-cloud/druva.md | 34 ++++-- .../saas-cloud/gmail-tracelogs.md | 27 ++++- docs/integrations/saas-cloud/index.md | 13 +- .../microsoft-exchange-trace-logs.md | 27 ++++- docs/integrations/saas-cloud/miro.md | 28 ++++- docs/integrations/saas-cloud/zendesk.md | 29 ++++- .../security-threat-detection/sailpoint.md | 28 ++++- .../integrations/web-servers/apache-tomcat.md | 6 +- docs/integrations/web-servers/apache.md | 2 +- docs/integrations/web-servers/haproxy.md | 2 +- docs/integrations/web-servers/iis-10.md | 2 +- .../integrations/web-servers/nginx-ingress.md | 2 +- .../web-servers/nginx-plus-ingress.md | 2 +- docs/integrations/web-servers/nginx-plus.md | 2 +- docs/integrations/web-servers/nginx.md | 2 +- docs/integrations/web-servers/squid-proxy.md | 6 +- docs/integrations/web-servers/varnish.md | 2 +- docs/manage/content-sharing/index.md | 6 +- .../data-volume-index/index.md | 12 +- docs/manage/manage-subscription/index.md | 6 + docs/manage/partitions/index.md | 2 +- docs/manage/security/access-keys.md | 111 +++++++----------- .../users-roles/roles/role-capabilities.md | 2 +- docs/observability/application-components.md | 2 +- .../automatic-installation-script.md | 4 +- .../deploy-with-aws-cloudformation/index.md | 2 +- ...fields-to-existing-host-metrics-sources.md | 2 +- .../app-central/integrations/darktrace.md | 5 +- .../app-central/integrations/dynatrace.md | 2 +- .../app-central/integrations/servicenow-v2.md | 31 ++--- .../integrations/sumo-logic-cloud-siem.md | 10 +- .../integrations/sumo-logic-log-analytics.md | 13 +- .../sumo-logic-notifications-by-gmail.md | 8 +- .../integrations/sumo-logic-notifications.md | 13 +- .../automation-service-bridge.md | 4 +- .../automation-service-playbooks.md | 6 +- .../threat-intelligence-indicators.md | 8 +- docs/reuse/ui-elements.md | 4 +- .../build-search/dynamic-parsing.md | 6 +- .../search-operators/sort.md | 11 +- .../ms-azure-event-hubs-source.md | 3 - .../amazon-aws/aws-s3-source.md | 8 +- .../azure-event-hubs-source.md | 3 +- .../tenable-source.md | 8 +- .../sumoconf-for-legacy-collectors.md | 6 +- .../remote-management/index.md | 40 +++---- .../processing-rules/index.md | 10 +- .../source-templates/postgresql/index.md | 17 ++- sidebars.ts | 16 ++- static/img/alerts/confirm-create.png | Bin 19394 -> 36551 bytes static/img/alerts/full-details.png | Bin 170152 -> 217975 bytes static/img/alerts/new-related-insight.png | Bin 117413 -> 135872 bytes static/img/alerts/ss-signal.png | Bin 448420 -> 424770 bytes static/img/get-started/acct-pref.png | Bin 29809 -> 38240 bytes .../security/access-key-preferences-page.png | Bin 98025 -> 119097 bytes .../img/security/access-keys-deactivation.png | Bin 98913 -> 40193 bytes static/img/security/create-access-key.png | Bin 78379 -> 162473 bytes static/img/security/generated-access-key.png | Bin 40777 -> 117483 bytes static/img/security/my-access-keys1.png | Bin 62046 -> 144165 bytes 158 files changed, 802 insertions(+), 526 deletions(-) delete mode 100644 docs/cse/schema/parser-troubleshooting-tips.md diff --git a/.clabot b/.clabot index bb2107475b..09c57f12d1 100644 --- a/.clabot +++ b/.clabot @@ -172,7 +172,8 @@ "chetanchoudhary-sumo", "JamoCA", "darshan-sumo", - "mahendrak-sumo" + "mahendrak-sumo", + "chvik" ], "message": "Thank you for your contribution! As this is an open source project, we require contributors to sign our Contributor License Agreement and do not have yours on file. To proceed with your PR, please [sign your name here](https://forms.gle/YgLddrckeJaCdZYA6) and we will add you to our approved list of contributors.", "label": "cla-signed", diff --git a/blog-cse/2024/12-31.md b/blog-cse/2024/12-31.md index abfcabdab0..809a2161a6 100644 --- a/blog-cse/2024/12-31.md +++ b/blog-cse/2024/12-31.md @@ -16,6 +16,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This is an archive of 2024 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). + + --- ### December 20, 2024 - Content Release @@ -852,7 +854,7 @@ Other changes are enumerated below. This release reverts a change to our AWS CloudTrail default (catch all) mapper for how `user_username` is mapped. This is being reverted due to reports of breaking rule tuning and missing user context for some `AssumedRole` events. -AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](/release-notes-cse/#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives. +AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives. AWS best practices suggest defining `sourceIdentity` to allow for the originating user for a role assumption to be identifiable. This is the best path to avoid false positive generation, as our mapper will favor `sourceIdentity` if it is present in CloudTrail logs. If it is not present, then `userIdentity.arn` will be used and the `resource-id` will be mapped to `user_username`, creating potential for false positives from dynamic session identifiers. See [Viewing source identity in CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-ct) in the AWS documentation for more information. diff --git a/blog-csoar/2024/12-31.md b/blog-csoar/2024/12-31.md index 9f04962f67..03d374225a 100644 --- a/blog-csoar/2024/12-31.md +++ b/blog-csoar/2024/12-31.md @@ -14,6 +14,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This is an archive of 2024 Cloud SOAR release notes. To view the full archive, [click here](/release-notes-csoar/archive). + + --- ### December 31, 2024 - Application Update @@ -312,7 +314,7 @@ This release introduces three new integrations, as well as several updates. --- ### March 12, 2024 - Content Release -Our Cloud SOAR [application update](/release-notes-csoar/#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards. +Our Cloud SOAR [application update](#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards. The Python upgrade impacts a total of 38 integrations. These integrations will require updates to ensure compatibility with the new Python version. @@ -369,7 +371,7 @@ We strongly encourage all users to review the provided documentation and prepare ### March 12, 2024 - Application Update #### Changes and Enhancements -* Python version updated. If you experience any issues, refer to our [content release note](/release-notes-csoar/#march-12-2024---content-release). +* Python version updated. If you experience any issues, refer to our [content release note](#march-12-2024---content-release). ##### Cloud SOAR * Playbooks: Test feature now permits you to use internal Incident ID. diff --git a/blog-service/2023/12-31.md b/blog-service/2023/12-31.md index 056ad3d3e3..7d919fc02f 100644 --- a/blog-service/2023/12-31.md +++ b/blog-service/2023/12-31.md @@ -758,7 +758,7 @@ We're excited to announce the release of our new cloud-to-cloud source for Trell We’re happy to announce a new security option allowing administrators to set a custom policy for the number of days an API Access Key can go unused before being automatically deactivated. This setting allows administrators to tailor the feature to suit their organization’s specific security requirements. This enhances the security of your account by reducing the risk of unauthorized access through abandoned access keys. This ensures that only active access keys can be used to access your account and its resources. -[Learn more](/docs/manage/security/access-keys#edit-deactivate-or-delete-an-access-key). +[Learn more](/docs/manage/security/access-keys#access-keys-deactivation-policy). --- diff --git a/cid-redirects.json b/cid-redirects.json index 8c65bf3a27..7c9000ff77 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -79,6 +79,7 @@ "/01Start-Here/02Getting-Started/Glossary": "/docs/contributing/glossary", "/01Start-Here/02Getting-Started": "/docs/get-started", "/Start_Here": "/docs/get-started", + "/Start_Here/About_Sumo_Logic/What_is_the_optimal_log_format_to_use_with_Sumo_Logic": "/docs/get-started/faq", "/Start_Here/About_Sumo_Logic/Status_and_Scheduled_Maintenance": "/docs/get-started/help", "/Start_Here/About_Sumo_Logic/Sumo_Logic_Support_Terms_and_Conditions": "/docs/get-started/support-terms", "/Start_Here/Analyst_or_Administrator": "/docs/get-started/onboarding-checklists", @@ -106,6 +107,7 @@ "/03Send-Data/Collect-from-Other-Data-Sources/01-About-Collectors/01-Collector-Overview": "/docs/send-data/collect-from-other-data-sources", "/03Send-Data/Collect-from-Other-Data-Sources/Amazon_MSK_Prometheus_metrics_collection": "/docs/send-data/collect-from-other-data-sources/amazon-msk-prometheus-metrics-collection", "/03Send-Data/Collect-from-Other-Data-Sources/Amazon-CloudWatch-Logs": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs", + "/Send-Data/Collect-from-Other-Data-Sources": "/docs/send-data/collect-from-other-data-sources", "/Send-Data/Collect-from-Other-Data-Sources/Amazon-CloudWatch-Logs": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs", "/03Send-Data/Collect-from-Other-Data-Sources/Amazon-Web-Services": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs", "/03Send-Data/Collect-from-Other-Data-Sources/Amazon-CloudWatch-Logs/Collect_Amazon_CloudWatch_Logs_using_a_Lambda_Function": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-lambda-function", @@ -1392,6 +1394,7 @@ "/APIs/General_API_Information/Sumo_Logic_Endpoints_and_Firewall_Security": "/docs/api/getting-started", "/Send_Data": "/docs/send-data", "/Send_Data/Collector_Management_API/Sumo_Logic_Endpoints": "/docs/api/collector-management", + "/Send_Data/Collector_Management_API/About_the_Collector_Management_API": "/docs/api/collector-management", "/Send_Data/Collector_FAQs/How_to_Ingest_Old_or_Historical_Data": "/docs/send-data/opentelemetry-collector/faq", "/APIs/General-API-Information/Sumo-Logic-Endpoints-by-Deployment-and-Firewall-Security": "/docs/api/getting-started", "/APIs/General-API-Information/Sumo-Logic-Endpoints-and-Firewall-Security": "/docs/api/getting-started", @@ -1578,6 +1581,7 @@ "/cid/10111": "/docs/integrations/app-development/jfrog-xray", "/cid/10188": "/docs/integrations/saas-cloud/miro", "/cid/10187": "/docs/integrations/saas-cloud/digital-guardian-arc", + "/cid/10114": "/docs/integrations/saas-cloud/jamf", "/cid/10208": "/docs/integrations/saas-cloud/cisco-meraki-c2c", "/cid/10209": "/docs/integrations/security-threat-detection/cisco-meraki", "/cid/10210": "/docs/integrations/saas-cloud/proofpoint-tap", @@ -1595,6 +1599,7 @@ "/cid/10198": "/docs/integrations/saas-cloud/microsoft-graph-azure-ad-reporting", "/cid/10193": "/docs/integrations/saas-cloud/asana", "/cid/10181": "/docs/integrations/saas-cloud/atlassian", + "/cid/10207": "/docs/integrations/saas-cloud/symantec-endpoint-security-service", "/cid/10197": "/docs/integrations/saas-cloud/symantec-web-security-service", "/cid/6016": "/docs/integrations/saas-cloud/trend-micro-vision-one", "/cid/10112": "/docs/integrations/app-development/jfrog-xray", @@ -1767,6 +1772,7 @@ "/cid/10337": "/docs/send-data/opentelemetry-collector/remote-management/source-templates/docker/changelog", "/cid/10338": "/docs/send-data/opentelemetry-collector/remote-management/source-templates/nginx/changelog", "/cid/10339": "/docs/send-data/opentelemetry-collector/remote-management/source-templates/kafka/changelog", + "/cid/10822": "/docs/manage/manage-subscription/create-manage-orgs-flex", "/cid/10817": "/docs/integrations/sumo-apps/cse", "/cid/10818": "/docs/integrations/sumo-apps/cse", "/cid/1082": "/docs/metrics/introduction/get-started-metrics", @@ -1885,6 +1891,7 @@ "/cid/2008": "/docs/send-data/installed-collectors/linux", "/cid/2009": "/docs/search/behavior-insights/logcompare", "/cid/2010": "/docs/search/search-query-language/search-operators/if", + "/cid/2110": "/docs/search/search-query-language/search-operators/macro", "/cid/2011": "/docs/get-started/help", "/cid/2012": "/docs/manage/security/enable-support-account", "/cid/2013": "/docs/send-data/installed-collectors/sources/windows-active-directory-inventory-source", @@ -2895,7 +2902,8 @@ "/Cloud_SIEM_Enterprise/CSE_Schema/Field_Mapping_for_Security_Event_Sources": "/docs/cse/schema/field-mapping-security-event-sources", "/Cloud_SIEM_Enterprise/CSE_Schema/Parser_Editor": "/docs/cse/schema/parser-editor", "/docs/send-data/parse-data/parser-editor": "/docs/cse/schema/parser-editor", - "/Cloud_SIEM_Enterprise/CSE_Schema/Parser_Editor/Parser_Troubleshooting_Tips": "/docs/cse/schema/parser-troubleshooting-tips", + "/Cloud_SIEM_Enterprise/CSE_Schema/Parser_Editor/Parser_Troubleshooting_Tips": "/docs/cse/troubleshoot/troubleshoot-parsers", + "/docs/cse/schema/parser-troubleshooting-tips": "/docs/cse/troubleshoot/troubleshoot-parsers", "/Cloud_SIEM_Enterprise/CSE_Schema/Username_and_Hostname_Normalization": "/docs/cse/schema/username-and-hostname-normalization", "/Cloud_SIEM_Enterprise/CSE_Sensors": "/docs/cse/sensors", "/Cloud_SIEM_Enterprise/CSE_Sensors/01_Sensor_Download_Locations": "/docs/cse/sensors/sensor-download-locations", @@ -2913,6 +2921,7 @@ "/Cloud_SIEM_Enterprise/Ingestion_Guides/Microsoft_Windows": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows", "/Cloud_SIEM_Enterprise/Ingestion_Guides/Fortigate_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall", "/Cloud_SIEM_Enterprise/Ingestion_Guides/Palo_Alto_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall", + "/Cloud_SIEM_Enterprise/Insights/Insight_Generation_Process": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Integrations": "/docs/cse/integrations", "/Cloud_SIEM_Enterprise/Integrations/Configuring_a_ThreatQ_Source_in_CSE": "/docs/cse/integrations/configuring-threatq-source-in-cse", "/Cloud_SIEM_Enterprise/Integrations/Enable_VirusTotal_Enrichment": "/docs/cse/integrations/enable-virustotal-enrichment", @@ -3459,6 +3468,7 @@ "/Other_Solutions/Work_from_Home_Solution": "/docs/observability/work-from-home-vpn", "/Other_Solutions/Work_from_Home_Solution/VPN_Monitoring_Resources_and_Tips": "/docs/observability/work-from-home-vpn", "/Other_Solutions/Software_Development_Optimization_Solution": "/docs/observability/sdo", + "/Release_Archive/Collector_Release_Notes_Archive": "/release-notes-collector", "/Release_Archive/Quick-Start-Tutorial(deprecated)": "/docs/get-started", "/Release_Archive/Quick-Start-Tutorial(deprecated)/01_Sumo_Logic_Quick_Start_Tutorial": "/", "/Release-Notes": "/docs/release-notes", @@ -3818,6 +3828,7 @@ "/Search/Get_Started_with_Search/Search_Basics/Export_Search_Results": "/docs/search/get-started-with-search/search-basics/export-search-results", "/Search/Get_Started_with_Search/How_to_Use_the_Search_Page/Field_Browser": "/docs/search/get-started-with-search/search-page/field-browser", "/Search/Get_Started_with_Search/Search_Basics/Search_Metadata": "/docs/search/get-started-with-search/search-basics", + "/Search/Library/Apps-in-Sumo-Logic/01-Sumo-Logic-Apps/Audit-App": "/docs/integrations/sumo-apps/audit", "/Search/Library/Apps-in-Sumo-Logic/01-Sumo-Logic-Apps/Data-Volume-App": "/docs/integrations/sumo-apps/data-volume", "/Search/Library/Apps-in-Sumo-Logic/01-Sumo-Logic-Apps/Data-Volume-App/Data-Volume-App-Dashboards": "/docs/integrations/sumo-apps/data-volume", "/Search/LogCompare": "/docs/search/behavior-insights/logcompare", @@ -3977,6 +3988,7 @@ "/Send-Data/Sources/03Use-Case-Library/Amazon-Web-Services/AWS-EC2-Instance-Log-Collection": "/docs/send-data/installed-collectors/sources/host-metrics-source", "/Send-Data/Sources/03Use_Case_Examples/Kubernetes_Collection_DaemonSet": "/docs/send-data/collect-from-other-data-sources/kubernetes-fluentd-plugin", "/Send-Data/Sources/03Use-JSON-to-Configure-Sources": "/docs/send-data/use-json-configure-sources", + "/Send-Data/Sources/03Use-JSON-to-Configure-Sources/JSON-Parameters-for-Installed-Sources": "/docs/send-data/use-json-configure-sources/json-parameters-installed-sources", "/Send-Data/Sources/03Use-JSON-to-Configure-Sources/Local-Configuration-File-Management": "/docs/send-data/use-json-configure-sources/local-configuration-file-management", "/Send-Data/Sources/03Use-JSON-to-Configure-Sources/Local-Configuration-File-Management/View-or-Download-Source-JSON-Configuration": "/docs/send-data/use-json-configure-sources/local-configuration-file-management/view-download-source-json-configuration", "/Send-Data/Sources/03Use-JSON-to-Configure-Sources/Local-Configuration-File-Management/Local-Configuration-File-Management-for-Existing-Collectors-and-Sources": "/docs/send-data/use-json-configure-sources/local-configuration-file-management/existing-collectors-and-sources", @@ -4020,6 +4032,7 @@ "/Start-Here/01About-Sumo-Logic/System-Requirements/Supported-Browsers": "/docs/get-started/system-requirements", "/Start-Here/01About-Sumo-Logic/System-Requirements/Installed-Collector-Requirements": "/docs/get-started/system-requirements", "/Traces/02Working_with_Tracing_data/Spans": "/docs/apm/traces/spans", + "/Traces/02Working_with_Tracing_data/Search_Query_Language_support_for_Traces": "/docs/apm/traces/search-query-language-support-for-traces", "/Traces/Getting_Started_with_Transaction_Tracing": "/docs/apm/traces/get-started-transaction-tracing", "/Traces/Getting_Started_with_Transaction_Tracing/Set_up_traces_collection_for_other_environments": "/docs/apm/traces/get-started-transaction-tracing/set-up-traces-collection-for-other-environments", "/Traces/Getting_Started_with_Transaction_Tracing/Working_with_spans_attributes": "/docs/apm/traces/advanced-configuration/working-with-span-attributes", @@ -4116,6 +4129,7 @@ "/docs/dashboards/chart-panel-types/line-charts": "/docs/dashboards/panels/line-charts", "/docs/dashboards/chart-panel-types/table-charts": "/docs/dashboards/panels/table-charts", "/docs/dashboards/chart-panel-types/string-single-value-charts": "/docs/dashboards/panels/single-value-charts", + "/docs/dashboards/get-started": "/docs/dashboards", "/docs/dashboards/get-started/add-links-text-panels": "/docs/dashboards/about", "/docs/dashboards/get-started/launch-search-data-panel": "/docs/dashboards/about", "/docs/dashboards/get-started/markdown-syntax": "/docs/dashboards/panels/markdown-syntax", diff --git a/docs/alerts/scheduled-searches/generate-cse-signals.md b/docs/alerts/scheduled-searches/generate-cse-signals.md index eec7ec5314..198a17f608 100644 --- a/docs/alerts/scheduled-searches/generate-cse-signals.md +++ b/docs/alerts/scheduled-searches/generate-cse-signals.md @@ -2,27 +2,27 @@ id: generate-cse-signals title: Generate Cloud SIEM Signals With a Scheduled Search sidebar_label: Generate Cloud SIEM Signals -description: You can generate a Cloud SIEM Signal with a scheduled search. +description: You can generate a Cloud SIEM signal with a scheduled search. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This page has information about creating a scheduled search that will trigger a Cloud SIEM Signal. Before you start using Scheduled Searches to create Cloud SIEM Signals, it is helpful to understand what Signals are, and how they relate to the generation of Cloud SIEM Insights. For information about how it all works see [Insight Generation Process](/docs/cse/get-started-with-cloud-siem/insight-generation-process/).  +This page has information about creating a scheduled search that will trigger a Cloud SIEM signal. Before you start using Scheduled Searches to create Cloud SIEM signals, it is helpful to understand what signals are, and how they relate to the generation of Cloud SIEM insights. For information about how it all works see [Insight Generation Process](/docs/cse/get-started-with-cloud-siem/insight-generation-process/).  :::note -For a more detailed description of the options you can configure for a scheduled search, see [Schedule a Search](schedule-search.md). +For a more detailed description of the options you can configure for a scheduled search, see [Create a Scheduled Search](/docs/alerts/scheduled-searches/schedule-search/). ::: ## Requirements for the search query -This section describes the requirements for your scheduled search, which include a minimum set of fields to be returned, and renaming message fields as necessary to match attribute names in the selected Cloud SIEM Record type schema.   +This section describes the requirements for your scheduled search, which include a minimum set of fields to be returned, and renaming message fields as necessary to match attribute names in the selected Cloud SIEM record type schema.   ### Required fields There are several fields that your scheduled search must return to -enable Signal generation: +enable signal generation: -* `normalizedseverity`. This field must contain a value between (and including) 0 and 10. Signals generated by the scheduled search will have this severity value. SIgnal severity values are used by Cloud SIEM’s Insight generation algorithm, as described above.  +* `normalizedseverity`. This field must contain a value between (and including) 0 and 10. Signals generated by the scheduled search will have this severity value. SIgnal severity values are used by Cloud SIEM’s insight generation algorithm, as described above.  * `stage`. This field must contain a Tactic in the MITRE ATT&CK framework, one of the following: * Collection * Command and Control @@ -39,7 +39,7 @@ enable Signal generation: * Reconnaissance * Resource Development :::important - If the `stage` field contains a Tactic that isn't in the MITRE ATT&CK framework, a Signal will not be generated, but a Record will be.  + If the `stage` field contains a Tactic that isn't in the MITRE ATT&CK framework, a signal will not be generated, but a record will be.  ::: * At least one entity field: @@ -60,55 +60,52 @@ enable Signal generation: ### Renaming message fields -When you configure a Scheduled Search to create Cloud SIEM Signals, you are prompted to select a [Cloud SIEM Record type](../../cse/schema/cse-record-types.md). The fields returned by your search must match an attribute in the Record -type you select. A field whose name does not match a Cloud SIEM attribute will not be populated in the Record created from the Schedule Search results. For more about Cloud SIEM attribute names, see [Attributes You Can Map to Records](../../cse/schema/attributes-map-to-records.md). +When you configure a Scheduled Search to create Cloud SIEM signals, you are prompted to select a [Cloud SIEM record type](/docs/cse/schema/cse-record-types/). The fields returned by your search must match an attribute in the record type you select. A field whose name does not match a Cloud SIEM attribute will not be populated in the record created from the Schedule Search results. For more about Cloud SIEM attribute names, see [Attributes You Can Map to Records](/docs/cse/schema/attributes-map-to-records/). ## Scheduling the search -1. After creating and saving your search, click the save icon.
Save the search -1. The **Save Item** popup appears. +1. After creating and saving your search, click the save icon.
Save the search +1. The **Save Item** popup appears.
Save as scheduled search :::note The name of your scheduled search will appear as the signal name in Cloud SIEM. ::: -
Save as scheduled search 1. Click **Schedule this search**. -1. The **Save Item** popup prompts you to select a run frequency.
![run-frequency.png](/img/alerts/run-freq-signal-gen.png) +1. The **Save Item** popup prompts you to select a run frequency.
Run frequency 1. Select a frequency from the pull-down list and click **Save**.  Scheduling a run frequency that matches your query time range will reduce overlapping searches and duplicate alerts. When you have a search scheduled to run over the same results as a previously scheduled search you would trigger an alert on the same data.  -1. The popup refreshes.
![options.png](/img/alerts/options.png) +1. The popup refreshes.
Options 1. **Time range for scheduled search.** Indicates the time range your query will use to execute, which impacts the results generated by the query. :::note - This setting is different than the Time Range option configured for the Saved Search. The first time range is only used when you run the Saved Search from the Library. This Time Range applies to your Scheduled Search. + This setting is different than the time range option configured for the Saved Search. The first time range is only used when you run the Saved Search from the library. This time range applies to your Scheduled Search. ::: 1. **Timezone for scheduled search**. Select the time zone you would like your scheduled search to use. The schedule's time is based on this time zone. This time zone is not related to the time zone of your data. If you do not make a selection, the scheduled search will use the time zone from your browser, which is the default selection. -1. **Send notification**. Select **If the following condition is met**, and enter an alert condition and the number of results that should trigger the alert. -1. **Alert Type**. Select **Cloud SIEM Signal**. -1. The popup refreshes.
![alert-type-selected.png](/img/alerts/alert-type-selected.png) -1. **Record Type**. Select a [Record Type](../../cse/schema/cse-record-types.md). +1. **Send Notification**. Select **If the following condition is met**, and enter an alert condition and the number of results that should trigger the alert. +1. **Alert Type**. Select **CSE Signal**. +1. The popup refreshes.
Alert type selected +1. **Record Type**. Select a [record type](/docs/cse/schema/cse-record-types/). 1. Click **Save**. -## View Signals in Cloud SIEM +## View signals in Cloud SIEM -To view Signals that were created from a scheduled search, run a keyword search on “CIP Scheduled Search” on the **Signals** page in the Cloud SIEM UI. +To view signals that were created from a scheduled search, run a keyword search on “Scheduled Search” on the **Signals** page in the Cloud SIEM UI: +1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Cloud SIEM**, and then select **Signals** in the top menu.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**. +1. Click in the **Filters** field at the top of the screen. +1. Type **Scheduled Search** and press Enter. The keyword search returns a list of all signals created by scheduled searches. +1. Click a signal from the list. Below is a screenshot of a signal that was created from a scheduled search. Note that: + * **Related Insights** shows the insights the signal is included with. If the signal is not part of an insight, there’s a **Create Insight** link you can use to create an insight for the signal. For more information, see [Create an insight from signal](#create-an-insight-from-signal). + * You can click the **Full Details** link for more information about the signal. See [View signal details](#view-signal-details) below for a screenshot. + * The **Mapping** section at the bottom of the page shows that the signal was the result of a scheduled search.
Signal -Below is a screenshot of a Signal that was created from a scheduled search. Note that: +## View signal details -* The **Mapping** section at the bottom of the page shows that the Signal was the result of a scheduled search. -* If the Signal is not part of an Insight, there’s a **Create Insight** link you can use to create an Insight for the Signal. For more information, see [Create an Insight from Signal](#create-an-insight-from-signal). -* You can click the **Full Details** link for more information about the Signal. See [View Signal details](#view-signal-details) below for a screenshot. +The **Full Details** tab displays details about the signal. -![ss-signal.png](/img/alerts/ss-signal.png) +Signal details -## View Signal details +## Create an insight from signal -The **Full Details** tab displays details about the Signal. +To create an insight from a signal generated from a scheduled search: -![full-details.png](/img/alerts/full-details.png) - -## Create an Insight from Signal - -To create an Insight from a Signal generated from a scheduled search: - -1. Navigate to a Signal that was generated from a scheduled search. -1. Click **Create Insight**.  -1. Click **Yes, Create Insight** when prompted whether you want to proceed.
![confirm-create.png](/img/alerts/confirm-create.png) -1. The new Insight is created and appears as a **Related Insight**.
![new-related-insight.png](/img/alerts/new-related-insight.png) +1. Navigate to a signal that was generated from a scheduled search. +1. **Related Insights** shows the insights the signal is included with. If the signal is not part of an insight, there’s a **Create Insight** link you can use to create an insight for the signal. Click **Create Insight**. 
Create insight link +1. Click **Yes, Create Insight**.
Confirm create +1. The new insight is created and appears as a **Related Insight**.
New related insight diff --git a/docs/api/access-keys.md b/docs/api/access-keys.md index 31019ad434..bfd12e4678 100644 --- a/docs/api/access-keys.md +++ b/docs/api/access-keys.md @@ -30,12 +30,10 @@ The [Access Keys](/docs/manage/security/access-keys) Management API allows you t | US1 | https://api.sumologic.com/docs/#tag/accessKeyManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/accessKeyManagement | - \ No newline at end of file diff --git a/docs/api/account-management.md b/docs/api/account-management.md index 83130a4108..f522b83d7f 100644 --- a/docs/api/account-management.md +++ b/docs/api/account-management.md @@ -31,11 +31,8 @@ The Account Management API allows you to manage the custom subdomain for the URL | US1 | https://api.sumologic.com/docs/#tag/accountManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/accountManagement | - - \ No newline at end of file diff --git a/docs/api/app-management.md b/docs/api/app-management.md index 3a978dae36..9accae19ea 100644 --- a/docs/api/app-management.md +++ b/docs/api/app-management.md @@ -30,11 +30,9 @@ View and install Sumo Logic applications that deliver out-of-the-box dashboards, | US1 | https://api.sumologic.com/docs/#tag/appManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/appManagement | - \ No newline at end of file diff --git a/docs/api/archive-ingestion.md b/docs/api/archive-ingestion.md index a857fc75b4..a0516412cc 100644 --- a/docs/api/archive-ingestion.md +++ b/docs/api/archive-ingestion.md @@ -34,12 +34,10 @@ You need the [Manage or View Collectors role capability](/docs/manage/users-role | US1 | https://api.sumologic.com/docs/#tag/archiveManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/archiveManagement | - \ No newline at end of file diff --git a/docs/api/cloud-siem-enterprise.md b/docs/api/cloud-siem-enterprise.md index 110c3742be..a46ce4d9f8 100644 --- a/docs/api/cloud-siem-enterprise.md +++ b/docs/api/cloud-siem-enterprise.md @@ -20,10 +20,8 @@ The [Cloud SIEM](/docs/cse) API allows you to create and manage Entities, Custom - \ No newline at end of file diff --git a/docs/api/cloud-soar.md b/docs/api/cloud-soar.md index fb076b0d70..80c133261c 100644 --- a/docs/api/cloud-soar.md +++ b/docs/api/cloud-soar.md @@ -34,10 +34,8 @@ https:///incmansuite_ng/lib/gui/app.php#support_apidoc|api_docume For more information, see [Legacy Cloud SOAR APIs](/docs/cloud-soar/legacy/legacy-cloud-soar-apis/). - \ No newline at end of file diff --git a/docs/api/collector-management/index.md b/docs/api/collector-management/index.md index 9adf3af5d3..8bc8601170 100644 --- a/docs/api/collector-management/index.md +++ b/docs/api/collector-management/index.md @@ -46,14 +46,13 @@ This API manages your OpenTelemetry collectors. | US2 | https://api.us2.sumologic.com/docs/#tag/otCollectorManagementExternal | - ## Guide contents diff --git a/docs/api/connections-management.md b/docs/api/connections-management.md index fec0338787..d4bbfd0ffd 100644 --- a/docs/api/connections-management.md +++ b/docs/api/connections-management.md @@ -31,7 +31,7 @@ Connections Management APIs let you set up connections to send alerts to third-p | US2 | https://api.us2.sumologic.com/docs/#tag/connectionManagement | - diff --git a/docs/api/content-management.md b/docs/api/content-management.md index 25597ad027..62e4b6980e 100644 --- a/docs/api/content-management.md +++ b/docs/api/content-management.md @@ -30,11 +30,10 @@ The Content Management API allows you to manage content in your organization’s | US1 | https://api.sumologic.com/docs/#tag/contentManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/contentManagement | - diff --git a/docs/api/content-permissions.md b/docs/api/content-permissions.md index 91b20f8b43..e921ddc3d8 100644 --- a/docs/api/content-permissions.md +++ b/docs/api/content-permissions.md @@ -30,7 +30,7 @@ The Content Permissions API allows you to share your folders, searches, and dash | US1 | https://api.sumologic.com/docs/#tag/contentPermissions | | US2 | https://api.us2.sumologic.com/docs/#tag/contentPermissions | - diff --git a/docs/api/dashboard.md b/docs/api/dashboard.md index e3309398c1..85e7bdca49 100644 --- a/docs/api/dashboard.md +++ b/docs/api/dashboard.md @@ -30,10 +30,9 @@ The Dashboard Management APIs allow you to create, retrieve, update, and delete |US1 |https://api.sumologic.com/docs/#tag/dashboardManagement | |US2 |https://api.us2.sumologic.com/docs/#tag/dashboardManagement | - diff --git a/docs/api/dynamic-parsing.md b/docs/api/dynamic-parsing.md index 80d0e5b8b7..1f8fa96fec 100644 --- a/docs/api/dynamic-parsing.md +++ b/docs/api/dynamic-parsing.md @@ -30,7 +30,7 @@ The Dynamic Parsing Management API allows you to configure Run Time Field Extrac | US1 | https://api.sumologic.com/docs/#tag/dynamicParsingRuleManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/dynamicParsingRuleManagement | - \ No newline at end of file diff --git a/docs/api/field-extraction-rules.md b/docs/api/field-extraction-rules.md index 4698009f21..30f8db689d 100644 --- a/docs/api/field-extraction-rules.md +++ b/docs/api/field-extraction-rules.md @@ -30,7 +30,7 @@ The Field Extraction Rules (FER) Management API allows you to configure FERs fro | US1 | https://api.sumologic.com/docs/#tag/extractionRuleManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/extractionRuleManagement | - \ No newline at end of file diff --git a/docs/api/field-management.md b/docs/api/field-management.md index d868c678a1..bda90d6667 100644 --- a/docs/api/field-management.md +++ b/docs/api/field-management.md @@ -30,7 +30,7 @@ The Field Management API allows you to configure fields from HTTP endpoints. Fie | US1 | https://api.sumologic.com/docs/#tag/fieldManagementV1 | | US2 | https://api.us2.sumologic.com/docs/#tag/fieldManagementV1 | - \ No newline at end of file diff --git a/docs/api/folder-management.md b/docs/api/folder-management.md index 675c0ef175..a1a7675b7b 100644 --- a/docs/api/folder-management.md +++ b/docs/api/folder-management.md @@ -30,11 +30,10 @@ The Folder Management API allows you to add folders and subfolders to the [Libra | US1 | https://api.sumologic.com/docs/#tag/folderManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/folderManagement | - \ No newline at end of file diff --git a/docs/api/health-events.md b/docs/api/health-events.md index 104f46fc09..c320873760 100644 --- a/docs/api/health-events.md +++ b/docs/api/health-events.md @@ -31,12 +31,10 @@ The [Health Events](/docs/manage/health-events) Management API allows you to vie | US2 | https://api.us2.sumologic.com/docs/#tag/healthEvents | - \ No newline at end of file diff --git a/docs/api/ingest-budget-v2.md b/docs/api/ingest-budget-v2.md index f8148e6d04..37baf974df 100644 --- a/docs/api/ingest-budget-v2.md +++ b/docs/api/ingest-budget-v2.md @@ -41,13 +41,11 @@ Ingest Budget Management V1 APIs have been removed and are no longer supported. | US1 | https://api.sumologic.com/docs/#tag/ingestBudgetManagementV2 | | US2 | https://api.us2.sumologic.com/docs/#tag/ingestBudgetManagementV2 | - - To manage ingest budgets, you must have the **Manage Ingest Budgets** role capability. Enabling this will automatically enable the **Manage Collectors** capability. The Manage Collectors capability on its own permits the re-assignment of budgets to different Collectors, but not creating or deleting them. For more information, see [Ingest Budgets](/docs/manage/ingestion-volume/ingest-budgets). diff --git a/docs/api/log-search-estimated-usage.md b/docs/api/log-search-estimated-usage.md index 06e111bddd..8330efcf7b 100644 --- a/docs/api/log-search-estimated-usage.md +++ b/docs/api/log-search-estimated-usage.md @@ -32,7 +32,7 @@ In the Infrequent Data Tier and Flex, you pay per query, based on the amount of | US1 | https://api.sumologic.com/docs/#operation/getLogSearchEstimatedUsageByMeteringType | | US2 | https://api.us2.sumologic.com/docs/#operation/getLogSearchEstimatedUsageByMeteringType | - \ No newline at end of file diff --git a/docs/api/log-searches.md b/docs/api/log-searches.md index 96c0e1d166..784e94a694 100644 --- a/docs/api/log-searches.md +++ b/docs/api/log-searches.md @@ -32,12 +32,10 @@ Whether you're running ad hoc searches during a forensic investigation or runnin | US1 | https://api.sumologic.com/docs/#tag/logSearchesManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/logSearchesManagement | - \ No newline at end of file diff --git a/docs/api/logs-data-forwarding.md b/docs/api/logs-data-forwarding.md index c04f465cb2..9ddfe0862a 100644 --- a/docs/api/logs-data-forwarding.md +++ b/docs/api/logs-data-forwarding.md @@ -30,7 +30,7 @@ The Logs Data Forwarding Management API allows you to forward log data from a Pa | US1 | https://api.sumologic.com/docs/#tag/logsDataForwardingManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/logsDataForwardingManagement | - \ No newline at end of file diff --git a/docs/api/lookup-tables.md b/docs/api/lookup-tables.md index 8a1997086a..b42043e1d3 100644 --- a/docs/api/lookup-tables.md +++ b/docs/api/lookup-tables.md @@ -30,7 +30,7 @@ The Lookup Management API allows you to manage [Lookup Tables](/docs/search/look | US1 | https://api.sumologic.com/docs/#tag/lookupManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/lookupManagement | - \ No newline at end of file diff --git a/docs/api/metrics-query.md b/docs/api/metrics-query.md index 74de15cc9e..4caaf5c236 100644 --- a/docs/api/metrics-query.md +++ b/docs/api/metrics-query.md @@ -55,10 +55,8 @@ A metric query consists of a metric, one or more filters, and optionally, one or | US1 | https://api.sumologic.com/docs/#tag/metricsQuery | | US2 | https://api.us2.sumologic.com/docs/#tag/metricsQuery | - \ No newline at end of file diff --git a/docs/api/metrics-searches-v2.md b/docs/api/metrics-searches-v2.md index 5fd8236618..6c93d86a3d 100644 --- a/docs/api/metrics-searches-v2.md +++ b/docs/api/metrics-searches-v2.md @@ -30,10 +30,9 @@ Use Metrics Search Management APIs V2 to save metrics searches in the content li | US1 | https://api.sumologic.com/docs/#tag/metricsSearchesManagementV2 | | US2 | https://api.us2.sumologic.com/docs/#tag/metricsSearchesManagementV2 | - diff --git a/docs/api/metrics-searches.md b/docs/api/metrics-searches.md index 5f1414003f..efc8c0a177 100644 --- a/docs/api/metrics-searches.md +++ b/docs/api/metrics-searches.md @@ -32,10 +32,8 @@ Use Metrics Search Management APIs to save metrics searches in your content libr | US1 | https://api.sumologic.com/docs/#tag/metricsSearchesManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/metricsSearchesManagement | - \ No newline at end of file diff --git a/docs/api/metrics-transformation-rules.md b/docs/api/metrics-transformation-rules.md index cab3389dc2..3e3df8930e 100644 --- a/docs/api/metrics-transformation-rules.md +++ b/docs/api/metrics-transformation-rules.md @@ -28,10 +28,9 @@ Metrics Transformation Rules APIs allow you control how long raw metrics are ret | US1 | https://api.sumologic.com/docs/#tag/transformationRuleManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/transformationRuleManagement | - diff --git a/docs/api/monitors-management.md b/docs/api/monitors-management.md index b73459ce42..03e18491b0 100644 --- a/docs/api/monitors-management.md +++ b/docs/api/monitors-management.md @@ -30,10 +30,8 @@ The Monitor Management API allows you to manage Monitors from HTTP endpoints. Mo | US1 | https://api.sumologic.com/docs/#tag/monitorsLibraryManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/monitorsLibraryManagement | - \ No newline at end of file diff --git a/docs/api/muting-schedules.md b/docs/api/muting-schedules.md index 0e176574b9..d2a9d01dbc 100644 --- a/docs/api/muting-schedules.md +++ b/docs/api/muting-schedules.md @@ -30,10 +30,8 @@ The Muting Schedules Management API allows you to pause alert notifications from | US1 | https://api.sumologic.com/docs/#tag/mutingSchedulesLibraryManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/mutingSchedulesLibraryManagement | - \ No newline at end of file diff --git a/docs/api/organizations-management.md b/docs/api/organizations-management.md index 8ed659801a..4f850f5d32 100644 --- a/docs/api/organizations-management.md +++ b/docs/api/organizations-management.md @@ -32,10 +32,9 @@ With the Organizations Management API, you can get the credits usage details of `*` This assembly is exclusive to the US2 deployment and manages APIs for Sumo Logic orgs not tied to a specific deployment, such as parent orgs with child orgs across multiple deployments. It includes the [List Organizations API](https://organizations.sumologic.com/docs/#operation/listOrganizations) to support this setup. - diff --git a/docs/api/partition-management.md b/docs/api/partition-management.md index 2920a62a4f..331160b26c 100644 --- a/docs/api/partition-management.md +++ b/docs/api/partition-management.md @@ -30,12 +30,10 @@ The Partitions Management API allows you to improve search performance by search | US1 | https://api.sumologic.com/docs/#tag/partitionManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/partitionManagement | - \ No newline at end of file diff --git a/docs/api/password-policy.md b/docs/api/password-policy.md index 1e59332ee4..78942a122f 100644 --- a/docs/api/password-policy.md +++ b/docs/api/password-policy.md @@ -30,11 +30,10 @@ The Password Policy Management API allows you to manage the [password policy](/d | US1 | https://api.sumologic.com/docs/#tag/passwordPolicy | | US2 | https://api.us2.sumologic.com/docs/#tag/passwordPolicy | - diff --git a/docs/api/policies-management.md b/docs/api/policies-management.md index 4fe91a1bf6..3fa8c01bd8 100644 --- a/docs/api/policies-management.md +++ b/docs/api/policies-management.md @@ -30,10 +30,8 @@ The Policies Management API allows you to control the security and share setting | US1 | https://api.sumologic.com/docs/#tag/policiesManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/policiesManagement | - \ No newline at end of file diff --git a/docs/api/role-management-v2.md b/docs/api/role-management-v2.md index 405b0ef5a9..3dc747cd8d 100644 --- a/docs/api/role-management-v2.md +++ b/docs/api/role-management-v2.md @@ -74,10 +74,9 @@ For example, consider you are interested in querying upon audit logs with change | count by eventTime, eventName, actor, role_name, created_log_analytics_filter, created_audit_data_filter, updated_log_analytics_filter, updated_log_analytics_filter ``` - diff --git a/docs/api/role-management.md b/docs/api/role-management.md index af0428417a..e3bee07256 100644 --- a/docs/api/role-management.md +++ b/docs/api/role-management.md @@ -32,10 +32,8 @@ To manage roles, you must have an administrator role or your role must have been | US1 | https://api.sumologic.com/docs/#tag/roleManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/roleManagement | - \ No newline at end of file diff --git a/docs/api/saml-configuration.md b/docs/api/saml-configuration.md index 641761067b..214b2cb003 100644 --- a/docs/api/saml-configuration.md +++ b/docs/api/saml-configuration.md @@ -30,11 +30,10 @@ The [SAML Configuration](/docs/manage/security/saml/set-up-saml) Management API | US1 | https://api.sumologic.com/docs/#tag/samlConfigurationManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/samlConfigurationManagement | - diff --git a/docs/api/scan-budget.md b/docs/api/scan-budget.md index a041f55035..faf1e4b5f2 100644 --- a/docs/api/scan-budget.md +++ b/docs/api/scan-budget.md @@ -35,4 +35,12 @@ The Scan Budget Management APIs allows you to manage scan budgets from HTTP endp | US1 | https://api.sumologic.com/docs/#tag/budgetManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/budgetManagement | +## Required role capabilities + + + +* Usage Management + * View Usage Management + * Manage Usage Management + To manage scan budgets, you must have the **Manage Usage Management** role capability. Enabling this will also automatically enable the **View Usage Management** capability. diff --git a/docs/api/scheduled-views.md b/docs/api/scheduled-views.md index 54adcd4747..3438aa3b4b 100644 --- a/docs/api/scheduled-views.md +++ b/docs/api/scheduled-views.md @@ -30,12 +30,10 @@ The [Scheduled View](/docs/manage/scheduled-views) Management API allows you to | US1 | https://api.sumologic.com/docs/#tag/scheduledViewManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/scheduledViewManagement | - \ No newline at end of file diff --git a/docs/api/search-job.md b/docs/api/search-job.md index 6138f8f4ce..091f639288 100644 --- a/docs/api/search-job.md +++ b/docs/api/search-job.md @@ -31,7 +31,7 @@ The Search Job API is available to Enterprise accounts. - ## Endpoints for API access @@ -343,6 +342,7 @@ This is the formatted result document: ```json { + "warning":"", "state":"DONE GATHERING RESULTS", "messageCount":90, "histogramBuckets":[ @@ -356,7 +356,6 @@ This is the formatted result document: "count":1, "startTimestamp":1359405480000 }, - ... { "length":60000, "count":1, @@ -367,7 +366,10 @@ This is the formatted result document: ], "pendingWarnings":[ ], - "recordCount":1 + "recordCount":1, + "usageDetails":{ + "dataScannedInBytes":0 + } } ``` @@ -385,12 +387,16 @@ Notice that the state of the sample search job is DONE GATHERING RESULTS. The fo #### More about results +The **warnings** value contains the detailed information about the warning while obtaining the current status of a search job. + The **messageCount** and **recordCount** values indicate the number of messages and records found or produced so far. Messages are raw log messages and records are aggregated data. For queries that do not contain an aggregation operator, only messages are returned. If the query contains an aggregation, for example, **count by _sourceCategory**, then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return). The **pendingErrors** and **pendingWarnings** values contain any pending error or warning strings that have accumulated since the last time the status was requested. +The **usageDetails** value contains the amount of data scanned in bytes details. + Errors and warnings are not cumulative. If you need to retain the errors and warnings, store them locally. The **histogramBuckets** value returns a list of histogram buckets. A histogram bucket is defined by its timestamp, which is the start timestamp (in milliseconds) of the bucket, and a length, also in milliseconds, that expressed the width of the bucket. The **timestampplus** length is the end timestamp of the bucket, so the count is the number of messages in the bucket. @@ -468,6 +474,7 @@ curl -b cookies.txt -c cookies.txt -H 'Accept: application/json' ```json { + "warning": "", "fields":[ { "name":"_messageid", @@ -595,6 +602,7 @@ curl -b cookies.txt -c cookies.txt -H 'Accept: application/json' The result contains two lists, **fields** and **messages**. +* ***warnings** contains the detailed information about the warning while paging through the messages found by a search job. * **fields** contains a list of all the fields defined for each of the messages returned. For each field, the field name and field type are returned. * **messages** contains a list of maps, one map per message. Each **map** maps from the fields described in the fields list to the actual value for the message. @@ -666,6 +674,7 @@ This is the formatted result document: ```json { + "warning": "", "fields":[ { "name":"_sourceCategory", @@ -691,6 +700,8 @@ This is the formatted result document: The returned document is similar to the one returned for the message paging API. The schema of the records returned is described by the list of fields as part of the fields element. The records themselves are a list of maps. +The ***warnings** contains the detailed information about the warning while paging through the records found by a Search Job. + ## POST Methods @@ -828,10 +839,12 @@ Example error response: ```json { - "status" : 400, - "id" : "IUUQI-DGH5I-TJ045", - "code" : "searchjob.invalid.timestamp.from", - "message" : "The 'from' field contains an invalid time." + "warning": "A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request", + "id": "IUUQI-DGH5I-TJ045", + "link": { + "rel": "self", + "href": "https://api.sumologic.com/api/v1/search/jobs/IUUQI-DGH5I-TJ045" + } } ``` diff --git a/docs/api/service-allowlist.md b/docs/api/service-allowlist.md index 4cc352fda9..f86b124418 100644 --- a/docs/api/service-allowlist.md +++ b/docs/api/service-allowlist.md @@ -30,11 +30,10 @@ The [Service Allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses | US1 | https://api.sumologic.com/docs/#tag/serviceAllowlistManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/serviceAllowlistManagement | - diff --git a/docs/api/service-map.md b/docs/api/service-map.md index 9a769c63be..1a74d5f7e4 100644 --- a/docs/api/service-map.md +++ b/docs/api/service-map.md @@ -37,15 +37,13 @@ Tracing APIs give you the ability to browse and execute queries for traces and s | US1 | https://api.sumologic.com/docs/#tag/serviceMap | | US2 | https://api.us2.sumologic.com/docs/#tag/serviceMap | - - ## Endpoints for API access Sumo Logic has deployments that are assigned depending on the geographic location and the date an account is created. For API access, you must manually direct your API client to the correct Sumo Logic API URL. diff --git a/docs/api/slo-management.md b/docs/api/slo-management.md index 315b2f1d4d..9f14d5e22d 100644 --- a/docs/api/slo-management.md +++ b/docs/api/slo-management.md @@ -30,12 +30,10 @@ With the SLO Management API, you can monitor and set up alerts on KPIs for your | US1 | https://api.sumologic.com/docs/#tag/slosLibraryManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/slosLibraryManagement | - \ No newline at end of file diff --git a/docs/api/span-analytics.md b/docs/api/span-analytics.md index 3c9f0f028b..390bc783ad 100644 --- a/docs/api/span-analytics.md +++ b/docs/api/span-analytics.md @@ -38,7 +38,7 @@ Select the documentation link for your deployment: | US1 | https://api.sumologic.com/docs/#tag/spanAnalytics | | US2 | https://api.us2.sumologic.com/docs/#tag/spanAnalytics | - - ## Endpoints for API access Sumo Logic has deployments that are assigned depending on the geographic location and the date an account is created. For API access, you must manually direct your API client to the correct Sumo Logic API URL. diff --git a/docs/api/token-management.md b/docs/api/token-management.md index ce521e873d..668e4a65bc 100644 --- a/docs/api/token-management.md +++ b/docs/api/token-management.md @@ -30,11 +30,9 @@ The Tokens Management API allows you to manage [Installation Tokens](/docs/manag | US1 | https://api.sumologic.com/docs/#tag/tokensLibraryManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/tokensLibraryManagement | - \ No newline at end of file diff --git a/docs/api/tracing.md b/docs/api/tracing.md index 38b381deb3..b0f7cc876a 100644 --- a/docs/api/tracing.md +++ b/docs/api/tracing.md @@ -36,7 +36,7 @@ Tracing APIs give you the ability to browse and execute queries for traces and s | US1 | https://api.sumologic.com/docs/#tag/traces | | US2 | https://api.us2.sumologic.com/docs/#tag/traces | - - ## Endpoints for API access Sumo Logic has deployments that are assigned depending on the geographic location and the date an account is created. For API access, you must manually direct your API client to the correct Sumo Logic API URL. diff --git a/docs/api/user-management.md b/docs/api/user-management.md index 34463ccc83..36e164aef3 100644 --- a/docs/api/user-management.md +++ b/docs/api/user-management.md @@ -30,10 +30,8 @@ The User Management API allows you to [manage user accounts](/docs/manage/users- | US1 | https://api.sumologic.com/docs/#tag/userManagement | | US2 | https://api.us2.sumologic.com/docs/#tag/userManagement | - \ No newline at end of file +* User Management (all role capabilities) \ No newline at end of file diff --git a/docs/cse/integrations/insight-enrichment-server.md b/docs/cse/integrations/insight-enrichment-server.md index f3136e811c..e3e9aa429f 100644 --- a/docs/cse/integrations/insight-enrichment-server.md +++ b/docs/cse/integrations/insight-enrichment-server.md @@ -151,7 +151,7 @@ The following parameters control general server behaviors, as opposed to enrichm | Setting | Required? | Description | |:--|:--|:--| | `URL` | yes | The URL for your API endpoint. For more information, see [Sumo Logic API Authentication, Endpoints, and Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). | -| `api_id` | yes | Enter your Sumo Logic Access ID. For more information, see [Manage your access keys on Preferences page](/docs/manage/security/access-keys#from-the-preferences-page). | +| `api_id` | yes | Enter your Sumo Logic Access ID. For more information, see [Access Keys](/docs/manage/security/access-keys). | | `api_key` | yes | Enter your Sumo Logic Access Key.| | `log_level` | no | Log level the server should use. The options are:

-`error`. Only display error messages.
-`info`. Display informational messages. This is the recommended value.
-`debug`. Displays debug (or trace) data. Recommended only when debugging.

Default: `info` | | `poll_interval` | no | How often the Insight Enrichment Server should check for new insights. You can specify the interval in seconds (s), minutes (m), or hours (h).

Default: 10s | diff --git a/docs/cse/integrations/security-incident-response-integration.md b/docs/cse/integrations/security-incident-response-integration.md index 48cf61642e..c0b4491b71 100644 --- a/docs/cse/integrations/security-incident-response-integration.md +++ b/docs/cse/integrations/security-incident-response-integration.md @@ -36,7 +36,7 @@ Your Cloud SIEM role must allow you to use API keys and to retrieve and modify i In this step, you make a copy of your API credentials, which you'll need to supply when you install the SIR-Cloud SIEM integration in [Step 5](#step-5-install-the-sir-cloud-siem-integration) below.  -You’ll need to supply a Sumo Logic Access ID and Access Key. If necessary, you can create those on your **Preferences** page in the Sumo Logic UI. For more information, see [Create an access key on Preferences page](/docs/manage/security/access-keys#from-the-preferences-page). +You’ll need to supply a Sumo Logic Access ID and Access Key. If necessary, you can create those in the Sumo Logic UI. For more information, see [Access Keys](/docs/manage/security/access-keys). ## Step 2: Install ServiceNow plugins diff --git a/docs/cse/schema/index.md b/docs/cse/schema/index.md index 42e8c71b94..fc70a27384 100644 --- a/docs/cse/schema/index.md +++ b/docs/cse/schema/index.md @@ -69,10 +69,4 @@ This guide has information about Cloud SIEM schemas. In this section, we'll intr

Learn how to import YARA rules from GitHub into Cloud SIEM.

-
-
- Flow diagram icon

Parser Troubleshooting

 -

Learn how to troubleshoot problems with parsers.

-
-
diff --git a/docs/cse/schema/parser-editor.md b/docs/cse/schema/parser-editor.md index 257e14520d..11262fc5ab 100644 --- a/docs/cse/schema/parser-editor.md +++ b/docs/cse/schema/parser-editor.md @@ -8,14 +8,14 @@ description: Learn how to use the Parser Editor to configure and test a custom p import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe'; -This topic has instructions for using the Sumo Logic parser editor. You can use the editor to customize system parsers, and to create your own custom parsers. We provide [parser templates](#parser-templates) that you can use as a starting point for creating custom parsers. +This article has instructions for using the Sumo Logic parser editor. You can use the editor to customize system parsers, and to create your own custom parsers. We provide [parser templates](#parser-templates) that you can use as a starting point for creating custom parsers. For a complete list of standard parsers, see [Parsers](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/parsers/README.md) in the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md). See additional articles for more information about the Sumo Logic Cloud SIEM parsers: * [Parsing Language Reference Guide](/docs/cse/schema/parsing-language-reference-guide) * [Parsing Patterns](/docs/cse/schema/parsing-patterns) -* [Parser Troubleshooting](/docs/cse/schema/parser-troubleshooting-tips) +* [Troubleshoot Parsers](/docs/cse/troubleshoot/troubleshoot-parsers) :::note The instructions that follow assume that you have already written your parser code. diff --git a/docs/cse/schema/parser-troubleshooting-tips.md b/docs/cse/schema/parser-troubleshooting-tips.md deleted file mode 100644 index 2b100fd928..0000000000 --- a/docs/cse/schema/parser-troubleshooting-tips.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -id: parser-troubleshooting-tips -title: Parser Troubleshooting Tips -sidebar_label: Parser Troubleshooting -description: Learn how to troubleshoot problems with parsers. ---- - - -Sumo Logic parsers are a powerful tool for extracting log data to support security and observability use cases. This topic provides tips to help you identify and resolve some common issues you might encounter when using parsers. - -For general information on the parsing engine and syntax, see the [Parser Editor](/docs/cse/schema/parser-editor) and [Parsing Language Reference Guide](/docs/cse/schema/parsing-language-reference-guide) topics. - -1. Our [Ingestion Guides](/docs/cse/ingestion/) provide instructions for how to ingest data from a variety of data sources. Check to see if there is a guide for the data source you’re working with. The ingest guides generally describe the most straightforward, least error-prone method. Make sure that you’ve followed the instructions exactly and that the data to be ingested is supported. - - These guides explain how to configure Collectors and Sources to use a specific parser, what messages are supported out-of-the-box, and have links to vendor documentation where appropriate. - - For data sources that can be configured to log in a custom format, such as [Palo Alto Firewall](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall), the ingest guide will define what formats are supported. Support is usually limited to default configurations, but may vary.   -2. The Sumo Logic Collector or Source that sends the data to be parsed must be correctly configured with the path to the parser. Make sure the path you assign to the Collector or Source is exactly correct. A single character difference will result in parser errors for all logs you try to ingest from your data source. The path to a parser looks like this: - - `/Parsers/System/Microsoft/Windows-XML` - - The ingest guide for a data source will include the path to the correct parser. You can also determine the path to a parser on the **Logs > Parsers** page in the Sumo Logic UI: navigate to the parser, and then choose **Copy Path** from the three-dot kebab menu.   -3. Check for Field Extraction Rules, [Sumo Logic Ingest Mappings](/docs/cse/ingestion/sumo-logic-ingest-mapping), or [Local Configurations](/docs/cse/schema/parser-editor#create-a-local-configuration-for-a-system-parser) related to the parser that is presenting issues. - - * Field Extraction Rules can alter message contents in such a way that the parser works when you're testing it in the Parser Editor against messages returned by a Sumo Logic log search, but not when it receives logs from the Sumo Logic source that collected the logs. Replicating the logic of the FER in a Local Configuration in the parser usually solves this problem.  - * Sumo Logic Ingest Mappings for a data source should always be disabled when you’ve configured a Sumo Logic parser for that same data source. Otherwise, a single message might result in multiple Cloud SIEM records.  - * A Local Configuration to a parser is an override to out-of-the-box behavior. For this reason, if you’re having trouble with a parser, checking out any Local Configurations is important. Make sure to test the parser without Local Configurations so you can verify whether the problem is with the parser itself, or related to an external factor.    -4. Use the right parser for your data format. Some data sources, for example, Windows Event Logs, can send data in multiple different formats and using the correct parser for the format in use is required. diff --git a/docs/get-started/account-settings-preferences.md b/docs/get-started/account-settings-preferences.md index 9695463169..ead23d4e83 100644 --- a/docs/get-started/account-settings-preferences.md +++ b/docs/get-started/account-settings-preferences.md @@ -66,10 +66,6 @@ To set up 2-Step Verification, you will need to install a Time-Based One-Time Pa 1. Scan the QR code displayed on your screen with your TOTP App. 1. After the TOTP App is configured, enter two consecutive authentication codes. -## My Access Keys - -In Sumo Logic, you'll need an access key to register new Collectors and use Sumo Logic APIs. If you have a role that grants the **Create Access Keys** capability, you can create and manage your own Access Keys. For more information, see [Access Keys](/docs/manage/security/access-keys). - ## My Preferences Preference settings are only changed for your personal account; they do not affect any other users in your organization. Any changes you make to your preferences take effect the next time you sign in, not during the current session. diff --git a/docs/get-started/index.md b/docs/get-started/index.md index 4bfb917f3c..074a386150 100644 --- a/docs/get-started/index.md +++ b/docs/get-started/index.md @@ -44,7 +44,7 @@ Let's get started!
icon

Account Preferences

 -

Account settings, access keys, and credentials.

+

Account settings and credentials.

diff --git a/docs/get-started/sumo-logic-ui-classic.md b/docs/get-started/sumo-logic-ui-classic.md index ca1ce4286b..f90cdac592 100644 --- a/docs/get-started/sumo-logic-ui-classic.md +++ b/docs/get-started/sumo-logic-ui-classic.md @@ -208,7 +208,6 @@ To manage your personal Sumo Logic account preferences, do the following: 1. In the Preferences page that appears on the right, you can modify settings in the following areas: * **My Profile**: username and password * **My Security Settings**: enable and disable 2-step verification - * **My Access Keys**: add, edit, and remove access keys * **My Preferences**: your account session settings For more information, see the [Preferences Page](account-settings-preferences.md). diff --git a/docs/get-started/sumo-logic-ui.md b/docs/get-started/sumo-logic-ui.md index c34c15f9aa..c8d14cfd0d 100644 --- a/docs/get-started/sumo-logic-ui.md +++ b/docs/get-started/sumo-logic-ui.md @@ -128,7 +128,6 @@ To manage your personal Sumo account preferences: 1. From the top nav bar, click the person icon, and then from the dropdown, select **Preferences**.
Account Preferences 1. In the Preferences page, you can modify the following settings: * **My Profile**. Username and password. - * **My Access Keys**. Add, edit, and remove access keys. * **My Preferences**. Your account session settings. For more information, see [Account Preferences and Credentials](account-settings-preferences.md). diff --git a/docs/integrations/amazon-aws/cis-aws-foundations-benchmark.md b/docs/integrations/amazon-aws/cis-aws-foundations-benchmark.md index 712d2b4aec..41ae05bcd8 100644 --- a/docs/integrations/amazon-aws/cis-aws-foundations-benchmark.md +++ b/docs/integrations/amazon-aws/cis-aws-foundations-benchmark.md @@ -34,9 +34,9 @@ The CIS AWS Foundation Benchmark App ingests [AWS CloudTrail](/docs/integrations Now that you have configured CIS AWS Foundation Benchmark, install the Sumo Logic App for CIS AWS Foundation Benchmark to take advantage of the preconfigured searches and dashboards to analyze your data. -import AppInstall from '../../reuse/apps/app-install.md'; +import AppInstall2 from '../../reuse/apps/app-install-v2.md'; - + For context regarding the CIS AWS Foundation Benchmark App, check out this [blog](https://www.sumologic.com/blog/cis-aws-foundations-benchmark-monitoring/) where we describe the monitoring controls. diff --git a/docs/integrations/amazon-aws/global-intelligence-guardduty.md b/docs/integrations/amazon-aws/global-intelligence-guardduty.md index 2c41adcde3..f01eba8158 100644 --- a/docs/integrations/amazon-aws/global-intelligence-guardduty.md +++ b/docs/integrations/amazon-aws/global-intelligence-guardduty.md @@ -155,7 +155,7 @@ These tasks require the Manage Collectors and Manage Access Keys [role capabilit In this step, you need to generate access key and access ID from the Sumo Logic console. To generate an access key and access ID, do the following: -1. Follow the instructions as described in this [Sumo Logic Access Key](/docs/manage/security/access-keys#create-an-access-key)) document. +1. Follow the instructions as described in [Access Keys](/docs/manage/security/access-keys). 2. Copy down both the values as you’ll need them to deploy the Sumo Logic GuardDuty Benchmark SAM App. diff --git a/docs/integrations/amazon-aws/guardduty-benchmark.md b/docs/integrations/amazon-aws/guardduty-benchmark.md index fe5bcc5e83..91def3c000 100644 --- a/docs/integrations/amazon-aws/guardduty-benchmark.md +++ b/docs/integrations/amazon-aws/guardduty-benchmark.md @@ -54,7 +54,7 @@ This section shows you how to generate an access key and access ID for log colle In this step, you need to generate access key and access ID from the Sumo Logic console. To generate an access key and access ID, do the following: -1. Follow the instructions as described in this [Sumo Logic Access Key](/docs/manage/security/access-keys#create-an-access-key)) document. +1. Follow the instructions as described in [Access Keys](/docs/manage/security/access-keys#create-an-access-key). 2. Copy down both the values as you’ll need them to deploy the Sumo Logic GuardDuty Benchmark SAM App. diff --git a/docs/integrations/app-development/jfrog-xray.md b/docs/integrations/app-development/jfrog-xray.md index 29b643146c..94e15270ae 100644 --- a/docs/integrations/app-development/jfrog-xray.md +++ b/docs/integrations/app-development/jfrog-xray.md @@ -129,7 +129,7 @@ When you configure the HTTP source, make sure to save the HTTP Source Address UR To add a hosted collector and HTTP source: 1. Create a new Sumo Logic hosted collector by performing the steps in [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector). -2. Create a new HTTP source on the hosted collector created above by following [these instructions](/docs/send-data/hosted-collectors/http-source/logs-metrics). +2. Create a new HTTP source on the hosted collector created above by following instructions in [HTTP Logs and Metrics Source]](/docs/send-data/hosted-collectors/http-source/logs-metrics). ### Step 5: Set up a collection method for JFrog Xray diff --git a/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry.md b/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry.md index 46aeaa9bda..2641347f1d 100644 --- a/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry.md +++ b/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry.md @@ -259,10 +259,10 @@ import CreateMonitors from '../../../reuse/apps/create-monitors.md'; | Name | Description | Alert Condition | Recover Condition | |:--|:--|:--|:--| -| `Artifactory - Excessive Denied Login Attempts` | This alert is triggered when there are multiple denied login attempts from the same IP or user. | Count `>` 5 | Count `<=` 5 | -| `Artifactory - High 4xx Status Codes` | This alert is triggered when there's a high number of HTTP 4xx error responses. | Count `>` 10 | Count `<=` 10 | -| `Artifactory - High 5xx Status Codes` | This alert is triggered when there's a high number of HTTP 5xx error responses. | Count `>` 10 | Count `<=` 10 | -| `Artifactory - High Denied Deploys to Cached Repos` | This alert is triggered when there's a high number of denied deploy attempts to cached repositories. | Count `>` 5 | Count `<=` 5 | -| `Artifactory - High Denied Deploys to Non-Cached Repos` | This alert is triggered when there's a spike in denied deploy attempts to non-cached repositories. | Count `>` 5 | Count `<=` 5 | -| `Artifactory - High Denied Downloads` | This alert is triggered when there's a high number of denied download attempts. | Count `>` 5 | Count `<=` 5 | -| `Artifactory - Slow HTTP Response Times` | This alert is triggered when Artifactory response times are high. | Count `>` 5 | Count `<=` 5 | +| `Artifactory - Excessive Denied Login Attempts` | This alert is triggered when there are multiple denied login attempts from the same IP or user. | Count > 5 | Count \<= 5 | +| `Artifactory - High 4xx Status Codes` | This alert is triggered when there's a high number of HTTP 4xx error responses. | Count > 10 | Count \<= 10 | +| `Artifactory - High 5xx Status Codes` | This alert is triggered when there's a high number of HTTP 5xx error responses. | Count > 10 | Count \<= 10 | +| `Artifactory - High Denied Deploys to Cached Repos` | This alert is triggered when there's a high number of denied deploy attempts to cached repositories. | Count > 5 | Count \<= 5 | +| `Artifactory - High Denied Deploys to Non-Cached Repos` | This alert is triggered when there's a spike in denied deploy attempts to non-cached repositories. | Count > 5 | Count \<= 5 | +| `Artifactory - High Denied Downloads` | This alert is triggered when there's a high number of denied download attempts. | Count > 5 | Count \<= 5 | +| `Artifactory - Slow HTTP Response Times` | This alert is triggered when Artifactory response times are high. | Count > 5 | Count \<= 5 | diff --git a/docs/integrations/app-development/opentelemetry/jira-opentelemetry.md b/docs/integrations/app-development/opentelemetry/jira-opentelemetry.md index 7d61e33892..5a6f46b8ca 100644 --- a/docs/integrations/app-development/opentelemetry/jira-opentelemetry.md +++ b/docs/integrations/app-development/opentelemetry/jira-opentelemetry.md @@ -277,3 +277,21 @@ The **Jira - Sprints Events** dashboard provides insights on sprint events in Ji The **Jira - User Events** dashboard provides information about user events in Jira, including the number of user events, trends, and users that have been updated, created, and deleted. User Events + + +## Create monitors for Jira app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### Jira alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `Jira - Abnormal Session Creation Rate Alert` | This alert is triggered when there are unusual patterns in session creation/destruction that might indicate security issues or system problems. | Count >= 1 | Count < 1 | +| `Jira - High Average Response Time Alert` | This alert is triggered when elevated response times in Jira are detected, indicating potential performance degradation. | Count >= 5000 | Count < 5000 | +| `Jira - High HTTP 4xx Error Rate Alert` | This alert is triggered when there is increase in HTTP 4xx errors to detect service disruptions. | Count >= 50 | Count < 50 | +| `Jira - High HTTP 5xx Error Rate Alert` | This alert is triggered when there is increase in HTTP 5xx errors to detect service disruptions. | Count >= 50 | Count < 50 | +| `Jira - High Priority Issues Unassigned SLA Alert` | This alert is triggered when high-priority issues remain unassigned beyond the Default SLA threshold of 30 minutes (1800000 milliseconds). To adjust the SLA, update the value in the query to the desired time in milliseconds (e.g., 15 minutes = 900000, 1 hour = 3600000). | Count >= 1 | Count < 1 | +| `Jira - Rapid Authentication Failures Alert` | This alert is triggered when a single user experiences more than 10 failed login attempts within 5 minutes, indicating potential password guessing attempts or account lockout issues. | Count > 10 | Count \<= 10 | diff --git a/docs/integrations/app-development/opentelemetry/jmx-opentelemetry.md b/docs/integrations/app-development/opentelemetry/jmx-opentelemetry.md index 66380b39ff..5e2c7759bc 100644 --- a/docs/integrations/app-development/opentelemetry/jmx-opentelemetry.md +++ b/docs/integrations/app-development/opentelemetry/jmx-opentelemetry.md @@ -251,4 +251,4 @@ import CreateMonitors from '../../../reuse/apps/create-monitors.md'; | `JMX - High Heap Memory Usage Alert` | This alert gets triggered when heap memory usage exceeds threshold. | Count < 20 | Count >= 20 | | `JMX - High Memory Pool Usage Alert` | This alert gets triggered when memory pool usage exceeds threshold. | Count < 20 | Count >= 20 | | `JMX - High Non Heap Memory Usage Alert` | This alert gets triggered when non heap memory usage exceeds threshold. | Count < 20 | Count >= 20 | -| `JMX - High Number Of Classes Loaded Alert` | This alert gets triggered when high number of classes are loaded. | Count > 1000 | Count < = 1000 | \ No newline at end of file +| `JMX - High Number Of Classes Loaded Alert` | This alert gets triggered when high number of classes are loaded. | Count > 1000 | Count \<= 1000 | diff --git a/docs/integrations/app-development/opentelemetry/puppet-opentelemetry.md b/docs/integrations/app-development/opentelemetry/puppet-opentelemetry.md index b5e05d8421..3dbf32cc6c 100644 --- a/docs/integrations/app-development/opentelemetry/puppet-opentelemetry.md +++ b/docs/integrations/app-development/opentelemetry/puppet-opentelemetry.md @@ -276,3 +276,18 @@ This sample query is from the **Puppet - Overview** dashboard > **Node Requests ### Node Puppet Runs Analysis: Puppet Node Runs Analysis Node Puppet Runs Analysis + +## Create monitors for Puppet app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### Puppet alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `Puppet - Catalog Compilation Performance` | This alert is triggered when average time taken to compile Puppet catalogs is greater than given value (Default 30 seconds). Extended compilation times can indicate Puppet master performance issues, complex catalogs, or resource constraints. | Count \>= 30 | Count \< 30 | +| `Puppet - Erroneous Nodes` | This alert is triggered when a node has error more errors then given value (Default 5). | Count \>= 5 | Count \< 5 | +| `Puppet - Error Pattern Analysis` | This alert is triggered when Puppet error logs show recurring patterns that may indicate issues, helping detect problems that need investigation. | Count \>= 20 | Count \< 20 | +| `Puppet - Resource Status Failures` | This alert is triggered when there are specific resource failures greater than given value (Default 5). | Count \>= 5 | Count \< 5 | diff --git a/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry.md b/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry.md index e4a9e8b8d1..76df3122b0 100644 --- a/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry.md +++ b/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry.md @@ -223,3 +223,19 @@ Use this dashboard to: - Monitor service usage and other system activity. Linux-Security-Analytics-User-Service-and-System-Monitoring + + +## Create monitors for Linux - Cloud Security Monitoring and Analytics app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### Linux - Cloud Security Monitoring and Analytics alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `Linux CSMA - Excessive Failed Authentication` | This alert is triggered when multiple failed login attempts from the same source are detected, indicating potential brute force attempts. | Count > 10 | Count \<= 10 | +| `Linux CSMA - Root Login Detection` | This alert is triggered when direct login attempts using the root account are detected, indicating a potential security concern since root logins should typically be disabled. | Count \>= 1 | Count < 1 | +| `Linux CSMA - System Shutdown Detection` | This alert is triggered when unexpected system shutdown events are detected through kernel stop messages, which may indicate unauthorized access, malicious activity, power issues, or system failures. | Count > 0 | Count \<= 0 | +| `Linux CSMA - User Account Creation Spike` | This alert is triggered when multiple user accounts are created in a short time period, which may indicate automated account creation, compromised systems, or unauthorized bulk user provisioning. | Count > 3 | Count \<= 3 | diff --git a/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/windows-opentelemetry.md b/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/windows-opentelemetry.md index 8a0ca94692..b712f5698f 100644 --- a/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/windows-opentelemetry.md +++ b/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/windows-opentelemetry.md @@ -305,3 +305,18 @@ The **WWindows - Security Monitoring - Critical Events** dashboard provides anal The **Windows - Security Monitoring - Inventory** dashboard helps you to monitor windows events provided by computer, channel, and provider. This dashboard also provides additional information on computer reboots. Windows-Security-Monitoring-Inventory + + +## Create monitors for Windows - Cloud Security Monitoring and Analytics app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### Windows - Cloud Security Monitoring and Analytics alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `Windows CSMA - Audit Log Tampering Detection` | This alert is triggered when attempt is detected to clear or tamper with Windows audit logs, indicating potential attempts to cover malicious activities. | Count > = 1 | Count < 1 | +| `Windows CSMA - Failed Authentication Spike` | This alert is triggered when unusual spikes in failed authentication attempts are detected, indicating potential brute force attacks. | Count > = 10 | Count < 10 | +| `Windows CSMA - Windows Update Failures` | This alert is triggered when repeated Windows Update failures are detected, indicating potential vulnerabilities to known exploits. | Count > = 3 | Count < 3 | diff --git a/docs/integrations/containers-orchestration/activemq.md b/docs/integrations/containers-orchestration/activemq.md index 873080fc8c..9e81898cc8 100644 --- a/docs/integrations/containers-orchestration/activemq.md +++ b/docs/integrations/containers-orchestration/activemq.md @@ -484,7 +484,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method 2: Install the alerts using a Terraform script -1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). To find out which deployment your Sumo Logic account is in, see [Sumo Logic endpoints](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). To find out which deployment your Sumo Logic account is in, see [Sumo Logic endpoints](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for ActiveMQ alerts: The alerts package is available in the Sumo Logic github[ repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/ActiveMQ). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/ActiveMQ/`. @@ -555,10 +555,10 @@ Locate and install the app you need from the **App Catalog**. If you want to see 1. From the **App Catalog**, search for and select the app. 2. Select the version of the service you're using and click **Add to Library**. 3. To install the app, complete the following fields. - 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app.
 + 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app. 2. **Data Source.** Choose **Enter a Custom Data Filter** and enter a custom ActiveMQ cluster filter. Examples: * For all ActiveMQ clusters: `messaging_cluster=*` - * For a specific cluster: `messaging_cluster=activemq.dev.01`.
 + * For a specific cluster: `messaging_cluster=activemq.dev.01`. * Clusters within a specific environment: `messaging_cluster=activemq-1` and `environment=prod` (This assumes you have set the optional environment tag while configuring collection). 4. **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. 5. Click **Add to Library**. diff --git a/docs/integrations/containers-orchestration/docker-community-edition.md b/docs/integrations/containers-orchestration/docker-community-edition.md index 6739771d99..be9e6ebfd1 100644 --- a/docs/integrations/containers-orchestration/docker-community-edition.md +++ b/docs/integrations/containers-orchestration/docker-community-edition.md @@ -307,8 +307,8 @@ In collector version 19.216-22 and later, when you configure the sourceCategory You build templates for sourceCategory and sourceHost specifying component variables in this form: `{{NAMESPACE.VAR_NAME}}`. Where: -* `NAMESPACE` is a namespace that indicates the variable type.
 -* `VAR_NAME` is the variable name.
 These are case-sensitive. +* `NAMESPACE` is a namespace that indicates the variable type. +* `VAR_NAME` is the variable name. These are case-sensitive. The table below defines the types of variables you can use. diff --git a/docs/integrations/containers-orchestration/kafka.md b/docs/integrations/containers-orchestration/kafka.md index 61ed4e3225..49aa1b000c 100644 --- a/docs/integrations/containers-orchestration/kafka.md +++ b/docs/integrations/containers-orchestration/kafka.md @@ -418,7 +418,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for Kafka alerts. The alerts package is available in the Sumo Logic [GitHub repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Kafka). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Kafka`. @@ -489,10 +489,10 @@ Locate and install the app you need from the **App Catalog**. If you want to see Version selection is not available for all apps. ::: 3. To install the app, complete the following fields. - * **App Name.** You can retain the existing name, or enter a name of your choice for the app.
 + * **App Name.** You can retain the existing name, or enter a name of your choice for the app. * **Data Source.** Choose **Enter a Custom Data Filter**, and enter a custom Kafka cluster filter. Examples: * For all Kafka clusters `messaging_cluster=*` - * For a specific cluster: `messaging_cluster=Kafka.dev.01`.
 + * For a specific cluster: `messaging_cluster=Kafka.dev.01`. * Clusters within a specific environment: `messaging_cluster=Kafka-1 and environment=prod`. This assumes you have set the optional environment tag while configuring collection. 4. **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. 5. Click **Add to Library**. diff --git a/docs/integrations/containers-orchestration/kubernetes.md b/docs/integrations/containers-orchestration/kubernetes.md index 22c4234b09..da2af7a056 100644 --- a/docs/integrations/containers-orchestration/kubernetes.md +++ b/docs/integrations/containers-orchestration/kubernetes.md @@ -123,7 +123,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability in Sumo Logic using [these instructions](/docs/manage/security/access-keys). There, you'll need to identify which deployment your Sumo Logic account is in ([learn more](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)). +1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). There, you'll need to identify which deployment your Sumo Logic account is in ([learn more](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)). 1. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 1. Download the Sumo Logic Terraform package for Kubernetes alerts. The alerts package is available in the [Sumo Logic GitHub repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/kubernetes). You can either download it through the `git clone` command or as a zip file. 1. **Alert Configuration**. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/kubernetes/`. diff --git a/docs/integrations/containers-orchestration/rabbitmq.md b/docs/integrations/containers-orchestration/rabbitmq.md index 0b8d728b30..a53acbcc89 100644 --- a/docs/integrations/containers-orchestration/rabbitmq.md +++ b/docs/integrations/containers-orchestration/rabbitmq.md @@ -389,7 +389,7 @@ There are limits to how many alerts can be enabled. For more information, see [M #### Method B: Install Monitors using a Terraform script -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. 3. Download the Sumo Logic Terraform package for MySQL monitors: The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/mysql). You can either download it using the git clone command or as a zip file. 4. Alert Configuration: After extracting the package, navigate to the terraform-sumologic-sumo-logic-monitor/monitor_packages/RabbitMQ/ directory. diff --git a/docs/integrations/databases/cassandra.md b/docs/integrations/databases/cassandra.md index b940eb2fe8..1dd12df004 100644 --- a/docs/integrations/databases/cassandra.md +++ b/docs/integrations/databases/cassandra.md @@ -551,7 +551,7 @@ There are limits to how many alerts can be enabled. For more information, see [M ### Method B: Using a Terraform script -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later and install it. 3. Download the Sumo Logic Terraform package for Cassandra monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Memcached). You can either download it using the git clone command or as a zip file. 4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Cassandra/` directory. diff --git a/docs/integrations/databases/couchbase.md b/docs/integrations/databases/couchbase.md index 8e1b832081..16a8ae1b30 100644 --- a/docs/integrations/databases/couchbase.md +++ b/docs/integrations/databases/couchbase.md @@ -233,7 +233,7 @@ The process to set up collection for Couchbase data is done through the followin The Sumo Logic Couchbase app supports the audit log, query log, error log, access log. For details, [refer to Couchbase logging documentation](https://docs.couchbase.com/server/current/manage/manage-logging/manage-logging.html#changing-log-file-locations). -1. **Configure logging in Couchbase**. By default, the Couchbase will write the log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/opt/couchbase/var/lib/couchbase/logs`. By default, the Audit log is disabled, you must enable the audit log following these [instructions](https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html). Query log, error log, the access log will be enabled by default. +1. **Configure logging in Couchbase**. By default, the Couchbase will write the log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/opt/couchbase/var/lib/couchbase/logs`. By default, the Audit log is disabled, you must enable the audit log following [these instructions](https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html). Query log, error log, the access log will be enabled by default. 2. **Configure a Collector**. Use one of the following Sumo Logic Collector options: 1. To collect logs directly from the Couchbase machine, configure an [Installed Collector](/docs/send-data/installed-collectors). 2. If you're using a service like Fluentd, or you would like to upload your logs manually, configure a [Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector). @@ -408,7 +408,7 @@ There are limits to how many alerts can be enabled - see the [Alerts FAQ](/docs/ ### Method B: Using a Terraform script method -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using [these instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later**. 3. **Download the Sumo Logic Terraform package for Couchbase alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/SquidProxy). You can either download it through the “git clone” command or as a zip file. 4. **Alert Configuration**. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Couchbase/` diff --git a/docs/integrations/databases/elasticsearch.md b/docs/integrations/databases/elasticsearch.md index ee9213ecf6..593dec59a2 100644 --- a/docs/integrations/databases/elasticsearch.md +++ b/docs/integrations/databases/elasticsearch.md @@ -389,7 +389,7 @@ To install these monitors, you must have the **Manage Monitors** role capability ### Method 2: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. 3. Download the Sumo Logic Terraform package for Elasticsearch monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Elasticsearch). You can either download it using the git clone command or as a zip file. 4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory. diff --git a/docs/integrations/databases/mariadb.md b/docs/integrations/databases/mariadb.md index eb266c11a0..9abb1c08ff 100644 --- a/docs/integrations/databases/mariadb.md +++ b/docs/integrations/databases/mariadb.md @@ -455,7 +455,7 @@ Sumo Logic has provided out-of-the-box alerts available through [Sumo Logic moni ### Method B: Using a Terraform script -1. **Generate a Sumo Logic access key and ID.** Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) +1. **Generate a Sumo Logic access key and ID.** Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) 2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html)** or later. 3. **Download the Sumo Logic Terraform package for MariaDB alerts.** The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/MariaDB). You can either download it through the “git clone” command or as a zip file. 4. **Alert Configuration.** After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/MariaDB/`. Edit the **MariaDB.auto.tfvars** file and add the Sumo Logic Access Key, Access Id, and Deployment from Step 1. diff --git a/docs/integrations/databases/memcached.md b/docs/integrations/databases/memcached.md index 8942032c21..f2c984678f 100644 --- a/docs/integrations/databases/memcached.md +++ b/docs/integrations/databases/memcached.md @@ -381,7 +381,7 @@ There are limits to how many alerts can be enabled. For more information, see [M ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install. 3. Download the Sumo Logic Terraform package for Memcached monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Memcached). You can either download it using the git clone command or as a zip file. 4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Memcached/` directory. diff --git a/docs/integrations/databases/mongodb.md b/docs/integrations/databases/mongodb.md index a05f932a58..233b3da29d 100644 --- a/docs/integrations/databases/mongodb.md +++ b/docs/integrations/databases/mongodb.md @@ -435,7 +435,7 @@ There are limits to how many alerts can be enabled. For more information, see [M ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. 3. Download the Sumo Logic Terraform package for MongoDB monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/MongoDB). You can either download it using the `git clone` command or as a zip file. 4. Alert Configuration. After extracting the package , navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/MongoDB/` directory. Edit the `MongoDB.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). diff --git a/docs/integrations/databases/mysql.md b/docs/integrations/databases/mysql.md index edfdadf2e6..9be203eb30 100644 --- a/docs/integrations/databases/mysql.md +++ b/docs/integrations/databases/mysql.md @@ -583,7 +583,7 @@ There are limits to how many alerts can be enabled. For more information, see [M ### Method B: Using a Terraform script -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. 3. Download the Sumo Logic Terraform package for MySQL monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/mysql). You can either download it using the `git clone` command or as a zip file. 4. Alert Configuration: After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/mysql/` directory. diff --git a/docs/integrations/databases/opentelemetry/couchbase-opentelemetry.md b/docs/integrations/databases/opentelemetry/couchbase-opentelemetry.md index a4d27a7cf3..8d8e559810 100644 --- a/docs/integrations/databases/opentelemetry/couchbase-opentelemetry.md +++ b/docs/integrations/databases/opentelemetry/couchbase-opentelemetry.md @@ -32,7 +32,7 @@ Following are the [Fields](/docs/manage/fields/) which will be created as part o ## Prerequisite -By default, the Couchbase will write the log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/opt/couchbase/var/lib/couchbase/logs`. By default, the Audit log is disabled, you must enable the audit log following these [instructions](https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html). Query log, error log, the access log will be enabled by default. +By default, the Couchbase will write the log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/opt/couchbase/var/lib/couchbase/logs`. By default, the Audit log is disabled, you must enable the audit log following [these instructions](https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html). Query log, error log, the access log will be enabled by default. import LogsCollectionPrereqisites from '../../../reuse/apps/logs-collection-prereqisites.md'; diff --git a/docs/integrations/databases/oracle.md b/docs/integrations/databases/oracle.md index 79f50370eb..ee930d0487 100644 --- a/docs/integrations/databases/oracle.md +++ b/docs/integrations/databases/oracle.md @@ -499,7 +499,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later**. 3. **Download the Sumo Logic Terraform package for Oracle alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Oracle). You can either download it through the “git clone” command or as a zip file. 4. **Alert Configuration**. After the package has been extracted, navigate to the package directory **terraform-sumologic-sumo-logic-monitor/monitor_packages/Oracle/**. Edit the **Oracle.auto.tfvars** file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1. diff --git a/docs/integrations/databases/postgresql.md b/docs/integrations/databases/postgresql.md index 17f24e0723..d3b8a7001e 100644 --- a/docs/integrations/databases/postgresql.md +++ b/docs/integrations/databases/postgresql.md @@ -428,7 +428,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Please identify which deployment your Sumo Logic account is in, using this [ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using this [ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for PostgreSQL alerts: The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/postgresql). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**postgresql**/ diff --git a/docs/integrations/databases/redis.md b/docs/integrations/databases/redis.md index 3933ea3880..0384642472 100644 --- a/docs/integrations/databases/redis.md +++ b/docs/integrations/databases/redis.md @@ -464,9 +464,9 @@ Monitors are disabled by default. Once you have installed the alerts via this me ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using[ these](/docs/manage/security/access-keys#from-the-preferences-page) instructions. Please identify which deployment your Sumo Logic account is in,[ using](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) this link. +1. Generate a Sumo Logic access key and ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. -3. Download the Sumo Logic Terraform package for Redis alerts. The alerts package is available in the Sumo Logic github[ repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/redis). You can either download it via the “git clone” command or as a zip file. +3. Download the Sumo Logic Terraform package for Redis alerts. The alerts package is available in the Sumo Logic github [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/redis). You can either download it via the “git clone” command or as a zip file. 4. Monitor Configuration. After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/**redis**/ Edit the redis.auto.tfvars file and add the Sumo Logic Access Key, Access Id and Deployment from Step 1. diff --git a/docs/integrations/hosts-operating-systems/host-process-metrics.md b/docs/integrations/hosts-operating-systems/host-process-metrics.md index 6c55a5a72b..7386b7b715 100644 --- a/docs/integrations/hosts-operating-systems/host-process-metrics.md +++ b/docs/integrations/hosts-operating-systems/host-process-metrics.md @@ -199,7 +199,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using [these instructions](/docs/manage/security/access-keys#from-the-preferences-page). Please identify which deployment your Sumo Logic account is in, using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using [this link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 1. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 1. **Download the Sumo Logic Terraform package for Host and Process alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/postgresql). You can either download it through the “git clone” command or as a zip file. 1. **Alert Configuration**. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/host_process_metrics/`. Edit the `host_and_processes.auto.tfvars` file and add the Sumo Logic Access Key, Access Id, and Deployment from Step 1. diff --git a/docs/integrations/microsoft-azure/microsoft-graph-identity-protection.md b/docs/integrations/microsoft-azure/microsoft-graph-identity-protection.md index aee67d0dc4..068a5a5b55 100644 --- a/docs/integrations/microsoft-azure/microsoft-graph-identity-protection.md +++ b/docs/integrations/microsoft-azure/microsoft-graph-identity-protection.md @@ -120,16 +120,33 @@ _sourceCategory=msgip-app-src riskEventType | count(risk_id) by risk_level | sort by _count ``` +## Collection configuration and app installation -## Collecting logs for Microsoft Graph Identity Protection API +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -This section explains how to collect logs from Microsoft Graph Identity Protection API and ingest them into Sumo Logic. For details, see [Cloud-to-Cloud-Integration for Microsoft Graph Identity Protection Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source/) to create the source and use the same source category while installing the app. + -## Installing the Microsoft Graph Identity Protection app +:::important +Use the [Cloud-to-Cloud Integration for Microsoft Graph Identity Protection](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Microsoft Graph Identity Protection app is properly integrated and configured to collect and analyze your Microsoft Graph Identity Protection data. +::: -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +### Create a new collector and install the app - +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Microsoft Graph Identity Protection dashboards diff --git a/docs/integrations/microsoft-azure/sql-server.md b/docs/integrations/microsoft-azure/sql-server.md index ac8ea155ba..85c082de31 100644 --- a/docs/integrations/microsoft-azure/sql-server.md +++ b/docs/integrations/microsoft-azure/sql-server.md @@ -451,7 +451,7 @@ The monitors are disabled by default. Once you have installed the alerts using t **Step 1: Generate a Sumo Logic access key and ID** -Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Please identify which deployment your Sumo Logic account is in, using this [ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using this [ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). **Step 2: [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later** diff --git a/docs/integrations/pci-compliance/opentelemetry/linux-opentelemetry.md b/docs/integrations/pci-compliance/opentelemetry/linux-opentelemetry.md index d8b05269ad..6119e94a34 100644 --- a/docs/integrations/pci-compliance/opentelemetry/linux-opentelemetry.md +++ b/docs/integrations/pci-compliance/opentelemetry/linux-opentelemetry.md @@ -220,3 +220,17 @@ Use this dashboard to: - Monitor actions performed by users with administrative privileges. PCI Compliance for Linux dashboards + +## Create monitors for PCI Compliance for Linux app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### PCI Compliance for Linux alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `PCI Linux - Excessive Failed Authentication` | This alert is triggered when multiple failed login attempts are detected over a 5-minute period, indicating potential brute force attempts and addressing PCI Requirement `10.2.4` for invalid logical access attempts. | Count > 5 | Count < = 5 | +| `PCI Linux - Privileged User Account Changes` | This alert is triggered when privileged user accounts (UID < 1000 or root accounts) are created, deleted, or modified, addressing PCI Requirement `10.2.5` for changes to identification and authentication mechanisms. | Count > 0 | Count < = 0 | +| `PCI Linux - Unauthorized Sudo Elevation` | This alert is triggered when unauthorized users attempt to use sudo is detected, which addresses PCI Requirement `7.2.0` for implementing an access control system among system components with multiple users. | Count > 2 | Count < = 2 | diff --git a/docs/integrations/pci-compliance/opentelemetry/windows-json-opentelemetry.md b/docs/integrations/pci-compliance/opentelemetry/windows-json-opentelemetry.md index 4fc895031c..0c38f2ede8 100644 --- a/docs/integrations/pci-compliance/opentelemetry/windows-json-opentelemetry.md +++ b/docs/integrations/pci-compliance/opentelemetry/windows-json-opentelemetry.md @@ -264,3 +264,19 @@ Track user activities such as password changes, password resets, excessive faile Track your Windows Update activities. Windows - PCI Req 06 - Windows Updates Activity + +## Create monitors for PCI Compliance For Windows JSON app + +import CreateMonitors from '../../../reuse/apps/create-monitors.md'; + + + +### PCI Compliance For Windows JSON alerts + +| Name | Description | Alert Condition | Recover Condition | +|:--|:--|:--|:--| +| `Windows PCI - Critical Policy Changes` | This alert is triggered when modifications to security policies or audit policies are detected, indicating potential changes to the system's security posture. It supports PCI DSS Requirements `10.2.2` (track changes to system-level objects) and `10.2.5.b` (track use of identification and authentication mechanisms). | Count >= 1 | Count < 1 | +| `Windows PCI - Excessive Failed Login Attempts` | This alert is triggered when there are multiple authentication failures detected across Windows environments. These are monitored across different authentication mechanisms like local Windows authentication, Kerberos, and network logons. It correlates failure patterns with specific error codes to identify potential security threats such as password guessing, account enumeration, or attempts to access disabled accounts. This helps security teams differentiate between benign issues and malicious activities. | Count >= 5 | Count < 5 | +| `Windows PCI - Failed Windows Updates` | This alert is triggered when Windows update failures are detected, which could leave systems vulnerable to known exploits. It aligns with PCI DSS Requirement `6.2.0` for installing critical security patches within one month of release. | Count > = 3 | Count < 3 | +| `Windows PCI - Security Audit Log Tampering` | This alert is triggered when attempt is detected to clear or tamper with Windows security audit logs, indicating potential attempts to hide malicious activities. It supports PCI DSS Requirements `10.2.0` (implement automated audit trails) and `10.3.0` (record audit trail entries). | Count > = 1 | Count < 1 | +| `Windows PCI - User Account State Change` | This alert is triggered when critical user account state changes are detected, including account creation, deletion, enablement, and disablement. This supports PCI DSS Requirement 8.1.3 for immediately revoking access for terminated users. | Count > = 1 | Count < 1 | diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md index d57beb4a3d..dabc05ca33 100644 --- a/docs/integrations/product-list/product-list-a-l.md +++ b/docs/integrations/product-list/product-list-a-l.md @@ -300,7 +300,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | Logo | Vendors and Products | Integrations | | :-- | :-- | :-- | -| Thumbnail icon | [Jamf](https://www.jamf.com/) | Automation integration: [Jamf](/docs/platform-services/automation-service/app-central/integrations/jamf/)
Cloud SIEM integration: [Jamf](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/3fe48850-f882-43c3-ab80-1e0354cf2aba.md)
Community app: [Sumo Logic for JAMF](https://github.com/SumoLogic/sumologic-content/tree/master/JAMF)
Partner integration: [Jamf Protect App for Sumo Logic](https://github.com/SumoLogic/sumologic-public-partner-apps/tree/master/JamfProtect)
Collector: [Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source) | +| Thumbnail icon | [Jamf](https://www.jamf.com/) | App: [Jamf](/docs/integrations/saas-cloud/jamf)
Automation integration: [Jamf](/docs/platform-services/automation-service/app-central/integrations/jamf/)
Cloud SIEM integration: [Jamf](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/3fe48850-f882-43c3-ab80-1e0354cf2aba.md)
Community app: [Sumo Logic for JAMF](https://github.com/SumoLogic/sumologic-content/tree/master/JAMF)
Partner integration: [Jamf Protect App for Sumo Logic](https://github.com/SumoLogic/sumologic-public-partner-apps/tree/master/JamfProtect)
Collector: [Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source) | | Thumbnail icon | [Jenkins](https://www.jenkins.io/) | App: [Jenkins](/docs/integrations/app-development/jenkins/) | | Thumbnail icon | [JFrog Artifactory](https://jfrog.com/artifactory/) | Apps:
- [Artifactory (6 and 7) - Classic](/docs/integrations/app-development/jfrog-artifactory/)
- [Artifactory - OpenTelemetry](/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry/) | | Thumbnail icon | [JFrog Xray](https://jfrog.com/help/r/get-started-with-the-jfrog-platform/jfrog-xray) | App: [JFrog Xray](/docs/integrations/app-development/jfrog-xray/)
Collector: [JFrog Xray Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jfrog-xray-source/) | diff --git a/docs/integrations/product-list/product-list-m-z.md b/docs/integrations/product-list/product-list-m-z.md index b59fd2f96d..1fe816c309 100644 --- a/docs/integrations/product-list/product-list-m-z.md +++ b/docs/integrations/product-list/product-list-m-z.md @@ -162,7 +162,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [ | Thumbnail icon | [Sucuri](https://sucuri.net/) | Cloud SIEM integration: [Sucuri](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/cdfd2ba0-77eb-4e11-b071-6f4d01fda607.md) | | Thumbnail icon | [Sumo Logic](https://www.sumologic.com/) | Apps:
- [Enterprise Audit - Cloud SIEM](/docs/integrations/sumo-apps/cse/)
- [Flex](/docs/integrations/sumo-apps/flex/)
- [Sumo Logic Audit App](/docs/integrations/sumo-apps/audit/)
- [Sumo Logic Data Volume App](/docs/integrations/sumo-apps/data-volume/)
- [Sumo Logic Enterprise Audit Apps](/docs/integrations/sumo-apps/enterprise-audit/) (multiple apps)
- [Sumo Logic Enterprise Search Audit App](/docs/integrations/sumo-apps/enterprise-search-audit/)
- [Sumo Logic Infrequent Data Tier App](/docs/integrations/sumo-apps/infrequent-data-tier/)
- [Sumo Logic Log Analysis QuickStart App](/docs/integrations/sumo-apps/log-analysis-quickstart/)
- [Sumo Logic Security Analytics App](/docs/integrations/sumo-apps/security-analytics/)
Automation integrations:
- [Automation Tools](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-automation-tools/)
- [Basic Tools](/docs/platform-services/automation-service/app-central/integrations/basic-tools/)
- [ESMTP](/docs/platform-services/automation-service/app-central/integrations/esmtp/)
- [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools/)
- [Incident Tools](/docs/platform-services/automation-service/app-central/integrations/incident-tools/)
- [IMAP](/docs/platform-services/automation-service/app-central/integrations/imap/)
- [Mail Tools](/docs/platform-services/automation-service/app-central/integrations/mail-tools/)
- [POP3](/docs/platform-services/automation-service/app-central/integrations/pop3/)
- [SMTP V3](/docs/platform-services/automation-service/app-central/integrations/smtp-v3/)
- [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/)
- [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/)
- [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/)
- [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/)
- [Sumo Logic Notifications](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications/)
- [Sumo Logic Notifications by Gmail](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications-by-gmail/)
- [Sumo Logic Notifications by Microsoft](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications-by-microsoft)
- [Triage Tools](/docs/platform-services/automation-service/app-central/integrations/triage-tools/)
- [ZIP Tools](/docs/platform-services/automation-service/app-central/integrations/zip-tools/)
Cloud SIEM integration: [Sumo Logic](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/34A5019C-7BEC-4BF8-A3B7-C38D567126C6.md)
Collector: [Universal Connector](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/universal-connector-source)
Community app: [Cloud Security Posture Management (CSPM) for Sumo Logic](https://github.com/SumoLogic/sumologic-content/tree/master/CSPM) | | Thumbnail icon | [Superwise](https://superwise.ai/) | Webhook: [Superwise](/docs/integrations/webhooks/superwise/) | -| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App: [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/)
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/)
Cloud SIEM integration: [Symantec](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/64c7f49c-f95a-4f4a-8540-56ec5fb1d96b.md)
Community app: [Sumo Logic for Symantec WSS](https://github.com/SumoLogic/sumologic-content/tree/master/Symantec/WSS) | +| Thumbnail icon | [Symantec](https://sep.securitycloud.symantec.com/v2/landing) | App:
- [Symantec Endpoint Security Service](/docs/integrations/saas-cloud/symantec-endpoint-security-service/)
- [Symantec Web Security Service](/docs/integrations/saas-cloud/symantec-web-security-service/)
Automation integrations:
- [Javelin AD Protect](/docs/platform-services/automation-service/app-central/integrations/javelin-ad-protect/)
- [Symantec DeepSight](/docs/platform-services/automation-service/app-central/integrations/symantec-deepsight/)
- [Symantec EDR](/docs/platform-services/automation-service/app-central/integrations/symantec-edr/)
- [Symantec Endpoint Protection](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection/)
- [Symantec Endpoint Protection Cloud](/docs/platform-services/automation-service/app-central/integrations/symantec-endpoint-protection-cloud/)
- [Symantec Secure Web Gateway (Bluecoat)](/docs/platform-services/automation-service/app-central/integrations/symantec-secure-web-gateway-bluecoat/)
- [Symantec WebPulse](/docs/platform-services/automation-service/app-central/integrations/symantec-webpulse/)
Collectors:
- [Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/)
- [Symantec Web Security Service Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source/)
- [Symantec Proxy Secure Gateway - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway/)
- [Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy/)
Cloud SIEM integration: [Symantec](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/64c7f49c-f95a-4f4a-8540-56ec5fb1d96b.md)
Community app: [Sumo Logic for Symantec WSS](https://github.com/SumoLogic/sumologic-content/tree/master/Symantec/WSS) | | Thumbnail icon | [Sysdig](https://sysdig.com/) | Cloud SIEM integration: [Sysdig](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/c4de0854-e718-45e1-a4c8-63623755aa43.md) | | Thumbnail icon | [syslog-ng](https://www.syslog-ng.com/) | Automation integration: [Syslog-NG](/docs/platform-services/automation-service/app-central/integrations/syslog-ng/)
Collector: [syslog-ng](/docs/send-data/hosted-collectors/cloud-syslog-source/syslog-ng/) | diff --git a/docs/integrations/saas-cloud/armis.md b/docs/integrations/saas-cloud/armis.md index a1ff80e4ee..a481dac548 100644 --- a/docs/integrations/saas-cloud/armis.md +++ b/docs/integrations/saas-cloud/armis.md @@ -183,15 +183,33 @@ _sourceCategory=ArmisDashboards id | count_distinct(id) ``` -## Collecting logs for Armis API +## Collection configuration and app installation -This section explains how to collect logs from Armis API and ingest them into Sumo Logic. Refer to the [Armis API Cloud-to-Cloud Integration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/armis-api-source/) to create the source and use the same source category while installing the app. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Armis app + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Armis](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/armis-api-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Armis app is properly integrated and configured to collect and analyze your Armis data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing the Armis dashboards diff --git a/docs/integrations/saas-cloud/asana.md b/docs/integrations/saas-cloud/asana.md index 6e081eede4..ea657d1554 100644 --- a/docs/integrations/saas-cloud/asana.md +++ b/docs/integrations/saas-cloud/asana.md @@ -63,15 +63,33 @@ _sourceCategory="asana-app" | sort by frequency ``` -## Set up collection +## Collection configuration and app installation -To set up [Cloud-to-Cloud Integration Asana Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/asana-source/) for the Asana app, follow the instructions provided. These instructions will guide you through the process of creating a source using the Asana Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Asana app is properly integrated and configured to collect and analyze your Asana data. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Asana app + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Asana](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/asana-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Asana app is properly integrated and configured to collect and analyze your Asana data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Asana dashboards diff --git a/docs/integrations/saas-cloud/cisco-umbrella.md b/docs/integrations/saas-cloud/cisco-umbrella.md index 5f91ad8c5a..01b904574c 100644 --- a/docs/integrations/saas-cloud/cisco-umbrella.md +++ b/docs/integrations/saas-cloud/cisco-umbrella.md @@ -56,9 +56,16 @@ The Cisco Umbrella app offers logging to Amazon S3 as it has the ability to uplo options aws s3 cisco -:::note -If you're collecting from a Cisco Umbrella bucket, SNS Subscription Endpoint is not supported. For more information, see important note on using the [Sumo Logic Amazon S3 source for the Cisco-Managed S3 bucket](/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source/#cisco-umbrella) -::: +Collection from a Cisco-managed S3 bucket has the following limitations: + +* AWS versioned APIs are not supported. The **Use AWS versioned APIs** setting on the Source must be disabled. +* S3 Event Notifications Integration is not supported, so you cannot use an SNS subscription endpoint. +* Access must be provided with an Access ID and Key. Role-based access is not supported. +* Use a prefix in the path expression so it doesn't point to the root directory. +* Ensure that your path expression ends in `/*`. Otherwise, you will get a ListBucket error. For example: + * Bucket Name: `cisco-managed-us-east-1` + * Path Expression: `987654321_12e34c..../*` + By having all your logs uploaded to an S3 bucket, you can then download logs automatically to keep in perpetuity in backup storage. Or, ingest the logs through your SIEM or another security tool to determine if any security events in these Umbrella logs coincide with events in other security tools. @@ -99,4 +106,4 @@ import AppUpdate from '../../reuse/apps/app-update.md'; import AppUninstall from '../../reuse/apps/app-uninstall.md'; - \ No newline at end of file + diff --git a/docs/integrations/saas-cloud/digital-guardian-arc.md b/docs/integrations/saas-cloud/digital-guardian-arc.md index 7a2d175908..c54cfa636f 100644 --- a/docs/integrations/saas-cloud/digital-guardian-arc.md +++ b/docs/integrations/saas-cloud/digital-guardian-arc.md @@ -326,15 +326,33 @@ _sourceCategory="Labs/DigitalGuardian" | sort by frequency ``` -## Set up collection +## Collection configuration and app installation -To set up the [Digital Guardian Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/digital-guardian-source), follow the instructions provided. These instructions will guide you through the process of creating a source using the Digital Guardian Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Digital Guardian ARC app is properly integrated and configured to collect and analyze your Digital Guardian ARC data. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Digital Guardian ARC app​​ + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Digital Guardian ARC](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/digital-guardian-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Digital Guardian ARC app is properly integrated and configured to collect and analyze your Digital Guardian ARC data. +::: + +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; - + ## Viewing the Digital Guardian ARC dashboard diff --git a/docs/integrations/saas-cloud/docusign.md b/docs/integrations/saas-cloud/docusign.md index 70bc123dd4..7078caaf66 100644 --- a/docs/integrations/saas-cloud/docusign.md +++ b/docs/integrations/saas-cloud/docusign.md @@ -159,11 +159,33 @@ _sourceCategory="docusign_src" | transpose row _timeslice column severity as low, medium, high ``` -## Installing the DocuSign app +## Collection configuration and app installation -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; - + + +:::important +Use the [Cloud-to-Cloud Integration for DocuSign](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/docusign-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your DocuSign app is properly integrated and configured to collect and analyze your DocuSign data. +::: + +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing DocuSign dashboards diff --git a/docs/integrations/saas-cloud/dropbox.md b/docs/integrations/saas-cloud/dropbox.md index 10aa77d0c0..8daa5fc0d3 100644 --- a/docs/integrations/saas-cloud/dropbox.md +++ b/docs/integrations/saas-cloud/dropbox.md @@ -112,15 +112,33 @@ _sourceCategory="dropboxSource" | sort by _timeslice ``` -## Collecting logs for Dropbox app +## Collection configuration and app installation -This section provides instructions for setting up [Cloud-to-Cloud-Integration for Dropbox Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source) to create the source and use the same source category while installing the app. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Dropbox app + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Dropbox](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Dropbox app is properly integrated and configured to collect and analyze your Dropbox data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Dropbox dashboards diff --git a/docs/integrations/saas-cloud/druva-cyber-resilience.md b/docs/integrations/saas-cloud/druva-cyber-resilience.md index 707e891756..ab53e09383 100644 --- a/docs/integrations/saas-cloud/druva-cyber-resilience.md +++ b/docs/integrations/saas-cloud/druva-cyber-resilience.md @@ -60,17 +60,33 @@ _source="Milan_Druva_Cyber_Resilience_v0.0.1" | count ``` -## Set up collection +## Collection configuration and app installation -To set up [Cloud-to-Cloud Integration Druva Cyber Resilience Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-cyber-resilience-source) for the Druva Cyber Resilience app, follow the instructions provided. These instructions will guide you through the process of creating a source using the Druva Cyber Resilience source category, which you will need to use when installing the app. By following these steps, you can ensure that your Druva Cyber Resilience app is properly integrated and configured to collect and analyze your Druva Cyber Resilience data. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Druva Cyber Resilience app​ + -This section has instructions for installing the Druva app for Sumo Logic. +:::important +Use the [Cloud-to-Cloud Integration for Druva Cyber Resilience](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-cyber-resilience-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Druva Cyber Resilience app is properly integrated and configured to collect and analyze your Druva Cyber Resilience data. +::: -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +### Create a new collector and install the app - +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Druva Cyber Resilience dashboards​ diff --git a/docs/integrations/saas-cloud/druva.md b/docs/integrations/saas-cloud/druva.md index cb473578ae..f512cd40b5 100644 --- a/docs/integrations/saas-cloud/druva.md +++ b/docs/integrations/saas-cloud/druva.md @@ -71,15 +71,33 @@ _sourceCategory="druva_app" | count_distinct(user_id) ``` -## Set up collection +## Collection configuration and app installation -To set up [Cloud-to-Cloud Integration Druva Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-source/) for the Druva App, follow the instructions provided. These instructions will guide you through the process of creating a source using the Druva Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Druva App is properly integrated and configured to collect and analyze your Druva data. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Druva app​ + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Druva](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Druva app is properly integrated and configured to collect and analyze your Druva data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Druva dashboards​ @@ -87,15 +105,15 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md'; -### Druva Overview dashboard +### Overview The **Druva - Overview** dashboard in the Druva app provides a comprehensive view of the devices and cloud apps used by your organization. It includes widgets for unique user activities, device and app distribution, top users and administrators' details by device and event counts, and the trend of devices and apps over time. This dashboard is a powerful tool for monitoring activity, with the ability to detect and address potential security threats through the "failed events over time" widget. The "recent events details" widget offers a quick snapshot of the latest events. By using this dashboard, you can identify potential issues or anomalies, track changes in device and app usage, and gain a better understanding of events occurring in your organization's devices and cloud apps.
druva-overview -### Druva Alerts Overview dashboard +### Alerts Overview The **Druva - Alerts Overview** dashboard in the Druva app provides comprehensive widgets to analyze security threats and take proactive measures. It includes widgets for tracking alerts by location, severity, and frequency over time, as well as detailed information on unusual activity events and the top users generating alerts. The recent alerts widget provides a quick snapshot of the latest security activity. By using this dashboard, organizations can identify and respond to potential threats efficiently, safeguarding their data effectively.
druva-alerts-overview -### Druva Backup and Restore dashboard +### Backup and Restore The **Druva - Backup and Restore Overview** dashboard offers a comprehensive view of backup, restore, and download events, providing valuable insights into your organization's data protection activities. The dashboard's widgets allow you to track and analyze these events, including the count and distribution of backup, restore, and download activities. You can closely monitor the most active users using the top users performing backup/restore activity widget. diff --git a/docs/integrations/saas-cloud/gmail-tracelogs.md b/docs/integrations/saas-cloud/gmail-tracelogs.md index 200b14f2b8..ca207557b0 100644 --- a/docs/integrations/saas-cloud/gmail-tracelogs.md +++ b/docs/integrations/saas-cloud/gmail-tracelogs.md @@ -135,16 +135,33 @@ _sourceCategory=Labs/GmailTraceLogs | count by message_set_type | sort by _count ``` +## Collection configuration and app installation -## Collecting logs for Gmail Trace Logs app +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -This section provides instructions for setting up [Cloud-to-Cloud-Integration for Gmail Trace Logs App](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/gmail-tracelogs-source.md) to create the source and use the same source category while installing the app. + -## Installing the Gmail Trace Logs app +:::important +Use the [Cloud-to-Cloud Integration for Gmail Trace Logs](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/gmail-tracelogs-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Gmail Trace Logs app is properly integrated and configured to collect and analyze your Gmail Trace Logs data. +::: -import AppInstall from '../../reuse/apps/app-install.md'; +### Create a new collector and install the app - +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Gmail Trace Logs Dashboards diff --git a/docs/integrations/saas-cloud/index.md b/docs/integrations/saas-cloud/index.md index e8077e6d27..0f0944ec49 100644 --- a/docs/integrations/saas-cloud/index.md +++ b/docs/integrations/saas-cloud/index.md @@ -165,6 +165,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.

Gain visibility into your Istio and control plane component performance.

+
+
+ icon

Jamf

 +

Get critical insights into your organization's Jamf environment.

+
+
icon

Kandji

 @@ -297,7 +303,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.

Identify security threats by analyzing alerts and events logs.

- +
+
+ icon

Symantec Endpoint Security Service

 +

Gain insights into the log data and identify potential security threats.

+
+
icon

Symantec Web Security Service

 diff --git a/docs/integrations/saas-cloud/microsoft-exchange-trace-logs.md b/docs/integrations/saas-cloud/microsoft-exchange-trace-logs.md index 2987cd8ca9..3727e69080 100644 --- a/docs/integrations/saas-cloud/microsoft-exchange-trace-logs.md +++ b/docs/integrations/saas-cloud/microsoft-exchange-trace-logs.md @@ -87,16 +87,33 @@ _sourceCategory="o365dummy" | fillmissing timeslice, values all in status | transpose row _timeslice column status ``` +## Collection configuration and app installation -## Collecting logs from Microsoft Exchange Trace Logs App +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -This section explains how to collect logs from Microsoft Exchange Trace logs Api and ingest them into Sumo Logic. Refer to the [Microsoft Exchange Trace Logs API Cloud-to-Cloud Integration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-exchange-trace-logs) to create the source and use the same source category while installing the app. + -## Installing the Microsoft Exchange Trace Logs app +:::important +Use the [Cloud-to-Cloud Integration for Microsoft Exchange Trace Logs](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-exchange-trace-logs) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Microsoft Exchange Trace Logs app is properly integrated and configured to collect and analyze your Microsoft Exchange Trace Logs data. +::: -import AppInstall from '../../reuse/apps/app-install.md'; +### Create a new collector and install the app - +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Microsoft Exchange Trace Logs Dashboards diff --git a/docs/integrations/saas-cloud/miro.md b/docs/integrations/saas-cloud/miro.md index 5ee6b59c98..c5d494c01b 100644 --- a/docs/integrations/saas-cloud/miro.md +++ b/docs/integrations/saas-cloud/miro.md @@ -65,15 +65,33 @@ _sourceCategory=miro | count_distinct (id) ``` -## Set up collection +## Collection configuration and app installation -Follow the instructions for setting up [Cloud-to-Cloud Integration for Miro](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/miro-source/) source and use the same source category while installing the app. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Miro app + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Miro](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/miro-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Miro app is properly integrated and configured to collect and analyze your Miro data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Miro dashboards​ diff --git a/docs/integrations/saas-cloud/zendesk.md b/docs/integrations/saas-cloud/zendesk.md index 7e90dada9d..b48a25b7ca 100644 --- a/docs/integrations/saas-cloud/zendesk.md +++ b/docs/integrations/saas-cloud/zendesk.md @@ -53,15 +53,33 @@ _sourceCategory="Labs/Zendesk" | count ``` -## Set up collection +## Collection configuration and app installation -To set up the [Zendesk Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zendesk-source) for the Zendesk app, follow the instructions provided. These instructions will guide you through the process of creating a source using the Zendesk Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Zendesk app is properly integrated and configured to collect and analyze your Zendesk data. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the Zendesk app​ + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for Zendesk](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zendesk-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Zendesk app is properly integrated and configured to collect and analyze your Zendesk data. +::: + +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app - +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing Zendesk dashboards​​ @@ -88,7 +106,6 @@ The Zendesk Monitors serve as a security tool, concentrating on observing essent | `Zendesk - Audits from Risky Locations` | This alert is triggered when audit events, such as user actions or configuration changes are performed from geographical locations identified as high-risk. These risky locations may correlate with regions known for cyberattacks or unauthorized activity, making it crucial to investigate these events for potential security risks. | Critical | Count > 0 | | `Zendesk - Impossible Login Events` | This alert notifies you of login attempts that are classified as *impossible*. This could mean logins from multiple geographically distant locations within a short time frame or logins from suspicious devices. Impossible login events often signal a compromise in account security, warranting immediate investigation to ensure no unauthorized access has occurred | Critical | Count > 0| - ## Upgrading the Zendesk app (Optional) import AppUpdate from '../../reuse/apps/app-update.md'; diff --git a/docs/integrations/security-threat-detection/sailpoint.md b/docs/integrations/security-threat-detection/sailpoint.md index 4ea023572c..3903e126ae 100644 --- a/docs/integrations/security-threat-detection/sailpoint.md +++ b/docs/integrations/security-threat-detection/sailpoint.md @@ -107,15 +107,33 @@ _sourceCategory=Labs/sailpoint | sort by _count ``` -## Set up collection +## Collection configuration and app installation -Follow the instructions for setting up [Cloud-to-Cloud Integration for SailPoint App](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source) to create the source and use the same source category while installing the app. +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; -## Installing the SailPoint app + -import AppInstall2 from '../../reuse/apps/app-install-v2.md'; +:::important +Use the [Cloud-to-Cloud Integration for SailPoint](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your SailPoint app is properly integrated and configured to collect and analyze your SailPoint data. +::: - +### Create a new collector and install the app + +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; + + + +### Use an existing collector and install the app + +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; + + + +### Use an existing source and install the app + +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; + + ## Viewing SailPoint dashboards diff --git a/docs/integrations/web-servers/apache-tomcat.md b/docs/integrations/web-servers/apache-tomcat.md index 86d5ec8f09..6802fb25a0 100644 --- a/docs/integrations/web-servers/apache-tomcat.md +++ b/docs/integrations/web-servers/apache-tomcat.md @@ -625,7 +625,7 @@ Custom filter examples: Step 1: Generate a Sumo Logic access key and ID -Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys). Step 2: Download and install Terraform @@ -737,11 +737,11 @@ Locate and install the app you need from the **App Catalog**. If you want to see Version selection is not available for all apps. ::: 3. To install the app, complete the following fields. - 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app.
 + 1. **App Name.** You can retain the existing name, or enter a name of your choice for the app. 2. **Data Source.** * Choose **Enter a Custom Data Filter**, and enter a custom filter for Apache Tomcat webserver farm. Examples: * For all Apache Tomcat webserver farms webserver_farm=* - * For a specific webserver farms: webserver_farm=tomcat.dev.01.
 + * For a specific webserver farms: webserver_farm=tomcat.dev.01. * Clusters within a specific environment: `webserver_farm=tomcat-1 and environment=prod`. (This assumes you have set the optional environment tag while configuring collection) 4. **Advanced**. Select the **Location in Library** (the default is the Personal folder in the library), or click **New Folder** to add a new folder. 5. Click **Add to Library**. diff --git a/docs/integrations/web-servers/apache.md b/docs/integrations/web-servers/apache.md index 7915977f60..aa143f44dc 100644 --- a/docs/integrations/web-servers/apache.md +++ b/docs/integrations/web-servers/apache.md @@ -465,7 +465,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Please identify which deployment your Sumo Logic account is in, using this[ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Please identify which deployment your Sumo Logic account is in, using this[ link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for Apache alerts. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/apache). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration. After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/apache/`. diff --git a/docs/integrations/web-servers/haproxy.md b/docs/integrations/web-servers/haproxy.md index 23b1555f19..f9042e3b41 100644 --- a/docs/integrations/web-servers/haproxy.md +++ b/docs/integrations/web-servers/haproxy.md @@ -455,7 +455,7 @@ However, if you would like to restrict these alerts to specific clusters or envi ### Method 2: Use a Terraform script -1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate an access key and access ID for a user that has the **Manage Monitors** role capability. For instructions see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it. 3. Download the Sumo Logic Terraform package for HAProxy monitors. The alerts package is available in the [Sumo Logic GitHub repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages). You can either download it using the git clone command or as a zip file. 4. Alert Configuration. After extracting the package, navigate to the terraform-sumologic-sumo-logic-monitor/monitor_packages/haproxy/ directory. Edit the haproxy.auto.tfvars file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). diff --git a/docs/integrations/web-servers/iis-10.md b/docs/integrations/web-servers/iis-10.md index 9705cacd33..7d8ed520d4 100644 --- a/docs/integrations/web-servers/iis-10.md +++ b/docs/integrations/web-servers/iis-10.md @@ -436,7 +436,7 @@ Monitors are disabled by default. Once you have installed the alerts using this ### Method B: Using a Terraform script -1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. **Generate a Sumo Logic access key and ID**. Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. **Download and install Terraform**. You'll need to [download and install Terraform](https://www.terraform.io/downloads.html), version 0.13 or later. 3. **Download the Sumo Logic Terraform package for IIS Server alerts**. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/IIS). You can either download it through the “git clone” command or as a zip file. 4. **Alert Configuration**. After the package has been extracted, navigate to the package directory **terraform-sumologic-sumo-logic-monitor/monitor_packages/IIS/**. diff --git a/docs/integrations/web-servers/nginx-ingress.md b/docs/integrations/web-servers/nginx-ingress.md index 87c6e34104..527cb3ecf0 100644 --- a/docs/integrations/web-servers/nginx-ingress.md +++ b/docs/integrations/web-servers/nginx-ingress.md @@ -115,7 +115,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. Generate a Sumo Logic access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate a Sumo Logic access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for Nginx Ingress alerts: The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Nginx%20Ingress). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/Nginx Ingress. diff --git a/docs/integrations/web-servers/nginx-plus-ingress.md b/docs/integrations/web-servers/nginx-plus-ingress.md index c6dd8fa3c3..e16f834ec5 100644 --- a/docs/integrations/web-servers/nginx-plus-ingress.md +++ b/docs/integrations/web-servers/nginx-plus-ingress.md @@ -133,7 +133,7 @@ The monitors are disabled by default. Once you have installed the alerts via thi ### Method B: Using a Terraform script -1. Generate a Sumo Logic [access key](/docs/manage/security/access-keys#from-the-preferences-page) and access ID for a user that has the[ Manage Monitors](/docs/manage/users-roles/roles/role-capabilities) role capability in Sumo Logic using these instructions. Please identify your Sumo Logic[ deployment](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate a Sumo Logic [access key](/docs/manage/security/access-keys) and access ID for a user that has the[ Manage Monitors](/docs/manage/users-roles/roles/role-capabilities) role capability in Sumo Logic using these instructions. Please identify your Sumo Logic[ deployment](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for Nginx Ingress alerts: The alerts package is available in the [Sumo Logic GitHub repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/nginx-plus-ingress). You can either download it via the `git clone` command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory **terraform-sumologic-sumo-logic-monitor/monitor_packages/nginx-plus-ingress/**. Edit the **nginxplusingress.auto.tfvars** file as per below instructions: diff --git a/docs/integrations/web-servers/nginx-plus.md b/docs/integrations/web-servers/nginx-plus.md index 7a8b198cef..f8ed279270 100644 --- a/docs/integrations/web-servers/nginx-plus.md +++ b/docs/integrations/web-servers/nginx-plus.md @@ -311,7 +311,7 @@ The monitors are disabled by default. Once you have installed the alerts via thi ### Method B: Using a Terraform script -1. Generate a Sumo Logic [access key](/docs/manage/security/access-keys#from-the-preferences-page) and access ID for a user that has the [Manage Monitors](/docs/manage/users-roles/roles/role-capabilities) role capability in Sumo Logic using these instructions. Please identify your Sumo Logic [deployment](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate a Sumo Logic [access key](/docs/manage/security/access-keys) and access ID for a user that has the [Manage Monitors](/docs/manage/users-roles/roles/role-capabilities) role capability in Sumo Logic using these instructions. Please identify your Sumo Logic [deployment](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later 3. Download the Sumo Logic Terraform package for Nginx Plus alerts. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/nginx-plus). You can either download it via the “git clone” command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/nginx-plus/`. Edit the **nginxplus.auto.tfvars** file as per the below instructions: diff --git a/docs/integrations/web-servers/nginx.md b/docs/integrations/web-servers/nginx.md index 6f9dc59059..fb3f092cc1 100644 --- a/docs/integrations/web-servers/nginx.md +++ b/docs/integrations/web-servers/nginx.md @@ -405,7 +405,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method B: Using a Terraform script -1. **Generate a Sumo Logic access key and ID** Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these[ instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. **Generate a Sumo Logic access key and ID** Generate an access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. **[Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later** 3. **Download the Sumo Logic Terraform package for Nginx alerts** The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Nginx). You can either download it through the “git clone” command or as a zip file. 4. **Alert Configuration** After the package has been extracted, navigate to the package directory `terraform-sumologic-sumo-logic-monitor/monitor_packages/Nginx/`. diff --git a/docs/integrations/web-servers/squid-proxy.md b/docs/integrations/web-servers/squid-proxy.md index 184be9c9ab..a7ccdd5e28 100644 --- a/docs/integrations/web-servers/squid-proxy.md +++ b/docs/integrations/web-servers/squid-proxy.md @@ -359,7 +359,7 @@ The process to set up collection for Squid Proxy data is done through the follow Squid Proxy app supports the default access logs and cache logs format. -1. **Configure logging in Squid Proxy.** By default, the squid proxy will write the access log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/var/log/squid/access.log`. If the access log is disabled then you must enable the access log following these [instructions](https://wiki.squid-cache.org/SquidFaq/SquidLogs). +1. **Configure logging in Squid Proxy.** By default, the squid proxy will write the access log to the log directory that was configured during installation. For example, on Linux, the log directory would be `/var/log/squid/access.log`. If the access log is disabled then you must enable the access log following [these instructions](https://wiki.squid-cache.org/SquidFaq/SquidLogs). 2. **Configure an Installed Collector.** If you have not already done so, install and configure an installed collector for Windows by [following the documentation](/docs/send-data/installed-collectors/windows). 3. **Configure a Collector**. Use one of the following Sumo Logic Collector options: 1. To collect logs directly from the Squid Proxy machine, configure an [Installed Collector](/docs/send-data/installed-collectors). @@ -687,7 +687,7 @@ The monitors are disabled by default. Once you have installed the alerts using t ### Method 2: Install the alerts using a Terraform script -1. Generate a Sumo Logic access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using these [instructions](/docs/manage/security/access-keys#from-the-preferences-page). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). +1. Generate a Sumo Logic access key and access ID for a user that has the Manage Monitors role capability in Sumo Logic using instructions in [Access Keys](/docs/manage/security/access-keys). Identify which deployment your Sumo Logic account is in, using this [link](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security). 2. [Download and install Terraform 0.13](https://www.terraform.io/downloads.html) or later. 3. Download the Sumo Logic Terraform package for Squid Proxy alerts: The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/SquidProxy). You can either download it through the “git clone” command or as a zip file. 4. Alert Configuration: After the package has been extracted, navigate to the package directory terraform-sumologic-sumo-logic-monitor/monitor_packages/SquidProxy/. @@ -759,7 +759,7 @@ Locate and install the app you need from the **App Catalog**. If you want to see Version selection is not available for all apps. ::: 3. To install the app, complete the following fields. - * **App Name.** You can retain the existing name, or enter a name of your choice for the app.
 + * **App Name.** You can retain the existing name, or enter a name of your choice for the app. * **Data Source.** Choose **Enter a Custom Data Filter**, and enter a custom Squid Proxy cluster filter. Examples: * For all Squid Proxy clusters: `proxy_cluster=*` * For a specific farm; `proxy_cluster=squidproxy.dev.01`. diff --git a/docs/integrations/web-servers/varnish.md b/docs/integrations/web-servers/varnish.md index e9493bf8b9..35400aa597 100644 --- a/docs/integrations/web-servers/varnish.md +++ b/docs/integrations/web-servers/varnish.md @@ -352,7 +352,7 @@ You can install monitors by importing a JSON file or using a Terraform script. ### Method B: Using a Terraform script -1. Generate an access key and access ID for a user with the **Manage Monitors** role capability; for instructions, see [Access Keys](/docs/manage/security/access-keys#from-the-preferences-page). +1. Generate an access key and access ID for a user with the **Manage Monitors** role capability; for instructions, see [Access Keys](/docs/manage/security/access-keys). 2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later and install it. 3. Download the Sumo Logic Terraform package for MySQL monitor. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages). You can either download it using the git clone command or as a zip file. 4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Varnish/` directory. diff --git a/docs/manage/content-sharing/index.md b/docs/manage/content-sharing/index.md index 88e23b4d5b..442e4f6614 100644 --- a/docs/manage/content-sharing/index.md +++ b/docs/manage/content-sharing/index.md @@ -6,7 +6,7 @@ description: Content Sharing allows you to selectively share and collaborate on import useBaseUrl from '@docusaurus/useBaseUrl'; -Content Sharing allows you to selectively share and collaborate on apps, dashboards, and searches with specific users or roles. As an Admin, you can use content sharing to transfer ownership of searches and dashboards, or to highlight key content to specific users and groups. As a user, you can now choose how widely shared your content is within your Org. +Content Sharing allows you to selectively share and collaborate on apps, dashboards, and searches with specific users or roles. As an Admin, you can use content sharing to share ownership of searches and dashboards, or to highlight key content to specific users and groups. As a user, you have the flexibility to control how broadly your content is shared within your organization. You can share log searches, metric searches, dashboards, and folders with a user, a role, or combinations of the two. You can edit the sharing permissions at any time and share and revoke as needed from the **Share** dialog: @@ -56,7 +56,7 @@ To share content from the left navigation bar or the Library: Permissions share -## Navigate Content Sharing Tabs +## Navigate content sharing tabs Sumo provides a few ways to navigate your content based on what you want to view. @@ -64,7 +64,7 @@ import UiElements from '../../reuse/ui-elements.md'; -## Available Permission Levels +## Available permission levels You can share your content with specific users or roles. As a best practice we recommend sharing at the search or dashboard level, or if you want to share a folder, share a subfolder. All contents of the folder are shared, you can’t exclude a particular content item in a folder as private content. diff --git a/docs/manage/ingestion-volume/data-volume-index/index.md b/docs/manage/ingestion-volume/data-volume-index/index.md index 1c53bf00e2..a608966537 100644 --- a/docs/manage/ingestion-volume/data-volume-index/index.md +++ b/docs/manage/ingestion-volume/data-volume-index/index.md @@ -13,7 +13,13 @@ The Data Volume Index provides data for logs and metrics: * **Logs and Tracing.** Ingest volume in bytes and the number of log messages. Tracing ingest volume in billed bytes and spans count. See [Log and Tracing Data Volume Index](log-tracing-data-volume-index.md) for details. * **Metrics.** Ingest volume measured in data points. See [Metrics Ingest Data Volume Index](metrics-data-volume-index.md) for details. -The Data Volume Index must be manually enabled by an administrator. The index then begins populating. A set of messages within the index is created every five minutes. The data does not backfill and is provided to the index only when the option is enabled. +If you are a user of Credits package accounts, the Data Volume Index should be manually enabled by an administrator by toggling the **Enable Granular Data Tracking** button. The index then begins populating. A set of messages within the index is created every five minutes. The data does not backfill and is provided to the index only when the option is enabled. + +:::note +Data Volume Index will be enabled by default for Flex package accounts. +::: + +Enable Granular Data Tracking After the Data Volume Index is enabled, you can access it using this search query:  @@ -29,11 +35,11 @@ Creating an Index typically adds a nominal amount of data to your overall volume Granular Data Tracking is a part of usage management that allows you to proactively manage your systems’ behavior and to fine tune your data ingest with respect to the data plan for your Sumo Logic subscription. This should be manually enabled by an administrator if you are a user of Credits package accounts and this will be enabled by default for Flex package accounts. A set of messages within the index is created every five minutes. The data does not backfill and is provided to the index only when the option is enabled. -### Enable/disable Granular Data Tracking +### Disable Granular Data Tracking 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Account**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Administration**, and then under **Account** select **Account Overview**. You can also click the **Go To...** menu at the top of the screen and select **Account Overview**. 1. Click the gear icon gear-icon-accounts-page in the top left panel of the **Account Overview** page. -1. Click **Enable Granular Data Tracking** or **Disable Granular Data Tracking**.
Disable Granular Data Tracking +1. Click **Disable Granular Data Tracking**.
Disable Granular Data Tracking ## Guide contents diff --git a/docs/manage/manage-subscription/index.md b/docs/manage/manage-subscription/index.md index 1ec367ab06..0fc77c0a70 100644 --- a/docs/manage/manage-subscription/index.md +++ b/docs/manage/manage-subscription/index.md @@ -47,6 +47,12 @@ In this section, we'll introduce the following concepts:

Learn how to group, provision, centrally manage, and monitor credits usage of multiple orgs.

+
+
+ icon

Create and Manage Orgs (Flex)

 +

Learn how to create and manage multiple Sumo Logic Orgs with Flex data.

+
+
icon

Manage Org Settings

 diff --git a/docs/manage/partitions/index.md b/docs/manage/partitions/index.md index a393e8ed50..9ca2c574d0 100644 --- a/docs/manage/partitions/index.md +++ b/docs/manage/partitions/index.md @@ -87,7 +87,7 @@ In this section, we'll introduce the following concepts:
- icon

Manage Indexes with Variable Rentention

 + icon

Manage Indexes with Variable Retention

Learn how to create Index Partitions and Scheduled Views to store your data.

diff --git a/docs/manage/security/access-keys.md b/docs/manage/security/access-keys.md index ed0b2ed973..519397d590 100644 --- a/docs/manage/security/access-keys.md +++ b/docs/manage/security/access-keys.md @@ -4,43 +4,13 @@ title: Access Keys description: Access keys allow you to securely register new Collectors or access Sumo Logic APIs. --- import useBaseUrl from '@docusaurus/useBaseUrl'; +import Iframe from 'react-iframe'; In Sumo Logic, you'll need an access key to: * **Register new Collectors**. When you install a Collector, in addition to having a role that grants you the **Manage Collectors** capability, you must supply an access key. You can use a different access key for each Collector, or use the same access key for multiple Collectors. The only time a Collector uses the access key is at installation, so if a key is deleted after a Collector has been set up, the Collector isn't affected. * **Use Sumo Logic APIs**. You must supply an access key to use the Sumo Logic APIs. See [API Authentication](/docs/api/getting-started#authentication) for details. -import Iframe from 'react-iframe'; - -:::sumo Micro Lesson - -