diff --git a/.claude/commands/audit-doc.md b/.claude/commands/audit-doc.md index 2e78224fb1c..5eac970adf7 100644 --- a/.claude/commands/audit-doc.md +++ b/.claude/commands/audit-doc.md @@ -132,7 +132,7 @@ Apply Sumo Logic style guide rules: **Terminology:** * [ ] "Sumo Logic" (not "SumoLogic" or "Sumo") -* [ ] Consistent product names (Cloud SIEM, Cloud SOAR) +* [ ] Consistent product names (SIEM, Cloud SOAR) * [ ] Proper capitalization for features and products * [ ] No contractions in formal documentation @@ -259,7 +259,7 @@ After presenting the audit report, ask the user if they would like Claude to: **By type:** -**Cloud SIEM (CSE):** +**SIEM (CSE):** * Date format with ordinal suffix (12th, 3rd) * Rule IDs follow pattern (MATCH-SXXXX, etc.) * Parser paths use full hierarchy diff --git a/.claude/commands/doc-from-jira.md b/.claude/commands/doc-from-jira.md index 3e063033502..fe4ca51ce4f 100644 --- a/.claude/commands/doc-from-jira.md +++ b/.claude/commands/doc-from-jira.md @@ -81,7 +81,7 @@ Use the technical area and doc type to suggest the most likely file path. | APM | `docs/apm/` | | Apps/Integrations | `docs/integrations/` | | Automation | `docs/platform-services/automation-service/` | -| Cloud SIEM | `docs/cse/` | +| SIEM | `docs/cse/` | | Cloud SOAR | `docs/cloud-soar/` | | Collectors/Sources | `docs/send-data/` | | Dashboards | `docs/dashboards/` | diff --git a/.claude/commands/doc.md b/.claude/commands/doc.md index 13fbc786971..234141474e2 100644 --- a/.claude/commands/doc.md +++ b/.claude/commands/doc.md @@ -428,7 +428,7 @@ Claude: * `/docs/api/` — API reference documentation. * `/docs/apm/` — Application Performance Monitoring and tracing. * `/docs/cloud-soar/` — Cloud SOAR documentation. -* `/docs/cse/` — Cloud SIEM documentation. +* `/docs/cse/` — SIEM documentation. * `/docs/dashboards/` — Dashboard and visualization docs. * `/docs/get-started/` — Getting started guides and onboarding. * `/docs/integrations/` — Third-party integrations (use specialized commands). diff --git a/.claude/commands/geo-optimize.md b/.claude/commands/geo-optimize.md index 9bd91ee4610..69f8d6f0c33 100644 --- a/.claude/commands/geo-optimize.md +++ b/.claude/commands/geo-optimize.md @@ -204,7 +204,7 @@ After the first use, the abbreviation alone is fine. Define the term once at its * **Code blocks** — never alter code, commands, or configuration values * **Step-by-step instructions** — do not reorder or reword steps; only improve surrounding prose -* **Product names and proper nouns** — do not rephrase "Cloud SIEM" or "Hosted Collector" +* **Product names and proper nouns** — do not rephrase "SIEM" or "Hosted Collector" * **Warnings, notes, and admonitions** — these are already structured for extraction; leave them * **Tables** — do not convert tables to prose; they are already GEO-friendly diff --git a/.claude/commands/jira.md b/.claude/commands/jira.md index 782b5875e56..7d1f64d54cb 100644 --- a/.claude/commands/jira.md +++ b/.claude/commands/jira.md @@ -38,7 +38,7 @@ Use this list to select the correct Technical Area when creating or updating tic - APM (Traces, RUM) - Apps/Integrations - Automation -- Cloud SIEM +- SIEM - Cloud SOAR - Collectors/Sources - Dashboards @@ -77,7 +77,7 @@ Use these keywords and file path patterns to suggest the most relevant Technical - **APM**: trace, span, RUM, real user monitoring, application performance - **Apps/Integrations**: app, integration, connector, third-party - **Automation**: automation, playbook, workflow, orchestration -- **Cloud SIEM**: SIEM, security, threat, detection, rule +- **SIEM**: SIEM, security, threat, detection, rule - **Cloud SOAR**: SOAR, incident response, security orchestration - **Collectors/Sources**: collector, source, ingestion, data collection - **Dashboards**: dashboard, panel, visualization, chart @@ -101,7 +101,7 @@ Use these keywords and file path patterns to suggest the most relevant Technical - **/apm/**, **/traces/**, **/real-user-monitoring/** → APM (Traces, RUM) - **/integrations/**, **/apps/** → Apps/Integrations - **/automation-service/** → Automation -- **/cse/**, **/cloud-siem/** → Cloud SIEM +- **/cse/**, **/siem/** → SIEM - **/csoar/**, **/cloud-soar/** → Cloud SOAR - **/send-data/**, **/collectors/** → Collectors/Sources - **/dashboards/** → Dashboards diff --git a/.claude/commands/release-note-cse.md b/.claude/commands/release-note-cse.md index 41e36c6c668..f74d87c0897 100644 --- a/.claude/commands/release-note-cse.md +++ b/.claude/commands/release-note-cse.md @@ -1,6 +1,6 @@ -# Create New Cloud SIEM Release Note +# Create New SIEM Release Note -Automates the creation of Cloud SIEM (CSE) release notes with proper formatting, frontmatter, and structure. +Automates the creation of SIEM (CSE) release notes with proper formatting, frontmatter, and structure. ## What this command does @@ -14,16 +14,16 @@ When you invoke `release-note-cse`, Claude will guide you through: ## When to use this command -* Publishing Cloud SIEM content updates (rules, log mappers, parsers). -* Announcing new Cloud SIEM features or bug fixes. +* Publishing SIEM content updates (rules, log mappers, parsers). +* Announcing new SIEM features or bug fixes. * Creating regular bi-weekly or monthly CSE release notes. -* Documenting Cloud SIEM application updates. +* Documenting SIEM application updates. ## Release types ### Content Release (`-content.md`) -For updates to Cloud SIEM detection content: +For updates to SIEM detection content: * **Rules**: New or updated detection rules * **Log Mappers**: New or updated log mapping configurations * **Parsers**: Parser updates and enhancements @@ -33,7 +33,7 @@ For updates to Cloud SIEM detection content: ### Application Release (`-application.md`) -For Cloud SIEM product features and updates: +For SIEM product features and updates: * **New features**: UI improvements, new capabilities * **Bug fixes**: Issue resolutions * **Performance improvements**: Optimizations @@ -117,7 +117,7 @@ hide_table_of_contents: true * **Always ask user to confirm keywords before creating file** * Suggested defaults: * Content releases: `rules`, `log mappers`, `parsers` - * Application releases: Feature-specific keywords (e.g., `insights`, `entities`, `signals`, `cloud siem`) + * Application releases: Feature-specific keywords (e.g., `insights`, `entities`, `signals`, `siem`) * User may want to add or modify keywords based on specific content **Date formatting:** @@ -303,14 +303,14 @@ Use standard vendor names: **Archive structure:** ```markdown --- -title: {Year} Release Notes Archive - Cloud SIEM -keywords: [rules, signals, schema, log mappers, parsers, cloud siem] +title: {Year} Release Notes Archive - SIEM +keywords: [rules, signals, schema, log mappers, parsers, siem] image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This is an archive of {Year} Cloud SIEM release notes. [View the full archive](/release-notes-cse/archive). +This is an archive of {Year} SIEM release notes. [View the full archive](/release-notes-cse/archive). @@ -339,7 +339,7 @@ This is an archive of {Year} Cloud SIEM release notes. [View the full archive](/ After successfully creating the release note, tell the user: ``` -✅ Cloud SIEM release note created successfully! +✅ SIEM release note created successfully! File created: * 📄 blog-cse/{date}-{type}.md. @@ -365,7 +365,7 @@ Checklist: * [ ] Links tested and working. * [ ] No placeholder text remaining. -The release note will appear on the Cloud SIEM release notes page in reverse chronological order (newest first). +The release note will appear on the SIEM release notes page in reverse chronological order (newest first). Would you like me to help fill in any additional details? ``` @@ -414,6 +414,6 @@ Would you like me to help fill in any additional details? ## References -* [Cloud SIEM Release Notes](https://sumologic.com/help/release-notes-cse) +* [SIEM Release Notes](https://sumologic.com/help/release-notes-cse) * [Release Notes Index](/docs/release-notes). * [Style Guide](/docs/contributing/style-guide). diff --git a/README.md b/README.md index 7527ac943ee..1b72246df37 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ [![Node.js >=20](https://img.shields.io/static/v1?label=Node.js&message=%3E%3D20&color=339933&style=flat&logo=nodedotjs&logoColor=white)](https://nodejs.org) [![Yarn v1](https://img.shields.io/static/v1?label=Yarn&message=v1&color=2C8EBB&style=flat&logo=yarn&logoColor=white)](https://yarnpkg.com) -Sumo Logic Docs is the open-source documentation site for Sumo Logic, an AI-powered security operations platform providing Cloud SIEM and security analytics to help teams automate, detect, and investigate threats. Sumo Logic empowers users to monitor, troubleshoot, and defend their environments using AI insights powered by log analytics. Learn more at [sumologic.com](https://www.sumologic.com). +Sumo Logic Docs is the open-source documentation site for Sumo Logic, an AI-powered security operations platform providing SIEM and security analytics to help teams automate, detect, and investigate threats. Sumo Logic empowers users to monitor, troubleshoot, and defend their environments using AI insights powered by log analytics. Learn more at [sumologic.com](https://www.sumologic.com). Our site is built with [Docusaurus 3](https://docusaurus.io/) and supports React, Rehype, and Remark plugins. @@ -62,7 +62,7 @@ Any broken links or images will be listed in the output. Fix them, rebuild, and | `/docs` | Documentation source files | | `/blog-service` | Service release notes | | `/blog-collector` | Collector release notes | -| `/blog-cse` | Cloud SIEM release notes | +| `/blog-cse` | SIEM release notes | | `/blog-csoar` | Cloud SOAR release notes | | `/static/img` | Images and media assets | | `sidebars.ts` | Left-nav sidebar configuration | diff --git a/blog-cse/2022/12-31.md b/blog-cse/2022/12-31.md index 988b8f733ad..74817dd92ac 100644 --- a/blog-cse/2022/12-31.md +++ b/blog-cse/2022/12-31.md @@ -1,5 +1,5 @@ --- -title: 2022 Release Notes Archive - Cloud SIEM +title: 2022 Release Notes Archive - SIEM image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 --- @@ -7,7 +7,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; -This is an archive of 2022 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). +This is an archive of 2022 SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). @@ -51,7 +51,7 @@ This is an archive of 2022 Cloud SIEM release notes. To view the full archive, [ #### New Entity Types -Eight new predefined Entity types have been added to Cloud SIEM. This will enable customers to more accurately associate Signals and Insights with security threats. They are listed below long with the related normalized record schema attributes (which can be specified in Rule definitions): +Eight new predefined Entity types have been added to SIEM. This will enable customers to more accurately associate Signals and Insights with security threats. They are listed below long with the related normalized record schema attributes (which can be specified in Rule definitions): | Entity Type | Schema Attributes | |:----- |:----- | @@ -449,7 +449,7 @@ To do this, simply expand the **Full Details** view, hover to the left of the fi #### Support for Custom Inventory Sources -Cloud SIEM now supports custom sources of inventory data. Now, if you want to ingest inventory data from a source that Sumo Logic does not provide a pre-built connnector for, you can use this new feature. See the new document [Configure a Custom Inventory Source](/docs/cse/administration/custom-inventory-sources/) for details. +SIEM now supports custom sources of inventory data. Now, if you want to ingest inventory data from a source that Sumo Logic does not provide a pre-built connnector for, you can use this new feature. See the new document [Configure a Custom Inventory Source](/docs/cse/administration/custom-inventory-sources/) for details. #### Standard Match Lists @@ -457,22 +457,22 @@ As a reminder, the migration for our out-of-the-box rules content from standard #### Minor Changes and Enhancements -* [New] API endpoints have been creeated enabling users to upload attribute changes (such as tags or criticality) for multiple Entities in a single call, rather than having to do so one at a time. The new endpoints are `/entities/bulk-add-tags`, `/entities/bulk-update-tags`, `/entities/bulk-remove-tags`, `/entities/bulk-update-suppressed`, and `/entities/bulk-update-criticality`. Note that these API endpoints have a limit of 1000 entries per call. More details are available via the **API Documentation** link in Cloud SIEM. +* [New] API endpoints have been creeated enabling users to upload attribute changes (such as tags or criticality) for multiple Entities in a single call, rather than having to do so one at a time. The new endpoints are `/entities/bulk-add-tags`, `/entities/bulk-update-tags`, `/entities/bulk-remove-tags`, `/entities/bulk-update-suppressed`, and `/entities/bulk-update-criticality`. Note that these API endpoints have a limit of 1000 entries per call. More details are available via the **API Documentation** link in SIEM. * [Updated] Previously, a new feature was added to the Enrichments tab that enabled you to hide any attribute-value pair with an "empty" value for clarity. This included values like "0" or "N/A". However, some of those values are often useful to the analyst (for example, `number_of_threat_reports="0"`). Starting with this release, this feature will only hide attributes with truly empty values (i.e., `attribute=""`). #### Resolved Issues * The CSV file upload method for updating Entity attributes did not support sensor zones or normalized entity names properly. -* Cloud SIEM has switched providers of lists of public dynamic DNS domains, which has resolved an issue with rules utilizing these lists. +* SIEM has switched providers of lists of public dynamic DNS domains, which has resolved an issue with rules utilizing these lists. --- ### October 13, 2022 - Application Update #### Announcement: Standard Match Lists Migration to Entity Tags -Currently, Cloud SIEM defines a set of standard Match Lists as a way to allow users to specify lists of Entities and other indicators that should affect whether or not Rules create Signals. However, starting next week, the Rules included with Cloud SIEM will begin transitioning to leverage Entity tags for this purpose instead. Tags on Entities are more flexible and can also provide context to analysts during the investigation phase. +Currently, SIEM defines a set of standard Match Lists as a way to allow users to specify lists of Entities and other indicators that should affect whether or not Rules create Signals. However, starting next week, the Rules included with SIEM will begin transitioning to leverage Entity tags for this purpose instead. Tags on Entities are more flexible and can also provide context to analysts during the investigation phase. -Next week, a new set of standard tag schemas will be introduced in Cloud SIEM. These tag schemas will correspond to the existing standard Match Lists: +Next week, a new set of standard tag schemas will be introduced in SIEM. These tag schemas will correspond to the existing standard Match Lists: @@ -515,7 +515,7 @@ Next week, a new set of standard tag schemas will be introduced in Cloud SIEM. T (There are five standard match lists *not* affected by this change, as they do not contain Entities. These include: business_asns, business_domains, business_hostnames, threat, and verified_uri_paths.) -**Beginning Thursday, October 20**, the contents of the standard match lists listed above will automatically be copied to tags set on the individual entities. So, for example, if an Entity `1.2.3.4` is in match list `sql_servers`, a tag `_deviceService:sql` will be set on it. Cloud SIEM will continue to automatically create these tags from the standard match lists for a period of 3 months, **until January 20, 2023**. During this period, pre-defined rules will be updated to reference these tags instead of the standard match lists, so by the end of this period all rules will be updated and Cloud SIEM will no longer automatically create these tags. +**Beginning Thursday, October 20**, the contents of the standard match lists listed above will automatically be copied to tags set on the individual entities. So, for example, if an Entity `1.2.3.4` is in match list `sql_servers`, a tag `_deviceService:sql` will be set on it. SIEM will continue to automatically create these tags from the standard match lists for a period of 3 months, **until January 20, 2023**. During this period, pre-defined rules will be updated to reference these tags instead of the standard match lists, so by the end of this period all rules will be updated and SIEM will no longer automatically create these tags. **Please update any process you use to maintain the members of standard match lists by January 20, 2023 to maintain standard Entity tags instead (or in addition).** We highly recommend you take advantage of Entity Groups to set Entity tags rather than individually setting tags. Entity Groups enable the automatic application of attributes like tags based on the Entity's value, IP address range, or inventory group. @@ -525,7 +525,7 @@ You can refer to Entity tags in Rule expressions. For example, if you've attache ``` array_contains(fieldTags["srcDevice_ip"], "_deviceService:sql") ``` -Additional information about the standard tag schema, match lists, Entity groups, and using these features with Rules is available in the [Cloud SIEM Documentation](/docs/cse). +Additional information about the standard tag schema, match lists, Entity groups, and using these features with Rules is available in the [SIEM Documentation](/docs/cse). #### Minor Changes and Enhancements @@ -540,9 +540,9 @@ Additional information about the standard tag schema, match lists, Entity groups --- ### October 12, 2022 - Introducing Sumo Logic Open Source Docs -Welcome to the Sumo Logic Cloud SIEM Release Notes on our new docs site! We're now open source and encourage you to contribute. We welcome all contributions, from minor typo fixes to brand new docs. Your expertise and sharing can help fellow users learn and expand their knowledge of Sumo Logic. +Welcome to the Sumo Logic SIEM Release Notes on our new docs site! We're now open source and encourage you to contribute. We welcome all contributions, from minor typo fixes to brand new docs. Your expertise and sharing can help fellow users learn and expand their knowledge of Sumo Logic. -Here you'll find information about new and enhanced features, updated content (like rules, log mappers and parsers), bug fixes, and other important announcements for Cloud SIEM. +Here you'll find information about new and enhanced features, updated content (like rules, log mappers and parsers), bug fixes, and other important announcements for SIEM. To view Release Notes from previous years, check the [archive](/release-notes-cse/archive). @@ -561,7 +561,7 @@ To view Release Notes from previous years, check the [archive](/release-notes-cs * [New] Entity domain normalization can now be managed via Terraform * [New] Users can now configure the Email Action to send emails in plain text in addition to the previously supported multipart HTML5/text format * [New] Changes to the Insight Threshold are now noted in the Audit Log -* [Deleted] As previously announced, the IBM Resilient and Sensor actions have been removed from Cloud SIEM +* [Deleted] As previously announced, the IBM Resilient and Sensor actions have been removed from SIEM #### Resolved Issues @@ -642,7 +642,7 @@ To view Release Notes from previous years, check the [archive](/release-notes-cs #### Insight Enrichment Server for Fed deployment -[Update] We’ve released a new version of the [Insight Enrichment Server](/docs/cse/integrations/insight-enrichment-server) that runs on the Sumo Logic FedRAMP-compliant deployment. This makes Cloud SIEM on FedRAMP functionally equivalent to commercial deployments of Cloud SIEM. +[Update] We’ve released a new version of the [Insight Enrichment Server](/docs/cse/integrations/insight-enrichment-server) that runs on the Sumo Logic FedRAMP-compliant deployment. This makes SIEM on FedRAMP functionally equivalent to commercial deployments of SIEM. --- ### September 9, 2022 - Application Update @@ -685,9 +685,9 @@ In one week (2022-09-15), we will be removing CHAIN-S00009 - 'Proofpoint TAP Cli #### Announcements -* Starting October 1, 2022, _suppressed _Signals will be retained in Cloud SIEM for 30 days (previously, they were retained for 90 days). All Signals are automatically stored in the Sumo sec_signals index for 2 years, so users searching for suppressed Signals more than 30 days old should search in that index instead of in the Cloud SIEM UI. - * Note also that in the past, Signals attached to Insights were searchable from the Cloud SIEM Signals list page indefinitely. Starting on October 1, they will only be searchable for 365 days. (They will still be visible from the Insight details page beyond that period.) -* As previously announced, the Sensor and IBM Resilient actions are no longer supported. They will be removed from Cloud SIEM by the end of this month. +* Starting October 1, 2022, _suppressed _Signals will be retained in SIEM for 30 days (previously, they were retained for 90 days). All Signals are automatically stored in the Sumo sec_signals index for 2 years, so users searching for suppressed Signals more than 30 days old should search in that index instead of in the SIEM UI. + * Note also that in the past, Signals attached to Insights were searchable from the SIEM Signals list page indefinitely. Starting on October 1, they will only be searchable for 365 days. (They will still be visible from the Insight details page beyond that period.) +* As previously announced, the Sensor and IBM Resilient actions are no longer supported. They will be removed from SIEM by the end of this month. #### Minor Changes and Enhancements @@ -727,11 +727,11 @@ In 2 weeks (2022-09-15) we will be removing CHAIN-S00009 - 'Proofpoint TAP Click #### Application Update -##### Cloud SIEM App is now available +##### SIEM App is now available -The Cloud SIEM app gives you visibility into what’s going on in Cloud SIEM. The app dashboards present high-level and detailed views into the Records that were created, the Signals that have fired, and the Insights generated by Cloud SIEM. You can also get insight in Cloud SIEM rules, including rule management activity, and which rules have fired. +The SIEM app gives you visibility into what’s going on in SIEM. The app dashboards present high-level and detailed views into the Records that were created, the Signals that have fired, and the Insights generated by SIEM. You can also get insight in SIEM rules, including rule management activity, and which rules have fired. -This app is available to all licensed Cloud SIEM customers in the Sumo Logic App Catalog. For more information, see [Cloud SIEM App](/docs/integrations/sumo-apps/cse). +This app is available to all licensed SIEM customers in the Sumo Logic App Catalog. For more information, see [SIEM App](/docs/integrations/sumo-apps/cse). #### Content Release @@ -771,18 +771,18 @@ Labels were not being created properly based on Network Blocks for a small numbe --- ### July 28, 2022 - Application Update -#### Read-Only User Capabilities for Cloud SIEM -New user capabilities (permissions) have been created enabling read-only access to content and configuration features in Cloud SIEM. +#### Read-Only User Capabilities for SIEM +New user capabilities (permissions) have been created enabling read-only access to content and configuration features in SIEM. These can be used when [defining roles](/docs/manage/users-roles/roles/create-manage-roles/) in the Sumo Logic platform. read-only roles -(For those with Cloud SIEM instances in the `jask.ai` domain, these capabilities are accessed via the **Configuration > Roles** page in Cloud SIEM.) +(For those with SIEM instances in the `jask.ai` domain, these capabilities are accessed via the **Configuration > Roles** page in SIEM.) Users with these capabilities (without the corresponding **Manage** capabilities) will be able to view the corresponding pages but will not be able to make changes on those pages. (Previously, users without the **Manage** capabilities could not see the corresponding pages.) -These permissions also apply to Cloud SIEM APIs, so **View** (only) capabilities can now be assigned if desired. +These permissions also apply to SIEM APIs, so **View** (only) capabilities can now be assigned if desired. #### Minor Changes and Enhancements @@ -811,7 +811,7 @@ These permissions also apply to Cloud SIEM APIs, so **View** (only) capabilities #### Entity Groups -There are a number of ways that the use of Entity attributes - tags, criticality and suppression - provide value to users of Cloud SIEM: Investigations can be completed faster with more context, Insights can be better prioritized with the appropriate severity, and false positive signals from test instances can be prevented, for example. However, setting those attributes has been a manual process and keeping them in sync as new Entities are defined is difficult. +There are a number of ways that the use of Entity attributes - tags, criticality and suppression - provide value to users of SIEM: Investigations can be completed faster with more context, Insights can be better prioritized with the appropriate severity, and false positive signals from test instances can be prevented, for example. However, setting those attributes has been a manual process and keeping them in sync as new Entities are defined is difficult. That's why we are pleased to announce a new feature called Entity Groups. By defining Entity Groups, attributes can be automatically applied (or removed) based on Entity value (name), IP address, or Inventory group membership. For example, all high-risk laptops will receive higher criticality -- even if such a laptop is added to your environment months later. @@ -845,17 +845,17 @@ More information about this exciting new feature and how to use it is in the doc #### Signal Index -Starting today, Signals generated by Cloud SIEM will be automatically saved in a new sec_signal index. This special partition is similar to the existing sec_record_* indices in that, unlike data retained using the older Signal Forwarding feature, it will be saved in proper JSON supporting keyword search and nested attributes. +Starting today, Signals generated by SIEM will be automatically saved in a new sec_signal index. This special partition is similar to the existing sec_record_* indices in that, unlike data retained using the older Signal Forwarding feature, it will be saved in proper JSON supporting keyword search and nested attributes. -The new index is automatically generated and retained for a period of 2 years at no additional cost for all Cloud SIEM customers. +The new index is automatically generated and retained for a period of 2 years at no additional cost for all SIEM customers. -As a result, the optional Signal Forwarding feature will be deprecated on September 22, 2022. Existing data will not be deleted but new Signals generated after that date will no longer be forwarded and the option will no longer be available in Cloud SIEM. +As a result, the optional Signal Forwarding feature will be deprecated on September 22, 2022. Existing data will not be deleted but new Signals generated after that date will no longer be forwarded and the option will no longer be available in SIEM. Customers leveraging Signal Forwarding data to generate dashboards (or for other use cases) will need to modify those applications to use the new sec_signal index before September 22. Note that because the new index is a special partition, a single query cannot be used to search both the sec_signal index and older forwarded Signal data simultaneously. -More information about using the special security indices is in the documentation at [Searching for Cloud SIEM Data in Sumo Logic](/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo). +More information about using the special security indices is in the documentation at [Searching for SIEM Data in Sumo Logic](/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo). #### Minor Changes and Enhancements @@ -868,7 +868,7 @@ Note the URL has also changed as a result; please update any bookmarks. #### Resolved Issues -When navigating to a Cloud SIEM page (with `sumologic.com` in the domain name), if the user had to login/authenticate first, they were not auto-forwarded to the appropriate Cloud SIEM page after doing so (but instead was taken to the Continuous Intelligence Platform home page). This has now been resolved and users will be auto-forwarded correctly. +When navigating to a SIEM page (with `sumologic.com` in the domain name), if the user had to login/authenticate first, they were not auto-forwarded to the appropriate SIEM page after doing so (but instead was taken to the Continuous Intelligence Platform home page). This has now been resolved and users will be auto-forwarded correctly. --- ### July 21, 2022 - Content Release @@ -1021,11 +1021,11 @@ The new Signal Index (recently announced) has been delayed, and will be availabl --- ### June 24, 2022 - Announcement -Beginning July 15, 2022, Signals generated by Cloud SIEM will be automatically saved in a new **sec_signals** index. This index/special partition will be similar to the existing **sec_record_** indices in that, unlike data retained using the older Signal Forwarding feature, it will be saved in proper JSON supporting keyword search and nested attributes. +Beginning July 15, 2022, Signals generated by SIEM will be automatically saved in a new **sec_signals** index. This index/special partition will be similar to the existing **sec_record_** indices in that, unlike data retained using the older Signal Forwarding feature, it will be saved in proper JSON supporting keyword search and nested attributes. -The new index will be automatically generated and retained for a period of 2 years at no additional cost for all Cloud SIEM customers. +The new index will be automatically generated and retained for a period of 2 years at no additional cost for all SIEM customers. -As a result, the optional Signal Forwarding feature in Cloud SIEM will be deprecated on September 15, 2022. Existing data will not be deleted but new Signals generated after that date will no longer be forwarded and the option will no longer be available in Cloud SIEM. +As a result, the optional Signal Forwarding feature in SIEM will be deprecated on September 15, 2022. Existing data will not be deleted but new Signals generated after that date will no longer be forwarded and the option will no longer be available in SIEM. Customers leveraging Signal Forwarding data to generate dashboards (or for other use cases) will need to modify those applications to use the new sec_signals index before September 15. @@ -1210,7 +1210,7 @@ If you have any questions or concerns, please contact Sumo Logic customer suppor #### Geographical Data for IP Addresses -* As previously announced, Cloud SIEM has switched to a new provider for geographical data for IP addresses. One consequence of this change is that the various `_isp` enrichment fields (listed below) are no longer being populated. However, that data is available in the equivalent `_asnOrg` fields (such as `device_ip_asnOrg`). If you have any rules that leverage the `_isp` fields, please switch to the `_asnOrg` fields as soon as possible. +* As previously announced, SIEM has switched to a new provider for geographical data for IP addresses. One consequence of this change is that the various `_isp` enrichment fields (listed below) are no longer being populated. However, that data is available in the equivalent `_asnOrg` fields (such as `device_ip_asnOrg`). If you have any rules that leverage the `_isp` fields, please switch to the `_asnOrg` fields as soon as possible. * Because these fields will no longer be populated, they will be removed on **June 7, 2022**: * `device_ip_isp` * `device_natIp_isp` @@ -1362,7 +1362,7 @@ If you have any questions or concerns, please contact Sumo Logic customer suppor * [Updated] On the Insight Details pages, Signals are now sorted in order of the most recent Signal first by default. (As always, the user can change the sort order.) * [New] When creating a copy of a Rule, users are now given then option to apply the Rule Tuning Expression(s) that are applied on the original rule to the copy as well. -* [New] In the Cloud SIEM UI, timestamps now explicitly include the time zone. +* [New] In the SIEM UI, timestamps now explicitly include the time zone. * [New] Users can now specify a maximum look-back window (in days) for TAXII feeds. * [New] The current status (enabled/disabled) for each feed is now displayed on the Threat Intelligence list page. @@ -1413,7 +1413,7 @@ If you have any questions or concerns, please contact Sumo Logic customer suppor #### Minor Changes and Enhancements -* [Updated] The `_sourceName` and `_sourceHost` values in records ingested by Cloud SIEM will now reflect the original values defined when ingested into the Sumo Logic platform. +* [Updated] The `_sourceName` and `_sourceHost` values in records ingested by SIEM will now reflect the original values defined when ingested into the Sumo Logic platform. * [Updated] The "Board" list view for Insights has been updated to include the resolution:
board-view @@ -1549,11 +1549,11 @@ If you have any questions or concerns, please contact Sumo Logic customer suppor #### Related Entities -[New] The Cloud SIEM team is excited to announce a newly enhanced feature: Related Entities. Although Insights and the Signals they contain are focused on a single Entity (a user, or host for example), there are often a number of additional Entities referenced in the Records/Signals contained in the Insight. In addition, Cloud SIEM can detect relationships between Entities (for example, determining that an IP address was associated with a given hostname during the Insight detection window). +[New] The SIEM team is excited to announce a newly enhanced feature: Related Entities. Although Insights and the Signals they contain are focused on a single Entity (a user, or host for example), there are often a number of additional Entities referenced in the Records/Signals contained in the Insight. In addition, SIEM can detect relationships between Entities (for example, determining that an IP address was associated with a given hostname during the Insight detection window). To provide an easy way for analysts to explore all of these Related Entities, a new tab has been added to the Insight Details page: -The **Entities** tab contains a list of all of the Entities detected in the Insight’s Signals and Records. The Primary Entity is listed first, and then the other Related Entities are listed in descending order of appearance. Where Cloud SIEM has determined a relationship between entities, that is called out (for example, 192.168.1.101 may also be hostname ‘na’). +The **Entities** tab contains a list of all of the Entities detected in the Insight’s Signals and Records. The Primary Entity is listed first, and then the other Related Entities are listed in descending order of appearance. Where SIEM has determined a relationship between entities, that is called out (for example, 192.168.1.101 may also be hostname ‘na’). Details listed with each entity include tags, the number of Signals the Entity was seen in, the number of recent Insights and Signals that featured that Entity, and the total sum of the Severities for those Signals. @@ -1561,7 +1561,7 @@ As each Entity is selected by the user, the right column changes to show more de This new feature should help users understand the context of security events more quickly by providing this data at a glance, reducing the amount of time it would have previously taken to gather that same information. -More information can be found in the [online documentation](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui#entities-tab). +More information can be found in the [online documentation](/docs/cse/get-started-with-siem/about-cse-insight-ui#entities-tab). #### Minor Changes and Enhancements @@ -1676,16 +1676,16 @@ We will be consolidating Authentication Brute Force Attempt **MATCH-S00258** on #### Minor Changes and Enhancements * [New] API endpoints are now available to add or remove a given Signal to/from a given Insight, `PUT "/insights//signals"` and `DELETE "/insights//signals"` respectively. (For both endpoints, the request body is a list containing signal ID(s) to add or remove from the insight as the request body, the response is the updated Insight.) -* [Update] The way Cloud SIEM displays group membership in Active Directory inventory objects is changing. Previously, it was displayed in LDAP form (i.e., `cn=groupname,dc=something,dc=domain,dc=com`); now it will just show the group name. +* [Update] The way SIEM displays group membership in Active Directory inventory objects is changing. Previously, it was displayed in LDAP form (i.e., `cn=groupname,dc=something,dc=domain,dc=com`); now it will just show the group name. #### Resolved Issues -* Signal and Insight timestamps in the Cloud SIEM UI were not always displayed in the user’s preferred time zone. +* Signal and Insight timestamps in the SIEM UI were not always displayed in the user’s preferred time zone. --- ### April 15, 2022 - Announcements -* Because it can now be connected via more standardized TAXII feeds, the integration between Cloud SIEM and **Anomali ThreatStream** has been **deprecated** as of **April 15, 2022**. If you are using this integration, be sure to convert to a TAXII feed. To set up a feed, first follow Anomali’s documentation for [Setting up a TAXII feed for ThreatStream](https://www.anomali.com/blog/generating-your-own-threat-intelligence-feeds-in-threatstream) then Sumo Logic’s documentation for [Integrating Cloud SIEM with a TAXII Feed](/docs/cse/integrations/integrate-cse-with-taxii-feed). +* Because it can now be connected via more standardized TAXII feeds, the integration between SIEM and **Anomali ThreatStream** has been **deprecated** as of **April 15, 2022**. If you are using this integration, be sure to convert to a TAXII feed. To set up a feed, first follow Anomali’s documentation for [Setting up a TAXII feed for ThreatStream](https://www.anomali.com/blog/generating-your-own-threat-intelligence-feeds-in-threatstream) then Sumo Logic’s documentation for [Integrating SIEM with a TAXII Feed](/docs/cse/integrations/integrate-cse-with-taxii-feed). * The Entity API has been updated to include a new field `IsSuppressed`. This field replaces `IsWhitelisted` which has been **deprecated** as of **April 15, 2022**. If you were previously using `IsWhitelisted` please ensure you have switched to the new field. --- @@ -2405,7 +2405,7 @@ We will be consolidating Authentication Brute Force Attempt **MATCH-S00258** on --- ### April 7, 2022 - Announcement -On April 21, 2022 we will be removing the following legacy log mappers related to the CIP Windows collector from the Cloud SIEM platform. These log mappers are in use with only a small portion of our customer base and we are working with our technical account teams to reach out directly to those impacted and migrate to our newer Sumo parsers. +On April 21, 2022 we will be removing the following legacy log mappers related to the CIP Windows collector from the SIEM platform. These log mappers are in use with only a small portion of our customer base and we are working with our technical account teams to reach out directly to those impacted and migrate to our newer Sumo parsers. No loss of out-of-the-box functionality will occur and no out-of-the-box rules are impacted as the Sumo parsers map all of the same information. Please be sure to check any custom rules that leverage Windows logging for compatibility with the new parsing and mapping, particularly where the "fields" field is referenced. @@ -2510,7 +2510,7 @@ No loss of out-of-the-box functionality will occur and no out-of-the-box rules a #### Upcoming Removal of Unused Content -On Tuesday, April 12th, **unused** legacy grok parsers and their corresponding log mappers will be removed from Cloud SIEM. +On Tuesday, April 12th, **unused** legacy grok parsers and their corresponding log mappers will be removed from SIEM. This update is part of a longer transition as we begin decommissioning legacy grok parsers in favor of our current parser set. Sumo Logic has confirmed customers are **NOT** actively using any of the legacy grok parsers or log mappers we plan to remove in this future update. @@ -2521,7 +2521,7 @@ It's important to note that this future content update does **NOT** remove or ch #### Spring4Shell Exploitation -A new Rule is being deployed designed to detect attempts to exploit Spring4Shell (MATCH-S00783). This Rule does not necessarily indicate whether the exploitation was successful, but Cloud SIEM already includes a number of Rules that provide extensive coverage of common post exploitation activities, notably: +A new Rule is being deployed designed to detect attempts to exploit Spring4Shell (MATCH-S00783). This Rule does not necessarily indicate whether the exploitation was successful, but SIEM already includes a number of Rules that provide extensive coverage of common post exploitation activities, notably: * MATCH-S00348 Curl Start Combination * MATCH-S00362 Suspicious Curl File Upload diff --git a/blog-cse/2023/12-31.md b/blog-cse/2023/12-31.md index 2a3c23cfd3e..97ac68f80c4 100644 --- a/blog-cse/2023/12-31.md +++ b/blog-cse/2023/12-31.md @@ -1,12 +1,12 @@ --- -title: 2023 Release Notes Archive - Cloud SIEM +title: 2023 Release Notes Archive - SIEM keywords: - rules - signals - schema - log mappers - parsers - - cloud siem + - siem image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 --- @@ -14,7 +14,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; -This is an archive of 2023 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). +This is an archive of 2023 SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). @@ -49,7 +49,7 @@ The Automation Service has been updated to include several new enhancements: * **Containment** action types are now supported. Typically, these actions will perform some sort of response or remediation action, such as resetting a user's password or blocking a domain on your firewall. Many integrations in App Central now include containment actions. * **User Choice** nodes (and manual steps) are now supported. When executing a playbook if a user choice node is encountered, the execution will pause until a user selects an option. For example, after enrichment, a user could be asked whether to proceed with a containment action or to perform additional enrichment first. When a playbook is paused at a user choice node, the status of that playbook will say `Waiting user interaction`. -* In the initial release of the Automation Service, playbooks would not appear in the **Create New Automation** Cloud SIEM dialog unless they defined as type `CSE`. This restriction has been lifted; all playbooks will now appear in the dropdown. +* In the initial release of the Automation Service, playbooks would not appear in the **Create New Automation** SIEM dialog unless they defined as type `CSE`. This restriction has been lifted; all playbooks will now appear in the dropdown. For full details, see the [Automation Service documentation](/docs/platform-services/automation-service/). @@ -72,7 +72,7 @@ When writing Rules and Rule Tuning Expressions, it's possible to write an expres If you test a Rule (from the Rules Details page), an error will be displayed in these cases, but the error is not obvious and not clear, and the normal editor validation does not catch these kinds of errors. -In addition, while the Cloud SIEM Rules engine does not generate runtime errors in these cases (there just isn't a match), the Log Search engine *does* generate errors and refuses to return any results in these cases. +In addition, while the SIEM Rules engine does not generate runtime errors in these cases (there just isn't a match), the Log Search engine *does* generate errors and refuses to return any results in these cases. A few weeks ago, we made a change to Signal and Insight detail pages, where for multi-signal Rules (such as Chain Rules), where we would attach a subset of rules on the details page and the user would have to go to the **Queried Records** tab to view any other potentially related records, we combined those views and began showing both the attached and queried records on the main page. Unfortunately, the way the new design worked, no records were displayed if the queried record log search failed. @@ -166,7 +166,7 @@ For full details, see the [Cloud SOAR documentation](/docs/platform-services/aut --- ### October 26, 2023 - Content Release -This content release includes templates for creating Cloud SIEM parsers. There are two versions of each, one with comments that explain the purpose of each parser component, and “clean” versions that you can use to start quickly creating custom parsers. Further documentation on using these parsers will be available on [Sumo Logic Docs](/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog/) in the coming weeks. Other changes in this release are enumerated below. +This content release includes templates for creating SIEM parsers. There are two versions of each, one with comments that explain the purpose of each parser component, and “clean” versions that you can use to start quickly creating custom parsers. Further documentation on using these parsers will be available on [Sumo Logic Docs](/docs/cse/get-started-with-siem/siem-content-catalog/) in the coming weeks. Other changes in this release are enumerated below. #### Rules @@ -204,11 +204,11 @@ This content release includes templates for creating Cloud SIEM parsers. There a #### Enhanced Support for Custom Insight Statuses -Sumo Logic is pleased to announce two enhancements to Cloud SIEM related to custom Insight statuses. +Sumo Logic is pleased to announce two enhancements to SIEM related to custom Insight statuses. First, the In Progress status can now be disabled (not deleted). Many customers create multiple statuses that all represent an "In Progress" state, so this option can help reduce confusion in those cases. -Second, while Cloud SIEM has long supported custom Insight statuses, Insights in any custom status have been reported together (as one group on the HUD or using the same color in other instances). To improve this experience, custom statuses can now be assigned a unique color: +Second, while SIEM has long supported custom Insight statuses, Insights in any custom status have been reported together (as one group on the HUD or using the same color in other instances). To improve this experience, custom statuses can now be assigned a unique color: Custom Insight Status Color Palette @@ -222,9 +222,9 @@ A corresponding attribute (`color`) has also been added to the custom status API #### Minor Changes and Enhancements -* [New] Searches in Cloud SIEM (from the top menu bar) are now case-insensitive. +* [New] Searches in SIEM (from the top menu bar) are now case-insensitive. * [New] Custom match list columns now support unnormalized attributes (like `fields.foo`) -* [New] The records search page in Cloud SIEM now includes a link to view the equivalent search in the Log Analytics Platform log search page. +* [New] The records search page in SIEM now includes a link to view the equivalent search in the Log Analytics Platform log search page. * [Updated] When a comment is added to an Insight by an Action from the Automation Service, it will be attributed to a system user called "Automation Service". #### Bug Fixes @@ -241,11 +241,11 @@ A corresponding attribute (`color`) has also been added to the custom status API #### Legacy Signal Forwarding Deprecation -Since July 2022, Signals generated by Cloud SIEM are automatically saved in a standardized `sec_signal` index. This special partition is similar to the existing `sec_record` indices in that, unlike data retained using the legacy Signal Forwarding feature, it is stored in a format that supports keyword search, nested attributes, and other standard log search features. +Since July 2022, Signals generated by SIEM are automatically saved in a standardized `sec_signal` index. This special partition is similar to the existing `sec_record` indices in that, unlike data retained using the legacy Signal Forwarding feature, it is stored in a format that supports keyword search, nested attributes, and other standard log search features. -The new index is automatically generated and retained for a period of 2 years at no additional cost for all Cloud SIEM customers. +The new index is automatically generated and retained for a period of 2 years at no additional cost for all SIEM customers. -As a result, the optional legacy Signal Forwarding feature in Cloud SIEM will be deprecated on **November 15, 2023**. Existing data will not be deleted, but new Signals generated after that date will no longer be forwarded using that feature and the option will no longer be available. (Signals will continue to be forwarded automatically to `sec_signal`.) Customers leveraging data forwarded using the legacy feature to generate dashboards (or for other use cases) will need to modify those applications to use the new `sec_signal` index before then. Note that the content of the `sec_signal` index is not identical to the content in data forwarded using the legacy option. +As a result, the optional legacy Signal Forwarding feature in SIEM will be deprecated on **November 15, 2023**. Existing data will not be deleted, but new Signals generated after that date will no longer be forwarded using that feature and the option will no longer be available. (Signals will continue to be forwarded automatically to `sec_signal`.) Customers leveraging data forwarded using the legacy feature to generate dashboards (or for other use cases) will need to modify those applications to use the new `sec_signal` index before then. Note that the content of the `sec_signal` index is not identical to the content in data forwarded using the legacy option. @@ -283,15 +283,15 @@ This content release contains rules mostly pertaining to Microsoft Azure OAUTH A #### MITRE ATT&CK® Threat Coverage Explorer -We are excited to announce a new feature in Cloud SIEM, the MITRE ATT&CK® Threat Coverage Explorer. This interactive tool gives you the ability to see how Rules, Signals, and log sources map to adversary actions using the [MITRE ATT&CK® Matrix for Enterprise](https://attack.mitre.org/). +We are excited to announce a new feature in SIEM, the MITRE ATT&CK® Threat Coverage Explorer. This interactive tool gives you the ability to see how Rules, Signals, and log sources map to adversary actions using the [MITRE ATT&CK® Matrix for Enterprise](https://attack.mitre.org/). MITRE ATT&CK® Threat Coverage Explorer -The MITRE Explorer can be used to identify gaps in coverage and understand the impact of specific log sources and Rules to the overall threat coverage and value of Cloud SIEM. +The MITRE Explorer can be used to identify gaps in coverage and understand the impact of specific log sources and Rules to the overall threat coverage and value of SIEM. The tool can be accessed in the Content Menu. It supports three different views: * Recent Activity - Your environment's actual coverage (Rules that generated Signals) over the past six months -* All Community Activity - All Cloud SIEM customers' anonymized and aggregated coverage over the past six months. +* All Community Activity - All SIEM customers' anonymized and aggregated coverage over the past six months. * Theoretical Coverage - Potential coverage if all rules are enabled and all log sources are connected. The MITRE Explorer uses the built-in MITRE tactic, technique, and sub-technique tags to track coverage, so if custom Rules are tagged appropriately, they will also be included. @@ -344,7 +344,7 @@ This content release includes new parsing, mapping, and passthrough rule support #### Entity Groups Inventory Enhancements -We are happy to announce some important enhancements to the [Entity Group](/docs/cse/records-signals-entities-insights/create-an-entity-group/) feature in Cloud SIEM. +We are happy to announce some important enhancements to the [Entity Group](/docs/cse/records-signals-entities-insights/create-an-entity-group/) feature in SIEM. With this release, Entity Groups can now use *any* attribute available in your inventory data - including non-normalized attributes. (Previously, only the `group` attribute was available.) Non-normalized attributes can be used by adding the `fields.` prefix. @@ -370,7 +370,7 @@ There much more information about Entity Groups and these enhancements in the [o #### Automation Service -Sumo Logic is excited to announce that the Automation Service for Cloud SIEM is now generally available for all Cloud SIEM customers. The Automation Service uses Cloud SOAR capabilities -- without needing Cloud SOAR itself -- to allow you to define and automate smart actions, including enrichments and notifications. These actions can be automatically triggered when certain events occur in Cloud SIEM, helping you to quickly investigate, understand, and react to potential security threats. +Sumo Logic is excited to announce that the Automation Service for SIEM is now generally available for all SIEM customers. The Automation Service uses Cloud SOAR capabilities -- without needing Cloud SOAR itself -- to allow you to define and automate smart actions, including enrichments and notifications. These actions can be automatically triggered when certain events occur in SIEM, helping you to quickly investigate, understand, and react to potential security threats. You can interact with the service through *automations*, which execute *playbooks*. Playbooks are composed of one or more *actions* with a workflow that could include parallel actions and logic steps. Actions are defined as part of *integrations* with specific internal and external applications. Sumo Logic provides hundreds of integrations, actions, and playbooks out of the box that you can use and customize. You can also create your own. @@ -378,11 +378,11 @@ You can interact with the service through *automations*, which execute *playbook Automations are accessible through the **Configuration** menu, under **Integrations**. Automation results are accessible from Insight and Entity detail pages. -The Automation Service does not include the full capabilities of Cloud SOAR. For example, the Automation Service only supports enrichment, nofification, and custom action types, and Automation Service playbooks can only be triggered from Cloud SIEM. There is also a limit to the number of actions you can run per hour. However, if you do have Cloud SOAR, then once you have upgraded to the Fall 2023 release of Cloud SOAR (currently in Beta), Cloud SIEM will use it to run automations instead of the Automation Service, giving Cloud SIEM access to the full capabilities of Cloud SOAR. +The Automation Service does not include the full capabilities of Cloud SOAR. For example, the Automation Service only supports enrichment, nofification, and custom action types, and Automation Service playbooks can only be triggered from SIEM. There is also a limit to the number of actions you can run per hour. However, if you do have Cloud SOAR, then once you have upgraded to the Fall 2023 release of Cloud SOAR (currently in Beta), SIEM will use it to run automations instead of the Automation Service, giving SIEM access to the full capabilities of Cloud SOAR. -Over time, the legacy Insight Actions and Cloud SIEM Enrichment Service features will be deprecated in favor of this new service. (The new service includes integrations and actions corresponding to the legacy Insight Actions and can run existing Enrichment Service PowerShell scripts. The online documentation has [more information about migrating](/docs/cse/automation/automations-in-cloud-siem/#migrate-from-legacy-actions-and-enrichments-to-the-automation-service).) Note that the Automation Service is not yet available in the FedRAMP environment. +Over time, the legacy Insight Actions and SIEM Enrichment Service features will be deprecated in favor of this new service. (The new service includes integrations and actions corresponding to the legacy Insight Actions and can run existing Enrichment Service PowerShell scripts. The online documentation has [more information about migrating](/docs/cse/automation/automations-in-siem/#migrate-from-legacy-actions-and-enrichments-to-the-automation-service).) Note that the Automation Service is not yet available in the FedRAMP environment. -There is much more information about the Automation Service and how to use it in the [online documentation](/docs/cse/automation/about-automation-service-and-cloud-siem/). +There is much more information about the Automation Service and how to use it in the [online documentation](/docs/cse/automation/about-automation-service-and-siem/). #### Minor Changes and Enhancements @@ -522,7 +522,7 @@ This release includes updated MITRE ATT&CK™ technique tags on several This release includes: * Removal of unused legacy parsers and directly associated mappers and rule content. -* Support for Windows Event Log JSON ingested via Open Telemetry collector. XML and JSON via OTel are now fully supported in Cloud SIEM. +* Support for Windows Event Log JSON ingested via Open Telemetry collector. XML and JSON via OTel are now fully supported in SIEM. #### Rules * [New] FIRST-S00038 First Seen Wget Usage from User @@ -606,7 +606,7 @@ This release includes: #### Minor Changes and Enhancements -* [Update] The Cloud SIEM UI has been updated with refreshed fonts and colors to better align with the core Sumo Logic pages. This is the first change in a greater series of updates designed to present a more unified user experience across Sumo Logic feature sets. +* [Update] The SIEM UI has been updated with refreshed fonts and colors to better align with the core Sumo Logic pages. This is the first change in a greater series of updates designed to present a more unified user experience across Sumo Logic feature sets. * [New] The **Signal Severity Total**, an indication of the activity for an Entity, has been added to the Entity list and details views. The Signal Severity Total is calculated by adding up the severity value for each of the Signals generated against a given Entity during the current detection window (by default 14 days), not including duplicate or suppressed Signals. #### Bug Fixes @@ -620,7 +620,7 @@ This release includes: Starting with this release, the rule type for First Seen rules is now "Anomaly", and Outlier Rules have been promoted from prototype mode. -**NOTE:** Due to performance and efficacy findings, OUTLIER-S00012 will be deleted on July 28th. If you wish to retain this rule, it must be duplicated in the Cloud SIEM Rules UI. +**NOTE:** Due to performance and efficacy findings, OUTLIER-S00012 will be deleted on July 28th. If you wish to retain this rule, it must be duplicated in the SIEM Rules UI. #### Rules * [Updated] OUTLIER-S00001 Spike in login failures from a user @@ -643,7 +643,7 @@ Starting with this release, the rule type for First Seen rules is now "Anomaly", * [New] http_url_queryParameters * New queryParameters enrichment/mappable field * [New] objectClassification - * Allows objectClassification to be used in Cloud SIEM rule expressions. + * Allows objectClassification to be used in SIEM rule expressions. --- @@ -651,7 +651,7 @@ Starting with this release, the rule type for First Seen rules is now "Anomaly", #### New RBAC Capabilities -Reminder: Earlier this week, we introduced new RBAC capabilities for Cloud SIEM: *View Entities* and *Manage Entities*. Users with the built-in administrator role received these capabilities automatically, but **admins must manually add these capabilities** to other roles as appropriate. If a user does not have either role, they will not be able to see Entity details or interact with or manage Entities in any way. +Reminder: Earlier this week, we introduced new RBAC capabilities for SIEM: *View Entities* and *Manage Entities*. Users with the built-in administrator role received these capabilities automatically, but **admins must manually add these capabilities** to other roles as appropriate. If a user does not have either role, they will not be able to see Entity details or interact with or manage Entities in any way. #### Minor Changes and Enhancements @@ -661,7 +661,7 @@ Reminder: Earlier this week, we introduced new RBAC capabilities for Cloud SIEM: #### Bug Fixes * Some customers were seeing non-blocking errors loading Insight detail pages, and links to Cloud SOAR, when they should not have. -* The number of records ingested into Cloud SIEM was not being reported consistently on the HUD. +* The number of records ingested into SIEM was not being reported consistently on the HUD. --- ### July 11, 2023 - Content Release @@ -727,7 +727,7 @@ This release includes parsing and mapping updates to Fortinet to account for var #### New RBAC Capabilities -Starting **Thursday, July 6**, we're introducing new RBAC capabilities for Cloud SIEM: *View Entities* and *Manage Entities*. Users with the built-in administrator role will receive these capabilities automatically, but **admins must manually add these capabilities** to other roles as appropriate. If a user does not have either role, they will not be able to see Entity details or interact with/manage Entities in any way. +Starting **Thursday, July 6**, we're introducing new RBAC capabilities for SIEM: *View Entities* and *Manage Entities*. Users with the built-in administrator role will receive these capabilities automatically, but **admins must manually add these capabilities** to other roles as appropriate. If a user does not have either role, they will not be able to see Entity details or interact with/manage Entities in any way. #### Minor Changes and Enhancements @@ -737,7 +737,7 @@ Starting **Thursday, July 6**, we're introducing new RBAC capabilities for Cloud * [Update] When a custom product or vendor is selected in log mapping, the string entered by the user is now indexed instead of the word "Custom", so that the custom entry can be searchable/filterable. This only applies to mappings configured going forward. * [New] Custom tag schemas can now be retrieved via API (`GET /tag-schemas`). * [New] When viewing Rule Tuning Expressions, if one applies to all rules, it will now say `All` instead of giving a numerical count. -* [Update] The Cloud SIEM UI color palette has been updated to more closely align with the standard Sumo Logic "dark mode" color palette. +* [Update] The SIEM UI color palette has been updated to more closely align with the standard Sumo Logic "dark mode" color palette. #### Bug Fixes @@ -774,22 +774,22 @@ This release includes additional parser and mappers for Aruba ClearPass Syslog e #### Outlier Rules -Sumo Logic is pleased to announce a new rule type for Cloud SIEM: Outlier Rules. This new rule type further enhances Cloud SIEM’s User and Entity Behavioral Analytics (UEBA) capabilities. With these rules, Cloud SIEM can detect events that deviate from the usual behavior of an Entity, such as a spike in login failures from a user, without having to define a static threshold. Once the rule is set, Cloud SIEM automatically builds a normal behavior baseline for each Entity based on the rule expression. It creates a signal only when a deviation from normal behavior is detected (in this case, too many login failures compared to their normal baseline behavior). Other examples include detecting a spike in Windows administrative privileges granted and a spike in AWS calls from a user. +Sumo Logic is pleased to announce a new rule type for SIEM: Outlier Rules. This new rule type further enhances SIEM’s User and Entity Behavioral Analytics (UEBA) capabilities. With these rules, SIEM can detect events that deviate from the usual behavior of an Entity, such as a spike in login failures from a user, without having to define a static threshold. Once the rule is set, SIEM automatically builds a normal behavior baseline for each Entity based on the rule expression. It creates a signal only when a deviation from normal behavior is detected (in this case, too many login failures compared to their normal baseline behavior). Other examples include detecting a spike in Windows administrative privileges granted and a spike in AWS calls from a user. -Outlier Rules are defined like any other rule type through the Content menu in Cloud SIEM. +Outlier Rules are defined like any other rule type through the Content menu in SIEM. Example Signal from Outlier Rule -Outlier Rules operate based on a baseline. During this period - typically between 7 and 30 days - the system will learn what normal behavior looks like. After the baseline is established, Cloud SIEM will begin generating Signals when unusual behavior is detected compared to that baseline. (Note that the longer the baseline, the more accurate the model will be.) +Outlier Rules operate based on a baseline. During this period - typically between 7 and 30 days - the system will learn what normal behavior looks like. After the baseline is established, SIEM will begin generating Signals when unusual behavior is detected compared to that baseline. (Note that the longer the baseline, the more accurate the model will be.) -Cloud SIEM will include a set of Outlier Rules out of the box. These rules can be tuned and customized like any other rule type, and custom Outlier Rules can also be created. +SIEM will include a set of Outlier Rules out of the box. These rules can be tuned and customized like any other rule type, and custom Outlier Rules can also be created. -For more information about how to use Outlier Rules, see the online [documentation](/docs/cse/rules/write-outlier-rule/). You can also see an introduction to the feature by navigating to the Rules page in Cloud SIEM. +For more information about how to use Outlier Rules, see the online [documentation](/docs/cse/rules/write-outlier-rule/). You can also see an introduction to the feature by navigating to the Rules page in SIEM. #### Minor Changes and Enhancements * [New] Users can now customize the global Signal Suppression period. During this period, which is set to 72 hours by default, duplicate signals (with identical names and Entities) are suppressed (for example, they do not “count” towards Insights). With this new feature, this period can be lowered globally (for all rules) to as low as 24 hours. (Note that lowering this value can lead to a higher number of potentially duplicate Insights.) The setting is accessible via the **Workflow** > **Detection** option in the Configuration menu. -* [Updated] Cloud SIEM application status will now be published on the main Sumo Logic status page, [https://status.sumologic.com/](https://status.sumologic.com/). (Previously it was published on [https://cse-status.sumologic.com/](https://cse-status.sumologic.com/).) Existing email subscriptions and status notifications will be moved to the new page automatically. +* [Updated] SIEM application status will now be published on the main Sumo Logic status page, [https://status.sumologic.com/](https://status.sumologic.com/). (Previously it was published on [https://cse-status.sumologic.com/](https://cse-status.sumologic.com/).) Existing email subscriptions and status notifications will be moved to the new page automatically. --- ### June 12, 2023 - Application Update @@ -907,22 +907,22 @@ The latest iteration of our content release include Office 365 changes that addr --- ### May 3, 2023 - Application Update -#### Cloud SIEM Insight Trainer +#### SIEM Insight Trainer -We are excited to announce the release of Cloud SIEM Insight Trainer, a dashboard packaged with the Cloud SIEM Application. +We are excited to announce the release of SIEM Insight Trainer, a dashboard packaged with the SIEM Application. Many security teams spend time every week tuning their SIEM to improve detections and focus SOC analyst attention on the most serious threats. Insight Trainer utilizes machine learning to provide Rule tuning recommendations and severity adjustments to significantly reduce the burden of manual tuning. Insight Trainer learns Rule severity adjustments from your Insights' history that reduces false positive, and optionally, "No Action" Insights. -Cloud SIEM Insight Trainer +SIEM Insight Trainer Some of the highlights of Insight Trainer include: * **Customer-Specific Tuning Recommendations** - Insight Trainer makes recommendations specific to each customer based on their unique set of Rules, Insight history, and analyst Insight resolutions. * **Improved SOC Efficiency** - Insight Trainer automates the manual process of identifying Rules that are candidates for tuning or severity adjustment and provides impact analysis of the changes. -* **Machine Learning/AI-Driven Analytics** - Insight Trainer leverages machine learning and AI to deliver outcome-based recommendations geared towards the reduction of false positive and non-actionable Insights without compromising the actual detection value or true positive Insights in Cloud SIEM. -* **Easy Adoption** - The dashboard is available as an update to our already existing Enterprise Audit Cloud SIEM application and can be set up to run with no additional configuration or data science knowledge. +* **Machine Learning/AI-Driven Analytics** - Insight Trainer leverages machine learning and AI to deliver outcome-based recommendations geared towards the reduction of false positive and non-actionable Insights without compromising the actual detection value or true positive Insights in SIEM. +* **Easy Adoption** - The dashboard is available as an update to our already existing Enterprise Audit SIEM application and can be set up to run with no additional configuration or data science knowledge. -Periodic application of the recommended changes will improve the quality of Insights generated by Cloud SIEM. For more information about the Insight Trainer, see our detailed [online documentation](/docs/cse/rules/insight-trainer/). +Periodic application of the recommended changes will improve the quality of Insights generated by SIEM. For more information about the Insight Trainer, see our detailed [online documentation](/docs/cse/rules/insight-trainer/). #### Bug Fixes @@ -999,7 +999,7 @@ Adds support for DocuSign Monitor and Druva inSync Cloud, and additional suppor #### Automation Service -Sumo Logic is excited to announce a new feature that integrates functionality previously available only in our Cloud SOAR solution directly into Cloud SIEM. This new feature, the Automation Service, allows you to define and automate smart actions, including enrichments and notifications, enabling your security analysts to address potential security threats faster and more accurately. +Sumo Logic is excited to announce a new feature that integrates functionality previously available only in our Cloud SOAR solution directly into SIEM. This new feature, the Automation Service, allows you to define and automate smart actions, including enrichments and notifications, enabling your security analysts to address potential security threats faster and more accurately. You can interact with the service through **automations**, which execute playbooks. **Playbooks** are composed of one or more actions with a workflow that can include parallel actions and logic steps. **Actions** are defined as part of **integrations**. @@ -1007,7 +1007,7 @@ The Automation Service includes over 350 integrations out of the box, each inclu Automation Service Integrations -Many playbooks are also included, providing instant value with practically no effort - simply connect the integration to the appropriate endpoint and enable the corresponding automation in Cloud SIEM. Playbooks can be automatically triggered when Insights are created or closed, or triggered manually. +Many playbooks are also included, providing instant value with practically no effort - simply connect the integration to the appropriate endpoint and enable the corresponding automation in SIEM. Playbooks can be automatically triggered when Insights are created or closed, or triggered manually. Automation Service Playbook Example @@ -1019,17 +1019,17 @@ Automations (and other objects) are accessible through the **Configuration** men Automation results are accessible from Insight and Entity detail pages. -**The Insight Enrichment Server and the Actions functionality in Cloud SIEM, which is replaced by the Automation Service, will be deprecated on November 30, 2023.** Until then, they will continue to be fully supported and operational. To aid in migration, all current Enrichment Server examples and Actions have equivalent actions and playbooks in the Automation Service. In addition, through the Bridge, customers can execute any existing PowerShell script currently connected to the Insight Enrichment Server. +**The Insight Enrichment Server and the Actions functionality in SIEM, which is replaced by the Automation Service, will be deprecated on November 30, 2023.** Until then, they will continue to be fully supported and operational. To aid in migration, all current Enrichment Server examples and Actions have equivalent actions and playbooks in the Automation Service. In addition, through the Bridge, customers can execute any existing PowerShell script currently connected to the Insight Enrichment Server. :::note The Automation Service currently has **Limited Availability**. This means that it is fully functional and supported in production environments, but not automatically deployed to every customer. If you would like it deployed to your environment, please contact Sumo Logic and we will enable it for you. ::: -There is much more information about the Automation Service and how to use it in the [online documentation](/docs/cse/automation/about-automation-service-and-cloud-siem/). +There is much more information about the Automation Service and how to use it in the [online documentation](/docs/cse/automation/about-automation-service-and-siem/). #### Threat Indicators -The way enrichments are displayed in Cloud SIEM is also being enhanced to provide important information to security analysts when they need it, without having to look it up. +The way enrichments are displayed in SIEM is also being enhanced to provide important information to security analysts when they need it, without having to look it up. First, the Enrichment tabs have been reorganized by Entity (instead of by Enrichment) and additional filter controls have been added: @@ -1041,7 +1041,7 @@ This persistence can be controlled by setting an expiration date as part of the Finally, enrichments can now set reputation indicators. These indicators will be visible anywhere in the UI that the Entity is displayed. Where there is sufficient room, a color-coded text label will be displayed (as in the example above); in other situations, an icon will be displayed instead. -The reputation is not set automatically; the enrichment must pass a reputation to Cloud SIEM. More information about this, and the other new features, is available in [online documentation](/docs/cse/integrations/enrichments-and-indicators/#). +The reputation is not set automatically; the enrichment must pass a reputation to SIEM. More information about this, and the other new features, is available in [online documentation](/docs/cse/integrations/enrichments-and-indicators/#). #### Minor Changes and Enhancements @@ -1159,19 +1159,19 @@ Description: This alert looks for a number of search expressions that result in #### Minor Changes and Enhancements * [New] When logs fail to parse or map, a detailed error message will be logged in the `sec_record_failure` index, in the `fields.reason` attribute. -* [New] Where possible, private domains are now [automatically enriched](/docs/cse/schema/record-processing-pipeline/#enrich-records-with-ip-address-url-and-domain-info) by Cloud SIEM during record processing. +* [New] Where possible, private domains are now [automatically enriched](/docs/cse/schema/record-processing-pipeline/#enrich-records-with-ip-address-url-and-domain-info) by SIEM during record processing. * [Updated] Insight comments can now contain up to 1024 characters (up from 256). * [New] On the list of Rule Tuning Expressions, each Tuning Expression now lists the number of Rules to which it is currently applied. * [New] For First Seen Rules, the UI will display the baseline model status (i.e., building, with amount of progress, or complete). (Note it will only display the status on Rules that were created or updated after this feature became available.) #### Bug Fixes -* In some cases, inventory data from an AWS EC2 source was not being displayed in Cloud SIEM properly. +* In some cases, inventory data from an AWS EC2 source was not being displayed in SIEM properly. * For Yara-based signals with file attachments, users were unable to download the file. * Occasionally, some related Entities were not visible in the Insight Related Entities graph but were included correctly on the list. * Entity suppression state was being reported incorrectly on several screens. * The `Manage Entity Groups` permission was required to view Entity Groups. Now only `View Entity Groups` is required. -* Links to the Cloud SIEM API no longer require a trailing slash. +* Links to the SIEM API no longer require a trailing slash. --- ### April 7, 2023 - Content Release @@ -1242,7 +1242,7 @@ For corrections involving logic adjustment, additional context is included withi #### Bug Fixes -* When an Entity normalization lookup table was deleted and then re-created in the Sumo platform, the configuration in Cloud SIEM was not automatically updated, causing the normalization to fail. +* When an Entity normalization lookup table was deleted and then re-created in the Sumo platform, the configuration in SIEM was not automatically updated, causing the normalization to fail. * Match lists with custom columns were not working properly during record processing. * The Network Blocks section was missing from the Entity details panel. * Links for schema tags were not displaying in the UI properly. @@ -1311,7 +1311,7 @@ We are excited to announce the new Entity Relationship Graph. With this feature, This feature is available to all customers but is currently in **Beta**. If you encounter any issues with this feature, report them to Sumo Logic Support. We appreciate your feedback. ::: -The Entity Relationship Graph (and the Related Entities list) displays all Entities involved in the Insight (those referred to in a record in a Signal in the Insight) as well as additional Entity relationships (for example, if Cloud SIEM detects an IP address may also have had a specific hostname at the time the Insight was generated). +The Entity Relationship Graph (and the Related Entities list) displays all Entities involved in the Insight (those referred to in a record in a Signal in the Insight) as well as additional Entity relationships (for example, if SIEM detects an IP address may also have had a specific hostname at the time the Insight was generated). However, unlike the Related Entities list, the graph can visualize additional Entity relationships that existed outside of the Insight during a specified time frame. @@ -1325,7 +1325,7 @@ Each node in the graph represents a single Entity. The graph also displays the r The graph also includes a number of controls for zoom, full screen mode, filtering by Entity type, and adjusting the time frame for relationship detection. -For more information about how to use the Entity Relationship Graph, see the [online documentation](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#about-the-entities-tab-graph-view). You will also see an introduction to the feature the first time you visit an Insight details page. +For more information about how to use the Entity Relationship Graph, see the [online documentation](/docs/cse/get-started-with-siem/about-cse-insight-ui/#about-the-entities-tab-graph-view). You will also see an introduction to the feature the first time you visit an Insight details page. #### Minor Changes and Enhancements @@ -1337,7 +1337,7 @@ For more information about how to use the Entity Relationship Graph, see the [on #### Bug Fixes -* In some cases, Cloud SIEM was unable to properly extract the user name from an AWS ARN. +* In some cases, SIEM was unable to properly extract the user name from an AWS ARN. * A recent change caused checkboxes to malfunction in Firefox. * On the Entity Timeline record details, the timestamp wasn’t displaying properly. @@ -1395,7 +1395,7 @@ This release contains changes to how the Palo Alto Firewall CSV parser handles t --- ### February 24, 2023 - Content Release -This release includes small modifications to First Seen rule type baseline and retention periods, and switches rule status from Prototype state, allowing more of these rules to contribute to Cloud SIEM Insights. The Microsoft Office 365 Audit parser now formulates key value pairs from the 'OperationProperties' array included in some messages. +This release includes small modifications to First Seen rule type baseline and retention periods, and switches rule status from Prototype state, allowing more of these rules to contribute to SIEM Insights. The Microsoft Office 365 Audit parser now formulates key value pairs from the 'OperationProperties' array included in some messages. #### Rules * [Updated] FIRST-S00002 First Seen AWS API Call from User @@ -1468,19 +1468,19 @@ This release includes small modifications to First Seen rule type baseline and r #### First Seen Rules -Sumo Logic is pleased to announce new features in Cloud SIEM that deliver enhanced **User and Entity Behavioral Analytics (UEBA)** capabilities. These new UEBA capabilities enable additional methods to detect and investigate anomalous or unexpected behavior that may signify a security threat. +Sumo Logic is pleased to announce new features in SIEM that deliver enhanced **User and Entity Behavioral Analytics (UEBA)** capabilities. These new UEBA capabilities enable additional methods to detect and investigate anomalous or unexpected behavior that may signify a security threat. -The first feature is called a **First Seen Rule**. With this new rule type, Cloud SIEM can detect events such as “the first time a user logs in from a new location” without having to define a rule expression that is unique to each user in your environment (and the location(s) from which he/she usually logs in). Other examples include detecting the unusual granting of administrative privileges, Windows recon command, AWS Secrets Manager API calls, API gateway enumeration, and more. +The first feature is called a **First Seen Rule**. With this new rule type, SIEM can detect events such as “the first time a user logs in from a new location” without having to define a rule expression that is unique to each user in your environment (and the location(s) from which he/she usually logs in). Other examples include detecting the unusual granting of administrative privileges, Windows recon command, AWS Secrets Manager API calls, API gateway enumeration, and more. -First Seen Rules are defined like any other rule type, through the Content menu in Cloud SIEM. +First Seen Rules are defined like any other rule type, through the Content menu in SIEM. A First Seen Rule definition -First Seen Rules operate based on a **baseline**. During this period of time - typically between 7 and 30 days - the system will learn what normal and expected behavior looks like. After the baseline is established, Cloud SIEM will begin generating Signals when unusual behavior is detected compared to that baseline. Baselines can be per-entity or global. (Note that the longer the baseline, the more accurate the model will be.) +First Seen Rules operate based on a **baseline**. During this period of time - typically between 7 and 30 days - the system will learn what normal and expected behavior looks like. After the baseline is established, SIEM will begin generating Signals when unusual behavior is detected compared to that baseline. Baselines can be per-entity or global. (Note that the longer the baseline, the more accurate the model will be.) -Cloud SIEM will include a set of more than twenty First Seen Rules out of the box. These rules can be tuned and customized like any other rule type, and custom First Seen Rules can also be created. +SIEM will include a set of more than twenty First Seen Rules out of the box. These rules can be tuned and customized like any other rule type, and custom First Seen Rules can also be created. -For more information about how to use First Seen Rules, see the online [documentation](/docs/cse/rules/write-first-seen-rule/). You can also see an introduction to the feature by navigating to a new First Seen Rule in the Cloud SIEM UI. +For more information about how to use First Seen Rules, see the online [documentation](/docs/cse/rules/write-first-seen-rule/). You can also see an introduction to the feature by navigating to a new First Seen Rule in the SIEM UI. #### Entity Timeline @@ -1499,10 +1499,10 @@ For more information about how to use the Entity Timeline, see the online [docum #### Minor Changes and Enhancements ### * [Updated] Entities listed in the Signals index (`sec_signal`) now include `criticality` and `suppressed` attributes (which reflect the state of those Entities when the Signal was generated). -* [New] The Cloud SIEM API now supports searching the Threat Intelligence data by `sourceName`. +* [New] The SIEM API now supports searching the Threat Intelligence data by `sourceName`. * [Updated] The Threat Intelligence API `GetThreatIntelIndicators` endpoint now supports data sets of more than 10,000 indicators. * [Updated] The Insights API now supports searching (filtering) by confidence score. -* [Updated] Cloud SIEM now supports up to 1000 inventory-based Entity Groups (the previous limit was 50). +* [Updated] SIEM now supports up to 1000 inventory-based Entity Groups (the previous limit was 50). * [Updated] When viewing an Insight, a label is displayed that indicates the source. When an Insight is generated by a Custom Insight, it will now say **Custom Insight (Rule)** (instead of **Rule**) and **Custom Insight (Signal)** (instead of **Signal**) to reduce confusion with Insights generated by the Insight Algorithm through standard Rules and Signals. * [New] Entity Groups can now be managed in bulk by uploading CSV files from the Entity Groups list page. @@ -1581,7 +1581,7 @@ Note that the following updates do not change detection capabilities and are onl To assist analysts detect potential security issues as early as possible, a new panel has been added to the Heads Up Display (HUD): -Screenshot of the new Active Entities panel in Cloud SIEM +Screenshot of the new Active Entities panel in SIEM This panel lists the top five most active entities, ranked by **Signal Severity Total**. This metric, which was introduced with the Related Entities enhancement last year, is the total sum of the severities of all unique Signals the Entity appears in during the current Insight detection window (typically, the past 14 days). @@ -1596,7 +1596,7 @@ Analysts can use this tool to investigate what appears to be risky activity and * [New] When looking at Signals in the new `sec_signal` index, attributes and values in array fields are now properly supported by auto-parsing, syntax like `count by`, and features like **right-click* > filter selected value**. * [New] An attribute `attackStage` has been added to the new `sec_signal` index. This attribute summarizes the Mitre attack stage represented by the rule which triggered the signal. The value is defined the same way as the `attack_stage` attribute included in the older Signal forwarding feature. * [Updated] The `subResolution` attribute is now included in the Insight payload for **http v2** actions. -* [Updated] The way Release Notes are listed in the Cloud SIEM UI is changing. There is no longer a “bell” item on the top menu; it has been replaced with a link to the Release Notes page in the Help menu. In addition, Release Notes are now directly visible in the UI when they are published. +* [Updated] The way Release Notes are listed in the SIEM UI is changing. There is no longer a “bell” item on the top menu; it has been replaced with a link to the Release Notes page in the Help menu. In addition, Release Notes are now directly visible in the UI when they are published. * [New] When executing a context action on a Signal, fields will now be passed to the context action if they are available based on the record(s) in context. #### Bug Fixes diff --git a/blog-cse/2024/12-31.md b/blog-cse/2024/12-31.md index 8a45605db7b..786a7fa0666 100644 --- a/blog-cse/2024/12-31.md +++ b/blog-cse/2024/12-31.md @@ -1,12 +1,12 @@ --- -title: 2024 Release Notes Archive - Cloud SIEM +title: 2024 Release Notes Archive - SIEM keywords: - rules - signals - schema - log mappers - parsers - - cloud siem + - siem image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 --- @@ -14,7 +14,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; -This is an archive of 2024 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). +This is an archive of 2024 SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). @@ -70,7 +70,7 @@ Changes are are enumerated below. ### December 6, 2024 - Content Release This content release: -- Introduces new Cloud SIEM detection rules for monitoring activity and alerts from GitHub Enterprise. +- Introduces new SIEM detection rules for monitoring activity and alerts from GitHub Enterprise. - New and updated log parsing and mapping support for: - AWS VPC Transit Gateways Flow Logs - Alert Logic @@ -207,9 +207,9 @@ Changes are enumerated below. --- ### November 8, 2024 - Application Update -#### Cloud SIEM network sensor end-of-life +#### SIEM network sensor end-of-life -The Sumo Logic Product Team is discontinuing our on-premise network sensor feature for Sumo Logic Cloud SIEM. The feature will no longer receive updates as of November 8, 2024, and support ends as of April 30, 2025. We fully support a customer or partner managed [Zeek network sensor](/docs/cse/sensors/ingest-zeek-logs/) as a data source for our Cloud SIEM product that will provide equivalent monitoring of your network. +The Sumo Logic Product Team is discontinuing our on-premise network sensor feature for Sumo Logic SIEM. The feature will no longer receive updates as of November 8, 2024, and support ends as of April 30, 2025. We fully support a customer or partner managed [Zeek network sensor](/docs/cse/sensors/ingest-zeek-logs/) as a data source for our SIEM product that will provide equivalent monitoring of your network. Learn more [here](/docs/cse/sensors/network-sensor-end-of-life/). @@ -982,7 +982,7 @@ Individual changes are enumerated below. ### August 5, 2024 - Content Release This content release includes: -* A new Cloud SIEM First Seen rule +* A new SIEM First Seen rule * Consolidation of AWSGuardDuty log mappers * CrowdStrike FDR mapping modifications by adding `aid` as a value for `device_hostname` as primary or alternate * Mapping update to Windows PowerShell operational events to facilitate a JSON data set from the legacy Windows format @@ -1252,7 +1252,7 @@ This content release includes several new and multiple updated log mappers, plus --- ### May 23, 2024 - Content Release -This release includes new Cloud SIEM detection rules, and updates to existing rules to correct summary and description expressions. All changes are enumerated below. +This release includes new SIEM detection rules, and updates to existing rules to correct summary and description expressions. All changes are enumerated below. #### Rules @@ -1320,7 +1320,7 @@ We've added an advanced rule feature that allows users to override the global si This setting can be accessed from the rule details page: -Rule-Level Signal Suppression Settings in Cloud SIEM +Rule-Level Signal Suppression Settings in SIEM The setting is in the "Show Advanced" section. You can specify a suppression period for the rule between 0 and 168 hours (if you set it to 0, suppression is completely disabled for the rule). @@ -1370,22 +1370,22 @@ This content release includes seventeen new rules and two updated rules. Details We're excited to announce multiple enhancements to our MITRE ATT&CK Threat Coverage Explorer. * **Rules Filtering** - You can now easily filter the coverage visualization based on rules, including out-of-the-box and user-created rules, as well as enabled, disabled, production and prototype rules. -* **All Community Activity** - This view now defaults to show only the vendor and product logs that are being sent to Cloud SIEM from your data sources. This gives you a better comparison between what your theoretical and historical coverage shows and what other customers of Cloud SIEM using those same log sources are seeing. You can still change the filter to display other (or all) log sources. +* **All Community Activity** - This view now defaults to show only the vendor and product logs that are being sent to SIEM from your data sources. This gives you a better comparison between what your theoretical and historical coverage shows and what other customers of SIEM using those same log sources are seeing. You can still change the filter to display other (or all) log sources. * **Customizable Colors** - You can now customize the tile colors to your own scheme.
Custom MITRE ATT&CK Explorer Color Palette For full details, see the [MITRE ATT&CK Coverage documentation](/docs/cse/administration/mitre-coverage/). -#### New UI Themes for Cloud SIEM +#### New UI Themes for SIEM -We are also excited to announce that Cloud SIEM now supports two different UI themes: the default "dark" theme, and a new "light" theme: +We are also excited to announce that SIEM now supports two different UI themes: the default "dark" theme, and a new "light" theme: -Light and Dark theme examples in Cloud SIEM +Light and Dark theme examples in SIEM The theme is set per user, and can be changed on the Sumo Logic user preferences page: Option to change UI theme -Note that the setting currently only affects Cloud SIEM and the Automation Service, but in the future this setting will also affect other pages in the Sumo Logic UI. +Note that the setting currently only affects SIEM and the Automation Service, but in the future this setting will also affect other pages in the Sumo Logic UI. #### Bug fixes @@ -1561,7 +1561,7 @@ This release includes new log mapping and parsing content for Druva Cyber Resili #### Minor changes and enhancements -* [New] Continuing our work to better align the Cloud SIEM UI pages with Log Analytics UI pages to improve usability and provide a consistent user experience, the color palette has been adjusted slightly, some page decoration has been removed or altered, and some controls have been updated. +* [New] Continuing our work to better align the SIEM UI pages with Log Analytics UI pages to improve usability and provide a consistent user experience, the color palette has been adjusted slightly, some page decoration has been removed or altered, and some controls have been updated. * [New] On the Entity list page, you can now filter by reputation indicator (i.e. Malicious, Suspicious or NotFlagged). * [New] Users can now navigate directly from the Entity Activity panel on the HUD to the Entity List page, with the proper filter pre-applied. * [Updated] The `Object Type` attribute has been added back to the Signal summary section, next to the timestamp, so that it is visible whether the Signal details are expanded or collapsed. @@ -1571,7 +1571,7 @@ This release includes new log mapping and parsing content for Druva Cyber Resili * Sorting by value was not working properly on the Entities list page. * Sometimes, if the target value was left blank (default), domain normalization would append a colon to the resulting value. -* Customers were experiencing rate limiting with VirusTotal due to a change to their API and constant retries due to resultant errors in Cloud SIEM. This has been resolved, as has an issue with enrichments for file hashes. +* Customers were experiencing rate limiting with VirusTotal due to a change to their API and constant retries due to resultant errors in SIEM. This has been resolved, as has an issue with enrichments for file hashes. * Some Entities were not showing as being included in Entity Groups properly (even though attributes had been set correctly). * The MITRE ATT&CK® `stage` attribute was missing from some Signals in the audit logs. * Custom inventory sources were not included in the appropriate dropdown in Entity Group configuration. @@ -1617,7 +1617,7 @@ This release includes minor mapping adjustments to Duo and MS Graph Identify Pro * Added principal as primary `user_username` key :::tip -For all the up-to-date Cloud SIEM content, see the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog). +For all the up-to-date SIEM content, see the [SIEM Content Catalog](https://github.com/SumoLogic/siem-content-catalog). ::: @@ -1633,14 +1633,14 @@ This content release includes updates to log mappers for Zeek fixing several bug * [Updated] Zeek conn Activity :::tip -For all the up-to-date Cloud SIEM content, see the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog). +For all the up-to-date SIEM content, see the [SIEM Content Catalog](https://github.com/SumoLogic/siem-content-catalog). ::: --- ### January 12, 2024 - Content Release -This content release includes updates to Cloud SIEM rules, new log mappers, new parsers, and the addition of normalization schema metadata. Specific updates are enumerated below. In addition, a number of rules were updated to include more accurate MITRE ATT&K® tactic and technique tags. +This content release includes updates to SIEM rules, new log mappers, new parsers, and the addition of normalization schema metadata. Specific updates are enumerated below. In addition, a number of rules were updated to include more accurate MITRE ATT&K® tactic and technique tags. #### Rules diff --git a/blog-cse/2025/12-31.md b/blog-cse/2025/12-31.md index 97ae9f06f69..5ad8978717e 100644 --- a/blog-cse/2025/12-31.md +++ b/blog-cse/2025/12-31.md @@ -1,18 +1,18 @@ --- -title: 2025 Release Notes Archive - Cloud SIEM +title: 2025 Release Notes Archive - SIEM keywords: - rules - signals - schema - log mappers - parsers - - cloud siem + - siem image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This is an archive of 2025 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). +This is an archive of 2025 SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive). Release notes are available on our website for a rolling multi-year period. For information about older releases, contact [Support](https://support.sumologic.com/support/s). @@ -32,12 +32,12 @@ For instructions on how to use these and other sources, see [About Sumo Logic Th #### New look for list pages -We're excited to announce a new look for list pages in Cloud SIEM. We've replaced "cards" with table rows for a simpler, cleaner appearance that more closely matches how we present data in the rest of Sumo Logic. This new presentation lets you see more at a glance, allowing you to more quickly evaluate your SIEM data. +We're excited to announce a new look for list pages in SIEM. We've replaced "cards" with table rows for a simpler, cleaner appearance that more closely matches how we present data in the rest of Sumo Logic. This new presentation lets you see more at a glance, allowing you to more quickly evaluate your SIEM data. To learn more, see our list view documentation for: -* [Insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#list-view) +* [Insights](/docs/cse/get-started-with-siem/about-cse-insight-ui/#list-view) * [Entities](/docs/cse/records-signals-entities-insights/view-manage-entities/#about-the-entities-list-page) -* [Signals](/docs/cse/get-started-with-cloud-siem/intro-for-analysts/#dive-into-signals-and-entities) +* [Signals](/docs/cse/get-started-with-siem/intro-for-analysts/#dive-into-signals-and-entities) --- @@ -308,7 +308,7 @@ This content release includes: We’re excited to announce the new insight summary pane, an AI-generated synopsis for each insight that describes the threat incidents that led to its creation. This helps security teams understand incidents faster and accelerate response time. The summary is generated by Sumo Logic's Summary Agent, an agentic AI tool. -[Learn more](/docs/cse/get-started-with-cloud-siem/insight-summary/). +[Learn more](/docs/cse/get-started-with-siem/insight-summary/). Insight summary @@ -1249,7 +1249,7 @@ We're happy to announce that now when you create custom insights, you can select #### Threat Intelligence -We’re excited to introduce Sumo Logic Threat Intelligence, a powerful feature set that enables Cloud SIEM administrators to seamlessly import indicators of Compromise (IoC) files and feeds directly into Sumo Logic to aid in security analysis. +We’re excited to introduce Sumo Logic Threat Intelligence, a powerful feature set that enables SIEM administrators to seamlessly import indicators of Compromise (IoC) files and feeds directly into Sumo Logic to aid in security analysis. For more information, [see our release note](/release-notes-service/2025/12/31/#march-03-2025-security) in the *Service* release notes section. @@ -1325,7 +1325,7 @@ Changes are enumerated below. ### January 31, 2025 - Content Release This content release includes: -- Removal and updates to Cloud SIEM rules. +- Removal and updates to SIEM rules. - Parsing and mapping support for new products. - Updates to existing parsing and mappers to support additional events and field mappings. @@ -1393,7 +1393,7 @@ This content release includes: - Parsing and mapping additions and updates for Cisco ISE, Cloudflare, Check Point Firewall, and Linux OS Syslog. :::note -In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from the out-of-the-box Cloud SIEM rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion. +In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from the out-of-the-box SIEM rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion. ::: #### Log Mappers diff --git a/blog-cse/2026-02-18-application.md b/blog-cse/2026-02-18-application.md index ac24391e80b..4750f512be7 100644 --- a/blog-cse/2026-02-18-application.md +++ b/blog-cse/2026-02-18-application.md @@ -10,4 +10,4 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; ### Bulk update insights -We're happy to announce that you can use the UI or API to update multiple insights at a time, including closing, reassigning, adding comments, or giving them a new status. Acting on multiple insights at once speeds up your insight resolution. [Learn more](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#bulk-update-insights). \ No newline at end of file +We're happy to announce that you can use the UI or API to update multiple insights at a time, including closing, reassigning, adding comments, or giving them a new status. Acting on multiple insights at once speeds up your insight resolution. [Learn more](/docs/cse/get-started-with-siem/about-cse-insight-ui/#bulk-update-insights). \ No newline at end of file diff --git a/blog-cse/2026-07-09-application.md b/blog-cse/2026-07-09-application.md index e296a59e3eb..6afe4bad338 100644 --- a/blog-cse/2026-07-09-application.md +++ b/blog-cse/2026-07-09-application.md @@ -11,4 +11,4 @@ import Iframe from 'react-iframe';  We're happy to announce that we have redesigned the Insight details page by moving the left-side panel to the top header and added comment enhancements, including a rich text editor, for a more streamlined experience. Insight comment page -[Learn more](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#insight-details-page). +[Learn more](/docs/cse/get-started-with-siem/about-cse-insight-ui/#insight-details-page). diff --git a/blog-cse/2026-07-14-content.md b/blog-cse/2026-07-14-content.md index a8e346e7590..102acf2c1ce 100644 --- a/blog-cse/2026-07-14-content.md +++ b/blog-cse/2026-07-14-content.md @@ -12,7 +12,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; **Important Notice** -To better represent and improve reliability of third-party security alerts passed through to Sumo Logic Cloud SIEM, we are introducing six new detection rules. These new rules represent new, more granular categories, enabling easier tuning and improved context from the underlying alerts over the existing Normalized Security Signal passthrough rule (MATCH-S00402). Since this is a significant change and custom content such as tuning expressions and custom insights dependent on the existing passthrough rule will need to be migrated, we will be phasing the migration of vendor/product log mappings which contribute records to the passthroughs over the course of July and August. +To better represent and improve reliability of third-party security alerts passed through to Sumo Logic SIEM, we are introducing six new detection rules. These new rules represent new, more granular categories, enabling easier tuning and improved context from the underlying alerts over the existing Normalized Security Signal passthrough rule (MATCH-S00402). Since this is a significant change and custom content such as tuning expressions and custom insights dependent on the existing passthrough rule will need to be migrated, we will be phasing the migration of vendor/product log mappings which contribute records to the passthroughs over the course of July and August. **Target Dates:** diff --git a/blog-csoar/2024/12-31.md b/blog-csoar/2024/12-31.md index 85c7c0b2a72..18d63f507ab 100644 --- a/blog-csoar/2024/12-31.md +++ b/blog-csoar/2024/12-31.md @@ -58,7 +58,7 @@ This release introduces new integrations, new playbooks, and several updates. * [Updated] [Microsoft Sentinel](/docs/platform-services/automation-service/app-central/integrations/microsoft-sentinel) * [Updated] [Netskope V2](/docs/platform-services/automation-service/app-central/integrations/netskope-v2) * [Updated] [Slack](/docs/platform-services/automation-service/app-central/integrations/slack) -* [Updated] [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem) +* [Updated] [Sumo Logic SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem) * [Updated] [Sumo Logic Notifications by Gmail](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-notifications-by-gmail) * [Updated] [URLScan.io](/docs/platform-services/automation-service/app-central/integrations/urlscan.io) * [Updated] [VirusTotal](/docs/platform-services/automation-service/app-central/integrations/virustotal) @@ -203,8 +203,8 @@ This release introduces two new integrations and several updates to integrations * [Updated] [Microsoft EWS Daemon](/docs/platform-services/automation-service/app-central/integrations/microsoft-ews-daemon/) * [Updated] [ServiceNow V2](/docs/platform-services/automation-service/app-central/integrations/servicenow-v2/) * [Updated] [Slack](/docs/platform-services/automation-service/app-central/integrations/slack/) -* [Updated] [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem/) -* [Updated] [Sumo Logic Cloud SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal/) +* [Updated] [Sumo Logic SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem/) +* [Updated] [Sumo Logic SIEM Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem-internal/) * [Updated] [Sumo Logic Log Analytics](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics/) * [Updated] [Sumo Logic Log Analytics Internal](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-log-analytics-internal/) * [Updated] [VirusTotal](/docs/platform-services/automation-service/app-central/integrations/virustotal/) diff --git a/blog-csoar/2025/12-31.md b/blog-csoar/2025/12-31.md index 89826715ec2..d6001dc30b5 100644 --- a/blog-csoar/2025/12-31.md +++ b/blog-csoar/2025/12-31.md @@ -311,7 +311,7 @@ This release introduces new integrations, new playbooks, and several updates. * [Updated] [HTTP Tools](/docs/platform-services/automation-service/app-central/integrations/http-tools) * [Updated] [ServiceNow V2](/docs/platform-services/automation-service/app-central/integrations/servicenow-v2) * [Updated] [Slack](/docs/platform-services/automation-service/app-central/integrations/slack) -* [Updated] [Sumo Logic Cloud SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem) +* [Updated] [Sumo Logic SIEM](/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem) --- diff --git a/blog-service/2022/12-31.md b/blog-service/2022/12-31.md index 3fcb78d9f6c..0be4aad57af 100644 --- a/blog-service/2022/12-31.md +++ b/blog-service/2022/12-31.md @@ -155,7 +155,7 @@ Update - We’ve made multiple updates to the [Search Results Table](/docs/searc --- ## October 14, 2022 (Manage) -Update - We’ve released an improvement that eases the processes of administering and monitoring [Sumo Logic Orgs](/docs/manage/manage-subscription/create-and-manage-orgs/create-manage-orgs). To streamline the child org provisioning process, we added support for auto-provisioning Cloud SIEM instances for both enterprise and MSSP customers. +Update - We’ve released an improvement that eases the processes of administering and monitoring [Sumo Logic Orgs](/docs/manage/manage-subscription/create-and-manage-orgs/create-manage-orgs). To streamline the child org provisioning process, we added support for auto-provisioning SIEM instances for both enterprise and MSSP customers. --- ## October 7, 2022 (Manage) @@ -408,7 +408,7 @@ Update - The Sumo App for Amazon DynamoDB uses logs and metrics to provide opera Update - The Sumo Logic Amazon RDS App dashboards provide visibility into your Amazon Relational Database Service (RDS) performance and operations. Preconfigured dashboards allow you to monitor critical metrics of your RDS cluster, including CPU, memory, storage, the network transmits and receive throughput, read and write operations, database connection count, disk queue depth, and more. Audit activity dashboards help you monitor activities performed on your RDS infrastructure. This app updates from the AWS observability solution in the App Catalog. Updates include upgrading all the dashboards to Dashboards(New). New Audit activity dashboards help you monitor activities performed on your RDS infrastructure and RDS instance-specific dashboard support for - Aurora and MySQL and Performance Insights dashboards. -Update - Sumo Logic and AWS are excited to announce an update to [Sumo Logic Integrations for AWS Organizations](https://aws.amazon.com/quickstart/architecture/sumo-logic-for-aws-organizations/). This solution allows joint customers of AWS and Sumo Logic to automate the integration of [AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/architecture.html)-compliant organizations with [Sumo Logic Cloud SIEM powered by AWS](https://aws.amazon.com/marketplace/pp/prodview-o622lpl6biu6s). +Update - Sumo Logic and AWS are excited to announce an update to [Sumo Logic Integrations for AWS Organizations](https://aws.amazon.com/quickstart/architecture/sumo-logic-for-aws-organizations/). This solution allows joint customers of AWS and Sumo Logic to automate the integration of [AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/architecture.html)-compliant organizations with [Sumo Logic SIEM powered by AWS](https://aws.amazon.com/marketplace/pp/prodview-o622lpl6biu6s). Our updates support Security Reference Architecture (SRA)-compliant setup of: diff --git a/blog-service/2024/12-31.md b/blog-service/2024/12-31.md index 76603f168a6..40806dcbbce 100644 --- a/blog-service/2024/12-31.md +++ b/blog-service/2024/12-31.md @@ -488,7 +488,7 @@ Learn more [here](/docs/dashboards/scheduled-report/#create-a-scheduled-report). We're excited to announce the opt-in general availability of our Sumo Logic New UI. This release introduces several enhancements designed to improve your overall experience: -* **Unified Navigation**. Access all Observability features (e.g., Alerts, Log Search, Metrics) and Security features (e.g., Cloud SIEM, Cloud SOAR) through a single, unified left-navigation menu. Unlike the Classic UI, there's no need to navigate away when switching between Observability and Security tools. +* **Unified Navigation**. Access all Observability features (e.g., Alerts, Log Search, Metrics) and Security features (e.g., SIEM, Cloud SOAR) through a single, unified left-navigation menu. Unlike the Classic UI, there's no need to navigate away when switching between Observability and Security tools. * **Streamlined Administration**. Key administrative functions such as Data Configuration, Help, and User Preferences are now conveniently located in the top toolbar for easier access. * **Enhanced Browsing Experience**. We've replaced in-app tabs with native browser tabs to provide a more familiar browsing experience. Enjoy session history, back button support, favorites, and other native browser functionalities. * **Improved Performance**. The simplified UI boosts performance and usability, offering a smoother and faster browsing experience that enables quicker incident resolution. Key improvements include: @@ -989,7 +989,7 @@ Our built-in HipChat CSE Action was [deprecated in August 2022](/release-notes-c We're excited to announce the availability of the Closed Beta version of our updated Sumo Logic User Interface (UI). This release brings several enhancements aimed at improving your overall experience: -* **Unified Navigation**. Seamlessly access all Observability features (e.g., Alerts, Log Search, APM, Metrics) alongside Security features (e.g., Cloud SIEM, Cloud SOAR) from a single, unified left-navigation menu. This is a significant improvement over our legacy Classic UI, where users had to navigate away from Sumo Logic when using Cloud SIEM or SOAR. +* **Unified Navigation**. Seamlessly access all Observability features (e.g., Alerts, Log Search, APM, Metrics) alongside Security features (e.g., SIEM, Cloud SOAR) from a single, unified left-navigation menu. This is a significant improvement over our legacy Classic UI, where users had to navigate away from Sumo Logic when using SIEM or SOAR. * **Streamlined Administration**. Administrative functions, Data Configuration, Help, and User Preferences have been relocated to the top toolbar menu for simplified access. * **Enhanced Browsing Experience**. Now, instead of in-app tabs, you can utilize native browser tabs for a more familiar browsing experience, complete with session history, the back button, favorites, and other native browser capabilities. * **Improved Performance**. With a simplified UI, you'll experience accelerated performance, enhanced usability, and a consistently smooth browsing experience, empowering you to troubleshoot incidents faster. We've achieved significant improvements in two primary metrics: diff --git a/blog-service/2025/12-31.md b/blog-service/2025/12-31.md index d0846177d42..fbafaf2324f 100644 --- a/blog-service/2025/12-31.md +++ b/blog-service/2025/12-31.md @@ -711,18 +711,18 @@ We're excited to introduce the new Palo Alto Networks 11 app for Sumo Logic. Thi AWS is streamlining [CloudTrail](https://aws.amazon.com/cloudtrail/) events for [IAM Identity Center](https://aws.amazon.com/iam/identity-center/) to retain only the essential fields needed for audit and incident response workflows. These changes improve user identification and integration with directories like Okta and Microsoft Active Directory, and do not impact CloudTrail events from other AWS services. -- To support this AWS update, Sumo Logic has revised several AWS apps and Cloud SIEM parsers. You are requested to reinstall the affected apps. +- To support this AWS update, Sumo Logic has revised several AWS apps and SIEM parsers. You are requested to reinstall the affected apps. - If you use CloudTrail data in the saved searches, dashboards, or detection rules, you are required to update your custom content before AWS enforces the changes on July 14, 2025. To learn more, see [Important changes to CloudTrail events for AWS IAM Identity Center](https://aws.amazon.com/blogs/security/modifications-to-aws-cloudtrail-event-data-of-iam-identity-center/). ##### Impact following the AWS CloudTrail updates -AWS is updating CloudTrail events for IAM Identity Center, affecting how user identity data is structured. So, if you are using the updated fields in your Cloud SIEM content or across the Sumo Logic platform, you need to update any saved queries, dashboards, or detection rules to reflect these changes and ensure continued functionality. +AWS is updating CloudTrail events for IAM Identity Center, affecting how user identity data is structured. So, if you are using the updated fields in your SIEM content or across the Sumo Logic platform, you need to update any saved queries, dashboards, or detection rules to reflect these changes and ensure continued functionality. Key actions required while updating the AWS CloudTrail include: - Sumo Logic provided apps must be manually reinstalled to incorporate the updated event field mappings. -- Cloud SIEM parsers have auto-updated and require no customer intervention. +- SIEM parsers have auto-updated and require no customer intervention. ##### Action plan for Sumo Logic users @@ -1075,14 +1075,14 @@ Here's what's changed since the [last rollout](/release-notes-service/2024/12/31 #### Threat Intelligence -We’re excited to introduce Sumo Logic Threat Intelligence, a powerful feature set that enables Cloud SIEM administrators to seamlessly import indicators of Compromise (IoC) files and feeds directly into Sumo Logic to aid in security analysis. IoCs are individual data points about threats that are gathered from external sources about various entities such as host names, file hashes, IP addresses, and other known targets for compromise. +We’re excited to introduce Sumo Logic Threat Intelligence, a powerful feature set that enables SIEM administrators to seamlessly import indicators of Compromise (IoC) files and feeds directly into Sumo Logic to aid in security analysis. IoCs are individual data points about threats that are gathered from external sources about various entities such as host names, file hashes, IP addresses, and other known targets for compromise. -Once indicators are ingested and appear on the **Threat Intelligence** tab, Cloud SIEM analysts can use the `hasThreatMatch` function in Cloud SIEM rules to analyze incoming records for matches to the threat intelligence indicators. +Once indicators are ingested and appear on the **Threat Intelligence** tab, SIEM analysts can use the `hasThreatMatch` function in SIEM rules to analyze incoming records for matches to the threat intelligence indicators. Sumo Logic Threat Intelligence will help you stay ahead of emerging threats and enhance your security posture. :::note -Only Cloud SIEM administrators can add threat intelligence indicators to the datastore. +Only SIEM administrators can add threat intelligence indicators to the datastore. ::: [Learn more](/docs/security/threat-intelligence/about-threat-intelligence). diff --git a/blog-service/2026-01-30-apps.md b/blog-service/2026-01-30-apps.md index d69ca8a503f..53b7802e6c2 100644 --- a/blog-service/2026-01-30-apps.md +++ b/blog-service/2026-01-30-apps.md @@ -13,5 +13,5 @@ hide_table_of_contents: true - **Sumo Logic Audit app**. Added monitor alerts for the [Sumo Logic Audit](/docs/integrations/sumo-apps/audit) app. - **CrowdStrike - Falcon Endpoint Protection app**. Updated the sample log messages, dashboards, and monitor alerts for [CrowdStrike - Falcon Endpoint Protection](/docs/integrations/security-threat-detection/crowdstrike-falcon-endpoint-protection/) app to coordinate it with `EppDetectionSummaryEvent` data type. - **Azure Container Instances app**. Updated the [Azure Container Instances](/docs/integrations/microsoft-azure/azure-container-instances/) app to set the default value for `resource_type` to `CONTAINERGROUPS` and added the `!category` field in log query scope. -- **Windows Source Template**. Released the Windows Source Template version 9.1.0, which tags the default `_parser` for logs forwarded to Cloud SIEM. For detailed version information, refer to the [changelog file](/docs/send-data/opentelemetry-collector/remote-management/source-templates/windows/changelog/#910---2026-01-19). +- **Windows Source Template**. Released the Windows Source Template version 9.1.0, which tags the default `_parser` for logs forwarded to SIEM. For detailed version information, refer to the [changelog file](/docs/send-data/opentelemetry-collector/remote-management/source-templates/windows/changelog/#910---2026-01-19). - **Updated OpenTelemetry apps**. [Redis](/docs/integrations/databases/opentelemetry/redis-opentelemetry/) and [HAProxy](/docs/integrations/web-servers/opentelemetry/haproxy-opentelemetry/). diff --git a/blog-service/2026-02-27-apps.md b/blog-service/2026-02-27-apps.md index 61fe990a93f..4f32814e028 100644 --- a/blog-service/2026-02-27-apps.md +++ b/blog-service/2026-02-27-apps.md @@ -13,7 +13,7 @@ We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and - **Azure Security apps**. Updated [Microsoft Defender for Endpoint](/docs/integrations/microsoft-azure/microsoft-defender-for-endpoint/#azure-security---microsoft-defender-for-endpoint-alerts), [Microsoft Defender for Identity](/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-identity/#azure-security---microsoft-defender-for-identity-alerts), [Microsoft Defender for Office 365](/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-office-365/#azure-security---microsoft-defender-for-office-365-alerts), and [Microsoft Graph Security](/docs/integrations/saas-cloud/microsoft-graph-security-v2/#microsoft-graph-security-alerts) with refreshed content and new monitor alerts to detect high-severity incidents, suspicious devices, and activity from embargoed or high-risk locations. - **Data Volume**. Added monitor alerts to track log ingestion, detect usage spikes or data gaps, and prevent unexpected credit overages. [Learn more](/docs/integrations/sumo-apps/data-volume/#data-volume-app-alerts). -- **Enterprise Audit apps**. Updated [Enterprise Audit - Collector & Data Forwarding Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---collector-and-data-forwarding-management-app), [Enterprise Audit - Content Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---content-management-alerts), [Enterprise Audit – Cloud SIEM](/docs/integrations/sumo-apps/cse/#enterprise-audit---cloud-siem-alerts), [Enterprise Audit - Security Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---security-management-alerts), and [Enterprise Audit - User & Role Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---user-and-role-management-alerts) with monitor alerts to improve compliance, detect misconfigurations, identify embargoed-location activity, and surface high-risk security events. +- **Enterprise Audit apps**. Updated [Enterprise Audit - Collector & Data Forwarding Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---collector-and-data-forwarding-management-app), [Enterprise Audit - Content Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---content-management-alerts), [Enterprise Audit – SIEM](/docs/integrations/sumo-apps/cse/#enterprise-audit---siem-alerts), [Enterprise Audit - Security Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---security-management-alerts), and [Enterprise Audit - User & Role Management](/docs/integrations/sumo-apps/enterprise-audit/#enterprise-audit---user-and-role-management-alerts) with monitor alerts to improve compliance, detect misconfigurations, identify embargoed-location activity, and surface high-risk security events. - **Enterprise Search Audit**. Added the **Enterprise Search Audit – Failures KPIs and Breakdowns** dashboard and monitor alerts to track search reliability, performance, and cost-related risks. [Learn more](/docs/integrations/sumo-apps/enterprise-search-audit/). - **Flex**. Added monitor alerts to help you detect ingestion spikes, prevent budget overruns, and control expensive queries by automatically flagging abnormal data usage and credit consumption before they impact costs or system stability. [Learn more](/docs/integrations/sumo-apps/flex/#flex-app-alerts). - **Infrequent Data Tier**. Added monitor alerts that help you control costs and usage by detecting consumption spikes, expensive or failed queries, and abnormal user or module-level scan activity before they waste credits. [Learn more](/docs/integrations/sumo-apps/infrequent-data-tier/#infrequent-data-tier-app-alerts). diff --git a/blog-service/2026-05-29-apps.md b/blog-service/2026-05-29-apps.md index ccc2c668e62..c46063799da 100644 --- a/blog-service/2026-05-29-apps.md +++ b/blog-service/2026-05-29-apps.md @@ -14,7 +14,7 @@ We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and - **CyberArk Audit**. Updated existing monitor alerts and dashboards, and added two new dashboards for **Identity Threat Detection** and **Privileged Access & Secrets**. [Learn more](/docs/integrations/saas-cloud/cyberark-audit/). - **CyberArk EPM**. Enhanced the CyberArk EPM app with a dashboard-enriched experience for improved visibility into endpoint privilege management activities. [Learn more](/docs/integrations/saas-cloud/cyberark-epm). - **Duo Security**. Added an IDP category for the Duo Security app in the app catalog. [Learn more](/docs/integrations/security-threat-detection/duo-security/). -- **Enterprise Audit - Cloud SIEM**. Updated the queries in **Cloud SIEM - Insights Overview** and **Cloud SIEM - Insights Closed** dashboards. [Learn more](/docs/integrations/sumo-apps/cse). +- **Enterprise Audit - SIEM**. Updated the queries in **SIEM - Insights Overview** and **SIEM - Insights Closed** dashboards. [Learn more](/docs/integrations/sumo-apps/cse). - **Google Cloud - Security Command Center**. Updated the log queries to add `nodrop` to the JSON field extraction, ensuring that findings with missing or incomplete fields are retained in the results rather than being dropped. [Learn more](/docs/integrations/google/cloud-security-command-center/). - **Microsoft Azure AD Inventory**. Updated the existing queries and dashboards for **Users Overview**, **Devices Overview**, and **Device Risk and Compliance**, along with monitor alerts to strengthen security and device monitoring. [Learn more](/docs/integrations/saas-cloud/microsoft-azure-ad-inventory). - **Microsoft Graph Azure AD Reporting**. Added an IDP category for the Microsoft Graph Azure AD Reporting app in the app catalog. [Learn more](/docs/integrations/saas-cloud/microsoft-graph-azure-ad-reporting/). diff --git a/cid-redirects.json b/cid-redirects.json index bf573ba1031..8f8dcab4289 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -296,7 +296,7 @@ "/docs/send-data/hosted-collectors/amazon-aws/aws-cost-explorer": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/aws-cost-explorer-source", "/docs/send-data/hosted-collectors/amazon-aws/aws-cost-explorer-source": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/aws-cost-explorer-source", "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Azure_Event_Hubs_Source": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source", - "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Carbon_Black_Cloud_Source": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black", + "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Carbon_Black_Cloud_Source": "/docs/cse/ingestion/ingestion-sources-for-siem/carbon-black", "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Carbon_Black_Inventory_Source": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source", "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Cisco_AMP_Source": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source", "/03Send-Data/Sources/02Sources-for-Hosted-Collectors/Cloud-to-Cloud_Integration_Framework/Cloud-to-Cloud_Source_Versions": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloud-to-cloud-source-versions", @@ -769,9 +769,9 @@ "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Lambda/01Collect-Logs-for-the-AWS-Lambda-App": "/docs/observability/aws/integrations/aws-lambda", "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Lambda/AWS-Lambda-App-Dashboards": "/docs/observability/aws/integrations/aws-lambda", "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Lambda": "/docs/observability/aws/integrations/aws-lambda", - "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", - "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall/Collect_Logs_for_AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", - "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall/Install_the_AWS_Network_Firewall_App_and_View_the_Dashboards": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", + "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall/Collect_Logs_for_AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Network_Firewall/Install_the_AWS_Network_Firewall_App_and_View_the_Dashboards": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Security_Hub": "/docs/integrations/amazon-aws/security-hub", "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Security_Hub/1-Ingest-findings-into-AWS-Security_Hub": "/docs/integrations/amazon-aws/security-hub", "/07Sumo-Logic-Apps/01Amazon_and_AWS/AWS_Security_Hub/2-Collect-findings-for-the-AWS-Security-Hub-App": "/docs/integrations/amazon-aws/security-hub", @@ -1175,12 +1175,12 @@ "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Carbon_Black_Cloud/Collect_Logs_for_Carbon_Black_Cloud": "/docs/integrations/security-threat-detection/carbon-black-cloud", "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Carbon_Black/Collect_logs_for_Carbon_Black": "/docs/integrations/security-threat-detection/carbon-black-cloud", "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Carbon_Black_Cloud/Install_the_Carbon_Black_Cloud_App_and_View_the_Dashboards": "/docs/integrations/security-threat-detection/carbon-black-cloud", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA/01Collect_Logs_for_the_Cisco_ASA_App": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA/Cisco-ASA-App-Dashboards": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Collect_logs_for_the_Cisco_Meraki_App": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", - "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Install_the_Cisco_Meraki_App_and_View_the_Dashboards": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA/01Collect_Logs_for_the_Cisco_ASA_App": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_ASA/Cisco-ASA-App-Dashboards": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Collect_logs_for_the_Cisco_Meraki_App": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/Cisco_Meraki/Install_the_Cisco_Meraki_App_and_View_the_Dashboards": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/CloudPassage_Halo": "/docs/integrations/security-threat-detection/cloudpassage-halo", "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/CloudPassage_Halo/01Collect-Logs-for-the-CloudPassage-Halo-App": "/docs/integrations/security-threat-detection/cloudpassage-halo", "/07Sumo-Logic-Apps/22Security_and_Threat_Detection/CloudPassage_Halo/03CloudPassage-Halo-App-Dashboards": "/docs/integrations/security-threat-detection/cloudpassage-halo", @@ -1404,7 +1404,7 @@ "/APIs/Account_Management_API": "/docs/api/account-management", "/APIs/Alerts-API": "/docs/api", "/APIs/Archive_Ingestion_Management_API": "/docs/api/archive-ingestion", - "/APIs/Cloud_SIEM_Enterprise_API": "/docs/api/cloud-siem-enterprise", + "/APIs/Cloud_SIEM_Enterprise_API": "/docs/api/siem-enterprise", "/APIs/Collector-Management-API": "/docs/api/collector-management", "/APIs/01Collector_Management_API": "/docs/api/collector-management", "/APIs/01Collector_Management_API/Sumo_Logic_Endpoints": "/docs/api/collector-management", @@ -1487,7 +1487,7 @@ "/Archive": "/docs/release-notes", "/Archive/Collector_Release_Notes_Archive": "/release-notes-collector", "/docs/api/collectors": "/docs/api/collector-management", - "/docs/api/cse": "/docs/api/cloud-siem-enterprise", + "/docs/api/cse": "/docs/api/siem-enterprise", "/docs/api/fields": "/docs/api/field-management", "/docs/api/folders": "/docs/api/folder-management", "/docs/api/monitors": "/docs/api/monitors-management", @@ -1981,7 +1981,7 @@ "/cid/1974": "/docs/integrations/security-threat-detection/twistlock", "/cid/1975": "/docs/observability/kubernetes/apps", "/cid/1976": "/docs/integrations/google/kubernetes-engine", - "/cid/1977": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", + "/cid/1977": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", "/cid/1978": "/docs/integrations/databases/mongodb-atlas", "/cid/1979": "/docs/integrations/amazon-aws/eks-control-plane", "/cid/1980": "/docs/observability/kubernetes", @@ -2143,7 +2143,7 @@ "/cid/24841": "/docs/integrations/security-threat-detection/palo-alto-networks-9", "/cid/25611": "/docs/integrations/saas-cloud/akamai-cloud-monitor", "/cid/25612": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source", - "/cid/25613": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black", + "/cid/25613": "/docs/cse/ingestion/ingestion-sources-for-siem/carbon-black", "/cid/25614": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source", "/cid/25615": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source", "/cid/25630": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-meraki-source", @@ -2196,7 +2196,7 @@ "/cid/35360": "/docs/get-started/library", "/cid/35361": "/docs/integrations/databases/oracle", "/cid/35362": "/docs/integrations/databases/oracle", - "/cid/35364": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit", + "/cid/35364": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", "/cid/39393": "/docs/send-data/collect-from-other-data-sources/autosubscribe-arn-destination", "/cid/3001": "/docs/search/search-query-language/group-aggregate-operators/count-count-distinct-and-count-frequent", "/cid/3003": "/docs/search/search-query-language/group-aggregate-operators/first-last", @@ -2383,8 +2383,8 @@ "/cid/5055": "/docs/dashboards/panels/single-value-charts", "/cid/50555": "/docs/integrations/containers-orchestration/kubernetes-control-plane", "/cid/5056": "/docs/dashboards/about/", - "/cid/5064": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/cid/5065": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", + "/cid/5064": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/cid/5065": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", "/cid/5067": "/docs/integrations/amazon-aws/cloudfront", "/cid/5068": "/docs/integrations/amazon-aws/cloudtrail", "/cid/5070": "/docs/integrations/amazon-aws/cloudtrail", @@ -2589,9 +2589,9 @@ "/cid/5368": "/docs/dashboards/panels/single-value-charts", "/cid/5375": "/", "/cid/5377": "/docs/search/behavior-insights/logreduce/understand-the-logreduce-relevance-column", - "/cid/5378": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail", + "/cid/5378": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", "/cid/5379": "/docs/integrations/amazon-aws/classic-load-balancer", - "/cid/5380": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail", + "/cid/5380": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", "/cid/5381": "/docs/integrations/containers-orchestration/vmware-legacy", "/cid/5382": "/docs/integrations/pci-compliance", "/cid/5383": "/docs/integrations/sumo-apps", @@ -2648,7 +2648,7 @@ "/cid/60047": "/docs/integrations/saas-cloud/dropbox", "/cid/6004": "/docs/integrations/saas-cloud/salesforce", "/cid/6005": "/docs/integrations/google/workspace/install-app-dashboards", - "/cid/6006": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office", + "/cid/6006": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-audit-office", "/cid/6007": "/docs/observability/aws/integrations/aws-lambda", "/cid/6008": "/docs/integrations/saas-cloud/pagerduty-v2", "/cid/6009": "/docs/integrations/databases/mongodb", @@ -2817,7 +2817,7 @@ "/cid/9002": "/docs/integrations/web-servers/nginx-ingress", "/cid/9003": "/docs/integrations/microsoft-azure/windows-json", "/cid/9004": "/docs/integrations/microsoft-azure/active-directory-json", - "/cid/9006": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", + "/cid/9006": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", "/cid/9008": "/docs/alerts/webhook-connections/new-relic", "/cid/10333": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules", "/cid/10334": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules/include-and-exclude-rules", @@ -3035,7 +3035,7 @@ "/Cloud_SIEM_Enterprise/Administration/Cloud_SIEM_Enterprise_Feature_Update_(2022)": "/docs/cse/administration", "/Cloud_SIEM_Enterprise/Administration/Create_a_Custom_Tag_Schema": "/docs/cse/administration/create-a-custom-tag-schema", "/Cloud_SIEM_Enterprise/Administration/Configure_a_Custom_Inventory_Source": "/docs/cse/administration/custom-inventory-sources", - "/Cloud_SIEM_Enterprise/Administration/Create_a_Custom_Threat_Intel_Source": "/docs/security/threat-intelligence/threat-indicators-in-cloud-siem", + "/Cloud_SIEM_Enterprise/Administration/Create_a_Custom_Threat_Intel_Source": "/docs/security/threat-intelligence/threat-indicators-in-siem", "/Cloud_SIEM_Enterprise/Administration/Create_and_Use_Network_Blocks": "/docs/cse/administration/create-use-network-blocks", "/Cloud_SIEM_Enterprise/Administration/Create_CSE_Actions": "/docs/cse/administration/create-cse-actions", "/Cloud_SIEM_Enterprise/Administration/Create_CSE_Context_Actions": "/docs/cse/administration/create-cse-context-actions", @@ -3050,37 +3050,37 @@ "/Cloud_SIEM_Enterprise/CSE_Ingestion/00CSE_Ingestion_Best_Practices": "/docs/cse/ingestion/cse-ingestion-best-practices", "/Cloud_SIEM_Enterprise/CSE_Ingestion/00Products_with_Log_Mappings": "/docs/cse/ingestion/products-with-log-mappings", "/Cloud_SIEM_Enterprise/CSE_Ingestion/01View_a_list_of_Mappers_for_a_Product": "/docs/cse/ingestion/view-mappers-for-product", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Auth0": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_Application_Load_Balancer": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_CloudTrail": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_GuardDuty": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_VPC_Flow": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Carbon_Black_Cloud": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Check_Point_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Corelight_Zeek": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Fortigate_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/G_Suite_Alert_Center": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Google_G_Suite_Apps_Audit": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit", - "/docs/cse/ingestion/google-g-suite-apps-audit": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Kemp_LoadMaster": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Linux_OS_Syslog": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_365_Audit_(Office_365_Audit)": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_Azure_Activity_Log": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_Windows": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Nginx_Access_Logs": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Okta": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/OneLogin": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Osquery": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Palo_Alto_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/SentinelOne": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Signal_Sciences_WAF": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Symantec_Proxy_Secure_Gateway": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Symantec_Proxy_Secure_Gateway_(Blue_Coat_Proxy)": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/ZScaler_NSS": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss", - "/Cloud_SIEM_Enterprise/CSE_Ingestion/Zscaler_Private_Access": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Auth0": "/docs/cse/ingestion/ingestion-sources-for-siem/auth0", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_Application_Load_Balancer": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-application-load-balancer", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_CloudTrail": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_GuardDuty": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-guardduty", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/AWS_VPC_Flow": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-vpc-flow", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Carbon_Black_Cloud": "/docs/cse/ingestion/ingestion-sources-for-siem/carbon-black", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Check_Point_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/check-point-firewall", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Corelight_Zeek": "/docs/cse/ingestion/ingestion-sources-for-siem/corelight-zeek", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Fortigate_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/fortigate-firewall", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/G_Suite_Alert_Center": "/docs/cse/ingestion/ingestion-sources-for-siem/g-suite-alert-center", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Google_G_Suite_Apps_Audit": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", + "/docs/cse/ingestion/google-g-suite-apps-audit": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Kemp_LoadMaster": "/docs/cse/ingestion/ingestion-sources-for-siem/kemp-loadmaster", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Linux_OS_Syslog": "/docs/cse/ingestion/ingestion-sources-for-siem/linux-os-syslog", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_365_Audit_(Office_365_Audit)": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-audit-office", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_Azure_Activity_Log": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-azure-activity-log", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Microsoft_Windows": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-windows", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Nginx_Access_Logs": "/docs/cse/ingestion/ingestion-sources-for-siem/nginx-access-logs", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Okta": "/docs/cse/ingestion/ingestion-sources-for-siem/okta", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/OneLogin": "/docs/cse/ingestion/ingestion-sources-for-siem/onelogin", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Osquery": "/docs/cse/ingestion/ingestion-sources-for-siem/osquery", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Palo_Alto_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/palo-alto-firewall", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/SentinelOne": "/docs/cse/ingestion/ingestion-sources-for-siem/sentinelone", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Signal_Sciences_WAF": "/docs/cse/ingestion/ingestion-sources-for-siem/signal-sciences-waf", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Symantec_Proxy_Secure_Gateway": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Symantec_Proxy_Secure_Gateway_(Blue_Coat_Proxy)": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/ZScaler_NSS": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-nss", + "/Cloud_SIEM_Enterprise/CSE_Ingestion/Zscaler_Private_Access": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-private-access", "/Cloud_SIEM_Enterprise/CSE_Ingestion/ztConfigure_a_Sumo_Logic_Ingest_Mapping": "/docs/cse/ingestion/sumo-logic-ingest-mapping", "/Cloud_SIEM_Enterprise/CSE_Rules": "/docs/cse/rules", "/Cloud_SIEM_Enterprise/CSE_Rules/01_About_CSE_Rules": "/docs/cse/rules/about-cse-rules", @@ -3095,9 +3095,9 @@ "/docs/cse/rules/import-yara-rules": "/docs/cse/sensors/ingest-zeek-logs", "/Cloud_SIEM_Enterprise/CSE_Rules/Normalized_Authentication_Rules": "/docs/cse/rules/normalized-authentication-rules", "/Cloud_SIEM_Enterprise/CSE_Rules/Normalized_Threat_Rules": "/docs/cse/rules/normalized-threat-rules", - "/docs/cloud-siem/actions-automation": "/docs/cse/automation", - "/docs/cloud-siem/rules": "/docs/cse/rules", - "/docs/cloud-siem/cse-ui": "/docs/cse", + "/docs/siem/actions-automation": "/docs/cse/automation", + "/docs/siem/rules": "/docs/cse/rules", + "/docs/siem/cse-ui": "/docs/cse", "/docs/cse/rules/rule-expression-syntax": "/docs/cse/rules/cse-rules-syntax", "/Cloud_SIEM_Enterprise/CSE_Rules/Rule_Tuning_Expressions": "/docs/cse/rules/rule-tuning-expressions", "/Cloud_SIEM_Enterprise/CSE_Rules/Tailor_a_Global_Rule": "/docs/cse/rules/tailor-global-rule", @@ -3128,11 +3128,11 @@ "/Cloud_SIEM_Enterprise/CSE_Sensors/Ingest_Zeek_Logs": "/docs/cse/sensors/ingest-zeek-logs", "/Cloud_SIEM_Enterprise/Ingestion_Guides": "/docs/cse/ingestion", "/Cloud_SIEM_Enterprise/Ingestion_Guides/00Products_with_Log_Mappings": "/docs/cse/ingestion/products-with-log-mappings", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Linux_OS_Syslog": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Microsoft_Windows": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Fortigate_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Palo_Alto_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Cisco_Meraki": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Linux_OS_Syslog": "/docs/cse/ingestion/ingestion-sources-for-siem/linux-os-syslog", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Microsoft_Windows": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-windows", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Fortigate_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/fortigate-firewall", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Palo_Alto_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/palo-alto-firewall", "/Cloud_SIEM_Enterprise/Insights/Insight_Generation_Process": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Integrations": "/docs/cse/integrations", "/Cloud_SIEM_Enterprise/Integrations/Configuring_a_ThreatQ_Source_in_CSE": "/docs/cse/integrations/configuring-threatq-source-in-cse", @@ -3153,13 +3153,13 @@ "/Cloud_SIEM_Enterprise/Match_Lists_and_Suppressed_Lists/Match_Fields_Reference": "/docs/cse/match-lists-suppressed-lists/match-fields-reference", "/Cloud_SIEM_Enterprise/Match_Lists_and_Suppressed_Lists/Standard_Match_Lists": "/docs/cse/match-lists-suppressed-lists/standard-match-lists", "/Cloud_SIEM_Enterprise/Match_Lists_and_Suppressed_Lists/Suppressed_Lists": "/docs/cse/match-lists-suppressed-lists/suppressed-lists", - "/docs/cse/onboard/log-mappings": "/docs/cse/get-started-with-cloud-siem", + "/docs/cse/onboard/log-mappings": "/docs/cse/get-started-with-siem", "/docs/cse/parsers/parser-overview": "/docs/api/parsers-library-management", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/About_the_CSE_Insight_UI": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/About_Signal_Suppression": "/docs/cse/records-signals-entities-insights/about-signal-suppression", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/Configure_a_Custom_Insight": "/docs/cse/records-signals-entities-insights/create-custom-entity-type", - "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/00Insight_Generation_Process": "/docs/cse/get-started-with-cloud-siem/insight-generation-process", + "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/00Insight_Generation_Process": "/docs/cse/get-started-with-siem/insight-generation-process", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/03View_and_Manage_Entities": "/docs/cse/records-signals-entities-insights/view-manage-entities", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/05Set_Insight_Generation_Window_and_Threshold": "/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/07Entity_Criticality": "/docs/cse/records-signals-entities-insights/entity-criticality", @@ -3172,7 +3172,7 @@ "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/Create_an_Entity_Group": "/docs/cse/records-signals-entities-insights/create-an-entity-group", "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/Save_Inventory_Data_to_a_Lookup_Table": "/docs/cse/administration", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights": "/docs/cse/records-signals-entities-insights", - "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/00Insight_Generation_Process": "/docs/cse/get-started-with-cloud-siem/insight-generation-process", + "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/00Insight_Generation_Process": "/docs/cse/get-started-with-siem/insight-generation-process", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/05Set_Insight_Generation_Window_and_Threshold": "/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold", "/docs/cse/records-signals-entities-insights/signal-index-migration-faq": "/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo", "/docs/cse/records-signals-entities-insights/signals-overview": "/docs/cse/records-signals-entities-insights", @@ -3181,9 +3181,9 @@ "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/13Using_Tags_with_Insights%2C_Signals%2C_Entities%2C_and_Rules": "/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/17View_Records_for_a_Signal": "/docs/cse/records-signals-entities-insights/view-records-signal", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/About_Signal_Suppression": "/docs/cse/records-signals-entities-insights/about-signal-suppression", - "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/About_the_CSE_Insight_UI": "/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui", + "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/About_the_CSE_Insight_UI": "/docs/cse/get-started-with-siem/about-cse-insight-ui", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/Configure_a_Custom_Insight": "/docs/cse/records-signals-entities-insights/configure-custom-insight", - "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/CSE_Heads_Up_Display": "/docs/cse/get-started-with-cloud-siem/cse-heads-up-display", + "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/CSE_Heads_Up_Display": "/docs/cse/get-started-with-siem/cse-heads-up-display", "/Collect/Microsoft_Windows/Windows_Security_Event_Logs/Configure_Windows_Security_Event_Logs_Collection/Microsoft_Defender_Advanced_Threat_Protection": "/docs/send-data/installed-collectors/sources", "/Global_Intelligence": "/docs/integrations/global-intelligence", "/Global_Intelligence/Global_Intelligence_for_Apache_Tomcat_App": "/docs/integrations/global-intelligence", @@ -3740,7 +3740,7 @@ "/Release-Notes/Developer-Release-Notes": "/release-notes-developer", "/Release-Notes/Cloud_SIEM_Enterprise_Release_Notes": "/release-notes-cse", "/docs/observability/aws/integrations/global-intelligence-cloudtrail-devops": "/docs/integrations/amazon-aws/global-intelligence-cloudtrail-devops", - "/docs/releasenotes/cloud-siem": "/release-notes-cse", + "/docs/releasenotes/siem": "/release-notes-cse", "/docs/releasenotes/collector": "/release-notes-collector", "/docs/releasenotes/developer": "/release-notes-developer", "/docs/releasenotes/service": "/release-notes-service", @@ -4490,50 +4490,50 @@ "/docs/integrations/security-threat-detection/ueba": "/docs/integrations/cloud-security-monitoring-analytics", "/docs/cse/integrations/automation-service": "/docs/cse/automation", "/docs/cse/integrations/automation-service-enrichments": "/docs/cse/integrations/enrichments-and-indicators", - "/docs/cse/ingestion/auth0": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0", - "/docs/cse/ingestion/aws-application-load-balancer": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer", - "/docs/cse/ingestion/aws-cloudtrail": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail", - "/docs/cse/ingestion/aws-guardduty": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty", - "/docs/cse/ingestion/aws-network-firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", - "/docs/cse/ingestion/aws-vpc-flow": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow", - "/docs/cse/ingestion/carbon-black": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black", - "/docs/cse/ingestion/check-point-firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall", - "/docs/cse/ingestion/cisco-asa": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/docs/cse/ingestion/cisco-meraki": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki", - "/docs/cse/ingestion/corelight-zeek": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek", - "/docs/cse/ingestion/fortigate": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall", - "/docs/cse/ingestion/fortigate-firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall", - "/docs/cse/ingestion/google-workspace-apps-audit": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit", - "/docs/cse/ingestion/g-suite-alert-center": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center", - "/docs/cse/ingestion/kemp-loadmaster": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster", - "/docs/cse/ingestion/linux-os-syslog": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog", - "/docs/cse/ingestion/microsoft-audit-office": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office", - "/docs/cse/ingestion/microsoft-azure-activity-log": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log", - "/docs/cse/ingestion/microsoft-windows": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows", - "/docs/cse/ingestion/nginx-access-logs": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs", - "/docs/cse/ingestion/okta": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta", - "/docs/cse/ingestion/onelogin": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin", - "/docs/cse/ingestion/osquery": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery", - "/docs/cse/ingestion/palo-alto-firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall", - "/docs/cse/ingestion/sentinelone": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone", - "/docs/cse/ingestion/signal-sciences-waf": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf", - "/docs/cse/ingestion/symantec-proxy-secure-gateway-blue-coat-proxy": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/docs/cse/ingestion/symantec-proxy-secure-gateway": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/docs/cse/ingestion/zscaler-nss": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss", - "/docs/cse/ingestion/zscaler-private-access": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access", - "/docs/cse/administration/onboarding-checklist-cse": "/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse", + "/docs/cse/ingestion/auth0": "/docs/cse/ingestion/ingestion-sources-for-siem/auth0", + "/docs/cse/ingestion/aws-application-load-balancer": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-application-load-balancer", + "/docs/cse/ingestion/aws-cloudtrail": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", + "/docs/cse/ingestion/aws-guardduty": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-guardduty", + "/docs/cse/ingestion/aws-network-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/docs/cse/ingestion/aws-vpc-flow": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-vpc-flow", + "/docs/cse/ingestion/carbon-black": "/docs/cse/ingestion/ingestion-sources-for-siem/carbon-black", + "/docs/cse/ingestion/check-point-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/check-point-firewall", + "/docs/cse/ingestion/cisco-asa": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/docs/cse/ingestion/cisco-meraki": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/docs/cse/ingestion/corelight-zeek": "/docs/cse/ingestion/ingestion-sources-for-siem/corelight-zeek", + "/docs/cse/ingestion/fortigate": "/docs/cse/ingestion/ingestion-sources-for-siem/fortigate-firewall", + "/docs/cse/ingestion/fortigate-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/fortigate-firewall", + "/docs/cse/ingestion/google-workspace-apps-audit": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", + "/docs/cse/ingestion/g-suite-alert-center": "/docs/cse/ingestion/ingestion-sources-for-siem/g-suite-alert-center", + "/docs/cse/ingestion/kemp-loadmaster": "/docs/cse/ingestion/ingestion-sources-for-siem/kemp-loadmaster", + "/docs/cse/ingestion/linux-os-syslog": "/docs/cse/ingestion/ingestion-sources-for-siem/linux-os-syslog", + "/docs/cse/ingestion/microsoft-audit-office": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-audit-office", + "/docs/cse/ingestion/microsoft-azure-activity-log": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-azure-activity-log", + "/docs/cse/ingestion/microsoft-windows": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-windows", + "/docs/cse/ingestion/nginx-access-logs": "/docs/cse/ingestion/ingestion-sources-for-siem/nginx-access-logs", + "/docs/cse/ingestion/okta": "/docs/cse/ingestion/ingestion-sources-for-siem/okta", + "/docs/cse/ingestion/onelogin": "/docs/cse/ingestion/ingestion-sources-for-siem/onelogin", + "/docs/cse/ingestion/osquery": "/docs/cse/ingestion/ingestion-sources-for-siem/osquery", + "/docs/cse/ingestion/palo-alto-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/palo-alto-firewall", + "/docs/cse/ingestion/sentinelone": "/docs/cse/ingestion/ingestion-sources-for-siem/sentinelone", + "/docs/cse/ingestion/signal-sciences-waf": "/docs/cse/ingestion/ingestion-sources-for-siem/signal-sciences-waf", + "/docs/cse/ingestion/symantec-proxy-secure-gateway-blue-coat-proxy": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/docs/cse/ingestion/symantec-proxy-secure-gateway": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/docs/cse/ingestion/zscaler-nss": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-nss", + "/docs/cse/ingestion/zscaler-private-access": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-private-access", + "/docs/cse/administration/onboarding-checklist-cse": "/docs/cse/get-started-with-siem/onboarding-checklist-cse", "/docs/cse/administration/threat-intelligence": "/docs/security/threat-intelligence", "/docs/security/threat-intelligence/notice-about-taxii-2": "/docs/security/threat-intelligence", "/docs/cse/records": "/docs/cse/records-signals-entities-insights", - "/docs/cse/records-signals-entities-insights/about-cse-insight-ui": "/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui", - "/docs/cse/records-signals-entities-insights/cse-heads-up-display": "/docs/cse/get-started-with-cloud-siem/cse-heads-up-display", - "/docs/cse/records-signals-entities-insights/insight-generation-process": "/docs/cse/get-started-with-cloud-siem/insight-generation-process", - "/docs/cse/get-started-with-cloud-siem/introduction-to-cloud-siem": "/docs/cse/get-started-with-cloud-siem", - "/docs/cse/cloud-siem-content-catalog": "/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog", - "/docs/cse/cloud-siem/mapping-map-record-fields-to-schema": "/docs/cse/schema/create-structured-log-mapping", - "/docs/cse/cloud-siem/entities": "/docs/cse/records-signals-entities-insights", - "/docs/cse/introduction-to-cloud-siem": "/docs/cse/get-started-with-cloud-siem", + "/docs/cse/records-signals-entities-insights/about-cse-insight-ui": "/docs/cse/get-started-with-siem/about-cse-insight-ui", + "/docs/cse/records-signals-entities-insights/cse-heads-up-display": "/docs/cse/get-started-with-siem/cse-heads-up-display", + "/docs/cse/records-signals-entities-insights/insight-generation-process": "/docs/cse/get-started-with-siem/insight-generation-process", + "/docs/cse/get-started-with-siem/introduction-to-siem": "/docs/cse/get-started-with-siem", + "/docs/cse/siem-content-catalog": "/docs/cse/get-started-with-siem/siem-content-catalog", + "/docs/cse/siem/mapping-map-record-fields-to-schema": "/docs/cse/schema/create-structured-log-mapping", + "/docs/cse/siem/entities": "/docs/cse/records-signals-entities-insights", + "/docs/cse/introduction-to-siem": "/docs/cse/get-started-with-siem", "/docs/integrations/sumo-apps/security-foundations": "/docs/integrations/sumo-apps", "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs", "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-amazon-kinesis": "/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs", @@ -4597,9 +4597,9 @@ "/docs/cloud-infrastructure-security/application-security": "/docs/security/additional-security-features/application-security", "/docs/security/automation/playbooks": "/docs/platform-services/automation-service", "/docs/cse/automation-service/": "/docs/cse/automation", - "/docs/cse/automation-service/about-automation-service": "/docs/cse/automation/about-automation-service-and-cloud-siem", - "/docs/cse/automation-service/automation-service-automations": "/docs/cse/automation/automations-in-cloud-siem", - "/docs/cse/automation-service/automation-service-examples": "/docs/cse/automation/cloud-siem-automation-examples", + "/docs/cse/automation-service/about-automation-service": "/docs/cse/automation/about-automation-service-and-siem", + "/docs/cse/automation-service/automation-service-automations": "/docs/cse/automation/automations-in-siem", + "/docs/cse/automation-service/automation-service-examples": "/docs/cse/automation/siem-automation-examples", "/docs/cse/automation-service/automation-service-app-central": "/docs/platform-services/automation-service/automation-service-app-central", "/docs/cse/automation-service/automation-service-playbooks": "/docs/platform-services/automation-service/playbooks", "/docs/platform-services/automation-service/automation-service-playbooks": "/docs/platform-services/automation-service/playbooks", @@ -4742,8 +4742,8 @@ "/Cloud_SIEM_Enterprise/Match_Lists/Custom_Match_List_Columns": "/docs/cse/match-lists-suppressed-lists", "/Cloud_SIEM_Enterprise/CSE_Sensors/01_Windows_Sensor_Overview": "/docs/cse/sensors", "/Cloud_SIEM_Enterprise/CSE_Sensors/21_Windows_Sensor_Installation_(Legacy": "/docs/cse/sensors", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_VPC_Flow": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/G_Suite_Alert_Center": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_VPC_Flow": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-vpc-flow", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/G_Suite_Alert_Center": "/docs/cse/ingestion/ingestion-sources-for-siem/g-suite-alert-center", "/Cloud_SIEM_Enterprise/Integrations/Insight_Enrichment_Server/Install_the_Insight_Enrichment_Server_(FedRAMP": "/docs/cse/integrations/insight-enrichment-server", "/01Start-Here/02Getting-Started/Certification_FAQs": "/docs/get-started/training-certification-faq", "/01Start-Here/Quick-Start-Tutorials/Using_Sumo_Logic_Tutorial": "/docs/get-started", @@ -4868,8 +4868,8 @@ "/docs/search/query-language/operators/formatdate": "/docs/search/search-query-language/search-operators/formatdate", "/docs/search/search-query-language/search-operators/save-lookups-classic": "/docs/search/search-query-language/search-operators", "/docs/search/search-query-language/search-operators/stats": "/docs/search/search-query-language/search-operators", - "/docs/security/cloud-siem/records-signals-entities-insights": "/docs/cse/records-signals-entities-insights", - "/docs/security/threat-intelligence/find-threats-with-cloud-siem": "/docs/security/threat-intelligence", + "/docs/security/siem/records-signals-entities-insights": "/docs/cse/records-signals-entities-insights", + "/docs/security/threat-intelligence/find-threats-with-siem": "/docs/security/threat-intelligence", "/docs/send-data/collect-from-integrations/kubernetes": "/docs/send-data/kubernetes", "/docs/send-data/collect-from-other-data-sources/amazon-aws/aws-cloudtrail": "/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source", "/docs/send-data/collect-from-other-data-sources/collect-from-amazon-web-services/amazon-eks": "/docs/send-data", @@ -4967,7 +4967,7 @@ "/07Sumo-Logic-Apps/04Microsoft-and-Azure/Azure_Audit/02_Collect_Metrics_for_Azure_Audit_from_Event_Hub": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source", "/07Sumo-Logic-Apps/10Containers_and_Orchestration/Docker/Docker-App-Dashboards": "/docs/integrations/containers-orchestration/docker-community-edition", "/Beta/Sumo_Logic_Cloud_SIEM/Cloud_SIEM_Rules": "/docs/cse/rules/cse-built-in-rules", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/SentinelOne": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/SentinelOne": "/docs/cse/ingestion/ingestion-sources-for-siem/sentinelone", "/Dashboards-and-Alerts/Alerts/09-Scheduled-Search-FAQs/Create-an-Email-Alert-to-Notify-you-when-Data-Usage-Reaches-90-Percent-of-your-Account-Limit": "/docs/alerts/scheduled-searches/create-email-alert", "/Dashboards-and-Alerts/Dashboards/Edit-Dashboards-and-Panels/Editing_Shared_Dashboards": "/docs/dashboards", "/Dashboards-and-Alerts/Dashboards/Get-Started-with-Dashboards-and-Panels/Dashboard-Optimization": "/docs/dashboards", @@ -4998,7 +4998,7 @@ "/docs/schema": "/docs/cse/schema", "/docs/search/search-query-language/search-operators/json": "/docs/search/search-query-language/parse-operators/parse-json-formatted-logs", "/docs/security/threat-intelligence/threat-intel-faq": "/docs/security/threat-intelligence/threat-intelligence-indicators", - "/docs/send-data/cloud-siem": "/docs/cse/ingestion", + "/docs/send-data/siem": "/docs/cse/ingestion", "/docs/send-data/collectors/collector-management/uninstall-collector": "/docs/send-data/installed-collectors", "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-source": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source", "/docs/send-data/http-source": "/docs/send-data/hosted-collectors/http-source", @@ -5035,14 +5035,14 @@ "/docs/search/scheduled-searches": "/docs/alerts/scheduled-searches", "/docs/search/search-query-language/search-operators/values": "/docs/search/search-query-language/search-operators", "/docs/send-data/installed-collectors/collector-api": "/docs/api/collector-management", - "/docs/send-data/service-appliance": "/docs/cse/get-started-with-cloud-siem/intro-for-analysts", + "/docs/send-data/service-appliance": "/docs/cse/get-started-with-siem/intro-for-analysts", "/Dashboards-and-Alerts/Alerts/09-Scheduled-Search-FAQs/How-to-Prevent-your-Scheduled-Search-from-Timing-Out": "/docs/alerts/scheduled-searches/faq", "/docs/integrations/saas-cloud/duo-security": "/docs/integrations/security-threat-detection/duo-security", "/05Search/Search-Cheat-Sheets/Log-Operators.-Cheat-Sheet": "/docs/search/search-cheat-sheets/log-operators", "/Apps/Apache_App/Apache_App_Dashboards": "/docs/integrations/web-servers/apache", "/Apps/Apache_App/Install_the_Apache_App": "/docs/integrations/web-servers/apache", "/Beta/Saved_beta_content/Beta_-_Library": "/docs/preview", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Zscaler_Private_Access": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Zscaler_Private_Access": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-private-access", "/Dashboards-and-Alerts/Alerts/09-Scheduled-Search-FAQs/Why-Would-a-Scheduled-Search-Fail": "/docs/alerts/scheduled-searches/faq", "/Search/Get-Started-with-Search/Search-Basics/Save-a-Search": "/docs/search/get-started-with-search/search-basics/save-search", "/Send-Data/Applications-and-Other-Data-Sources/Amazon-Inspector-App": "/docs/integrations/amazon-aws/inspector-classic", @@ -5068,8 +5068,8 @@ "/docs/reuse/apps/app-install-sumo-apps": "/docs/get-started/apps-integrations", "/docs/reuse/apps/create-aws-s3-source": "/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source", "/docs/reuse/budget-assignment": "/docs/manage/ingestion-volume/ingest-budgets", - "/docs/reuse/cse-api-table": "/docs/api/cloud-siem-enterprise", - "/docs/reuse/cse-dynamic-severity": "/docs/api/cloud-siem-enterprise", + "/docs/reuse/cse-api-table": "/docs/api/siem-enterprise", + "/docs/reuse/cse-dynamic-severity": "/docs/api/siem-enterprise", "/docs/reuse/csoar-api-table": "/docs/api/cloud-soar", "/docs/send-data/collectors/hosted-collectors": "/docs/send-data/hosted-collectors", "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/office-365-audit-source": "/docs/send-data/hosted-collectors/microsoft-source/ms-office-audit-source", @@ -5191,7 +5191,7 @@ "/Cloud_SIEM_Enterprise/CSE_Sensors/15_Cloud_Sensor_Guide": "/docs/cse/sensors", "/Cloud_SIEM_Enterprise/Match_Lists/Create_a_Match_List": "/docs/cse/match-lists-suppressed-lists/create-match-list", "/Cloud_SIEM_Enterprise/Administration/CSE_User_Accounts_and_Roles": "/docs/cse/administration/cse-user-accounts-and-roles", - "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/CSE_Heads_Up_Display": "/docs/cse/get-started-with-cloud-siem/cse-heads-up-display", + "/Cloud_SIEM_Enterprise/Records,_Signals,_Entities,_and_Insights/CSE_Heads_Up_Display": "/docs/cse/get-started-with-siem/cse-heads-up-display", "/Send-Data/Data-Types/GitHub": "/docs/integrations/app-development/github", "/Send-Data/Data_Types/Active_Directory": "/docs/integrations/microsoft-azure/active-directory-json", "/Send_Data/Data_Types/CIS_AWS_Foundations_Benchmark_App": "/docs/integrations/amazon-aws/cis-aws-foundations-benchmark", @@ -5260,7 +5260,7 @@ "/Beta/Data_Volume_App_V2": "/docs/manage/ingestion-volume/data-volume-index", "/Beta/Dynamic-Parsing": "/docs/search/get-started-with-search/build-search/dynamic-parsing", "/Beta/Search_Cookbook": "/docs/search/search-cheat-sheets/general-search-examples", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Osquery": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Osquery": "/docs/cse/ingestion/ingestion-sources-for-siem/osquery", "/Manage/Connections-and-Integrations/Webhook-Connections/Webhook_Connections_for_Jira/Webhook_Connection_for_Jira_Service_Desk": "/docs/alerts/webhook-connections/jira-service-desk", "/Manage/Ingestion-and-Volume/Search_Audit_Index": "/docs/manage/security/audit-indexes/search-audit-index", "/Manage/Ingestion_and_Volume/Log_Ingest_Data_Volume_Index": "/docs/manage/ingestion-volume/data-volume-index/log-tracing-data-volume-index", @@ -5326,17 +5326,17 @@ "/Cloud_SIEM_Enterprise/CSE_Sensors/Log_Sensor_Troubleshooting": "/docs/cse/sensors", "/Cloud_SIEM_Enterprise/CSE_Sensors/Network_Sensor_Deployment_Guide": "/docs/cse/sensors", "/Cloud_SIEM_Enterprise/Entities_and_Insights/Entity_Criticality": "/docs/cse/records-signals-entities-insights", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_Application_Load_Balancer": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_CloudTrail": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Auth0": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Check_Point_Firewall": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Google_G_Suite_Apps_Audit": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Microsoft_Azure_Activity_Log": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Signal_Sciences_WAF": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/Symantec_Proxy_Secure_Gateway": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy", - "/Cloud_SIEM_Enterprise/Ingestion_Guides/ZScaler_NSS": "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_Application_Load_Balancer": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-application-load-balancer", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_CloudTrail": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/AWS_Network_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Auth0": "/docs/cse/ingestion/ingestion-sources-for-siem/auth0", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Check_Point_Firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/check-point-firewall", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Cisco_ASA": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Google_G_Suite_Apps_Audit": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Microsoft_Azure_Activity_Log": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-azure-activity-log", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Signal_Sciences_WAF": "/docs/cse/ingestion/ingestion-sources-for-siem/signal-sciences-waf", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/Symantec_Proxy_Secure_Gateway": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/Cloud_SIEM_Enterprise/Ingestion_Guides/ZScaler_NSS": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-nss", "/Cloud_SIEM_Enterprise/Integrations/Forward_CSE_Signals_to_Sumo_Logic": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Match_Lists/Match_Fields_Reference": "/docs/cse/match-lists-suppressed-lists", "/Dashboards-and-Alerts/Alerts/Save-to-Index": "/docs/alerts/scheduled-searches/save-to-index", @@ -5599,5 +5599,53 @@ "/Visualizations-and-Alerts/Alerts/09-Scheduled-Search-FAQs/Create-an-Email-Alert-to-Notify-you-when-Data-Usage-Reaches-90-Percent-of-your-Account-Limit": "/docs/alerts/scheduled-searches/faq", "/Visualizations-and-Alerts/Alerts/09-Scheduled-Search-FAQs/Real_Time_Alert_with_greater_than_1,000_results": "/docs/alerts/scheduled-searches/faq", "/Visualizations-and-Alerts/Dashboards/Get-Started-with-Dashboards-and-Panels/Delete-a-Dashboard": "/docs/dashboards", - "/Visualizations-and-Alerts/Dashboards/Get-Started-with-Dashboards-and-Panels/Zoom-in-on-a-Panel": "/docs/dashboards" + "/Visualizations-and-Alerts/Dashboards/Get-Started-with-Dashboards-and-Panels/Zoom-in-on-a-Panel": "/docs/dashboards", + "/docs/api/cloud-siem-enterprise": "/docs/api/siem-enterprise", + "/docs/cse/automation/about-automation-service-and-cloud-siem": "/docs/cse/automation/about-automation-service-and-siem", + "/docs/cse/automation/automations-in-cloud-siem": "/docs/cse/automation/automations-in-siem", + "/docs/cse/automation/cloud-siem-automation-examples": "/docs/cse/automation/siem-automation-examples", + "/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui": "/docs/cse/get-started-with-siem/about-cse-insight-ui", + "/docs/cse/get-started-with-cloud-siem/cse-heads-up-display": "/docs/cse/get-started-with-siem/cse-heads-up-display", + "/docs/cse/get-started-with-cloud-siem": "/docs/cse/get-started-with-siem", + "/docs/cse/get-started-with-cloud-siem/insight-generation-process": "/docs/cse/get-started-with-siem/insight-generation-process", + "/docs/cse/get-started-with-cloud-siem/insight-summary": "/docs/cse/get-started-with-siem/insight-summary", + "/docs/cse/get-started-with-cloud-siem/intro-for-administrators": "/docs/cse/get-started-with-siem/intro-for-administrators", + "/docs/cse/get-started-with-cloud-siem/intro-for-analysts": "/docs/cse/get-started-with-siem/intro-for-analysts", + "/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse": "/docs/cse/get-started-with-siem/onboarding-checklist-cse", + "/docs/cse/get-started-with-cloud-siem/cloud-siem-content-catalog": "/docs/cse/get-started-with-siem/siem-content-catalog", + "/docs/cse/get-started-with-cloud-siem/cloud-siem-ui": "/docs/cse/get-started-with-siem/siem-ui", + "/docs/cse/get-started-with-cloud-siem/soc-analyst-agent": "/docs/cse/get-started-with-siem/soc-analyst-agent", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/auth0": "/docs/cse/ingestion/ingestion-sources-for-siem/auth0", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-application-load-balancer": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-application-load-balancer", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-cloudtrail": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-cloudtrail", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-guardduty": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-guardduty", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-network-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-network-firewall", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/aws-vpc-flow": "/docs/cse/ingestion/ingestion-sources-for-siem/aws-vpc-flow", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black": "/docs/cse/ingestion/ingestion-sources-for-siem/carbon-black", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/check-point-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/check-point-firewall", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-asa": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-asa", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/cisco-meraki": "/docs/cse/ingestion/ingestion-sources-for-siem/cisco-meraki", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/corelight-zeek": "/docs/cse/ingestion/ingestion-sources-for-siem/corelight-zeek", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/fortigate-firewall", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center": "/docs/cse/ingestion/ingestion-sources-for-siem/g-suite-alert-center", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/google-workspace-apps-audit": "/docs/cse/ingestion/ingestion-sources-for-siem/google-workspace-apps-audit", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem": "/docs/cse/ingestion/ingestion-sources-for-siem", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/kemp-loadmaster": "/docs/cse/ingestion/ingestion-sources-for-siem/kemp-loadmaster", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog": "/docs/cse/ingestion/ingestion-sources-for-siem/linux-os-syslog", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-audit-office": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-audit-office", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-azure-activity-log": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-azure-activity-log", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/microsoft-windows": "/docs/cse/ingestion/ingestion-sources-for-siem/microsoft-windows", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/nginx-access-logs": "/docs/cse/ingestion/ingestion-sources-for-siem/nginx-access-logs", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/okta": "/docs/cse/ingestion/ingestion-sources-for-siem/okta", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/onelogin": "/docs/cse/ingestion/ingestion-sources-for-siem/onelogin", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/osquery": "/docs/cse/ingestion/ingestion-sources-for-siem/osquery", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/palo-alto-firewall": "/docs/cse/ingestion/ingestion-sources-for-siem/palo-alto-firewall", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone": "/docs/cse/ingestion/ingestion-sources-for-siem/sentinelone", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/signal-sciences-waf": "/docs/cse/ingestion/ingestion-sources-for-siem/signal-sciences-waf", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy": "/docs/cse/ingestion/ingestion-sources-for-siem/symantec-proxy-secure-gateway-blue-coat-proxy", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-nss", + "/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-private-access": "/docs/cse/ingestion/ingestion-sources-for-siem/zscaler-private-access", + "/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem-internal": "/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem-internal", + "/docs/platform-services/automation-service/app-central/integrations/sumo-logic-cloud-siem": "/docs/platform-services/automation-service/app-central/integrations/sumo-logic-siem", + "/docs/security/threat-intelligence/threat-indicators-in-cloud-siem": "/docs/security/threat-intelligence/threat-indicators-in-siem" } diff --git a/docs/alerts/scheduled-searches/generate-cse-signals.md b/docs/alerts/scheduled-searches/generate-cse-signals.md index a92f9a35b94..abe4d75d235 100644 --- a/docs/alerts/scheduled-searches/generate-cse-signals.md +++ b/docs/alerts/scheduled-searches/generate-cse-signals.md @@ -1,13 +1,13 @@ --- id: generate-cse-signals -title: Generate Cloud SIEM Signals With a Scheduled Search -sidebar_label: Generate Cloud SIEM Signals -description: Create a Sumo Logic scheduled search to generate Cloud SIEM signals, with guidance on required fields, MITRE ATT&CK stage mappings, and record type schemas. +title: Generate SIEM Signals With a Scheduled Search +sidebar_label: Generate SIEM Signals +description: Create a Sumo Logic scheduled search to generate SIEM signals, with guidance on required fields, MITRE ATT&CK stage mappings, and record type schemas. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This page has information about creating a scheduled search that will trigger a Cloud SIEM signal. Before you start using Scheduled Searches to create Cloud SIEM signals, it is helpful to understand what signals are, and how they relate to the generation of Cloud SIEM insights. For information about how it all works see [Insight Generation Process](/docs/cse/get-started-with-cloud-siem/insight-generation-process/).  +This page has information about creating a scheduled search that will trigger a SIEM signal. Before you start using Scheduled Searches to create SIEM signals, it is helpful to understand what signals are, and how they relate to the generation of SIEM insights. For information about how it all works see [Insight Generation Process](/docs/cse/get-started-with-siem/insight-generation-process/).  :::note For a more detailed description of the options you can configure for a scheduled search, see [Create a Scheduled Search](/docs/alerts/scheduled-searches/schedule-search/). @@ -15,16 +15,16 @@ For a more detailed description of the options you can configure for a scheduled ## Requirements for the search query -When you [create a scheduled search](/docs/alerts/scheduled-searches/schedule-search/) to generate signals in Cloud SIEM, you start by creating a search query. +When you [create a scheduled search](/docs/alerts/scheduled-searches/schedule-search/) to generate signals in SIEM, you start by creating a search query. -This section describes the requirements for your scheduled search, which include a minimum set of fields to be returned, and renaming message fields as necessary to match attribute names in the selected Cloud SIEM record type schema.   +This section describes the requirements for your scheduled search, which include a minimum set of fields to be returned, and renaming message fields as necessary to match attribute names in the selected SIEM record type schema.   ### Required fields There are several fields that your scheduled search must return to enable signal generation: -* `normalizedseverity`. This field must contain a value between (and including) 0 and 10. Signals generated by the scheduled search will have this severity value. SIgnal severity values are used by Cloud SIEM’s insight generation algorithm, as described above.  +* `normalizedseverity`. This field must contain a value between (and including) 0 and 10. Signals generated by the scheduled search will have this severity value. SIgnal severity values are used by SIEM’s insight generation algorithm, as described above.  * `stage`. This field must contain a Tactic in the MITRE ATT&CK framework, one of the following: * Collection * Command and Control @@ -61,13 +61,13 @@ enable signal generation: ### Renaming message fields -When you configure a Scheduled Search to create Cloud SIEM signals, you are prompted to select a [Cloud SIEM record type](/docs/cse/schema/cse-record-types/). The fields returned by your search must match an attribute in the record type you select. A field whose name does not match a Cloud SIEM attribute will not be populated in the record created from the Schedule Search results. For more about Cloud SIEM attribute names, see [Attributes You Can Map to Records](/docs/cse/schema/attributes-map-to-records/). +When you configure a Scheduled Search to create SIEM signals, you are prompted to select a [SIEM record type](/docs/cse/schema/cse-record-types/). The fields returned by your search must match an attribute in the record type you select. A field whose name does not match a SIEM attribute will not be populated in the record created from the Schedule Search results. For more about SIEM attribute names, see [Attributes You Can Map to Records](/docs/cse/schema/attributes-map-to-records/). ### Example Let's suppose that `user_username` is the entity field we want to use, and its value needs to be mapped to `actor.email`. Then you need to add the following line to the query: `actor.email as user_username`. -And because the final output of this query is an aggregate, and Cloud SIEM signals expect `normalizedfield`, `stage`, and `entity`, we need need to add those in the `count` expression. +And because the final output of this query is an aggregate, and SIEM signals expect `normalizedfield`, `stage`, and `entity`, we need need to add those in the `count` expression. This is how the final query might look: @@ -87,7 +87,7 @@ AND _sourcecategory = "GoogleWorkspace/Groups" 1. After creating and saving your search, click the save icon.
Save the search 1. The **Save Item** popup appears.
Save as scheduled search :::note - The name of your scheduled search will appear as the signal name in Cloud SIEM. + The name of your scheduled search will appear as the signal name in SIEM. ::: 1. Click **Schedule this search**. 1. The **Save Item** popup prompts you to select a run frequency.
Run frequency @@ -104,10 +104,10 @@ AND _sourcecategory = "GoogleWorkspace/Groups" 1. **Record Type**. Select a [record type](/docs/cse/schema/cse-record-types/). 1. Click **Save**. -## View signals in Cloud SIEM +## View signals in SIEM -To view signals that were created from a scheduled search, run a keyword search on “Scheduled Search” on the **Signals** page in the Cloud SIEM UI: -1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Cloud SIEM**, and then select **Signals** in the top menu. +To view signals that were created from a scheduled search, run a keyword search on “Scheduled Search” on the **Signals** page in the SIEM UI: +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **SIEM > Signals**. You can also click the **Go To...** menu at the top of the screen and select **Signals**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **SIEM**, and then select **Signals** in the top menu. 1. Click in the **Filters** field at the top of the screen. 1. Type **Scheduled Search** and press Enter. The keyword search returns a list of all signals created by scheduled searches. 1. Click a signal from the list. Below is a screenshot of a signal that was created from a scheduled search. Note that: diff --git a/docs/alerts/scheduled-searches/index.md b/docs/alerts/scheduled-searches/index.md index 7da367f25b1..3382256ef34 100644 --- a/docs/alerts/scheduled-searches/index.md +++ b/docs/alerts/scheduled-searches/index.md @@ -1,7 +1,7 @@ --- slug: /alerts/scheduled-searches title: Scheduled Searches -description: Schedule log searches in Sumo Logic to run continuously and send alerts, save results to an index or lookup table, or generate Cloud SIEM signals. +description: Schedule log searches in Sumo Logic to run continuously and send alerts, save results to an index or lookup table, or generate SIEM signals. --- import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -41,8 +41,8 @@ A _Scheduled Search_ is a standard [Log Search](/docs/search) that you save and
- Calendar icon

Generate Cloud SIEM Signals with a Scheduled Search

 -

Learn how to create a Scheduled Search that will trigger a Cloud SIEM Signal.

+ Calendar icon

Generate SIEM Signals with a Scheduled Search

 +

Learn how to create a Scheduled Search that will trigger a SIEM Signal.

diff --git a/docs/alerts/scheduled-searches/schedule-search.md b/docs/alerts/scheduled-searches/schedule-search.md index 0844f607eb0..7a0889c28c8 100644 --- a/docs/alerts/scheduled-searches/schedule-search.md +++ b/docs/alerts/scheduled-searches/schedule-search.md @@ -111,7 +111,7 @@ When creating a Scheduled Search, you can configure various alert types, includi * [Webhook](/docs/alerts/webhook-connections/schedule-searches-webhook-connections). Send Sumo Logic alerts to third-party applications that accept incoming webhooks. For example, once you set up a Webhook connection in Sumo Logic, and create a Scheduled Search, then you can send an alert from that Scheduled Search as a post to a Slack channel, or integrate with third-party systems. * [Save to Index](save-to-index.md). Save search results to an index for future retrieval. This way, your data can be searched at a later time using `_index=index_name` with increased search performance. * [Save to Lookup](save-to-lookup.md). Save results to a [Lookup Table](../../search/lookup-tables/create-lookup-table.md) and use the [`lookup`](/docs/search/search-query-language/search-operators/lookup) operator for data enrichment. -* [Cloud SIEM Signal](generate-cse-signals.md). Trigger the creation of a Cloud SIEM Signal, which are otherwise generated when the conditions of a Cloud SIEM rule are satisfied by a Record. +* [SIEM Signal](generate-cse-signals.md). Trigger the creation of a SIEM Signal, which are otherwise generated when the conditions of a SIEM rule are satisfied by a Record. ## Troubleshooting diff --git a/docs/alerts/webhook-connections/servicenow/index.md b/docs/alerts/webhook-connections/servicenow/index.md index 8b750f4bb5b..4bbc92b4d28 100644 --- a/docs/alerts/webhook-connections/servicenow/index.md +++ b/docs/alerts/webhook-connections/servicenow/index.md @@ -45,5 +45,5 @@ In this section, we'll introduce the following concepts: :::tip * To import and maintain real-time information about AWS and VMware virtual machine assets into the ServiceNow CMDB, see the [Service Graph Installation and Configuration Guide](https://store.servicenow.com/appStoreAttachments.do?sys_id=d06467ab1bdab4d051a62132604bcb5e) -* For the Sumo Logic Cloud SIEM integration with the ServiceNow Security Incident Response (SIR) module, see [Security Incident Response (SIR) Integration](../../../cse/integrations/security-incident-response-integration.md) +* For the Sumo Logic SIEM integration with the ServiceNow Security Incident Response (SIR) module, see [Security Incident Response (SIR) Integration](../../../cse/integrations/security-incident-response-integration.md) ::: diff --git a/docs/api/about-apis/intro-to-apis.md b/docs/api/about-apis/intro-to-apis.md index 4d4cbdc39bd..bac81a0c080 100644 --- a/docs/api/about-apis/intro-to-apis.md +++ b/docs/api/about-apis/intro-to-apis.md @@ -17,7 +17,7 @@ In this article, you'll learn how to: * Create a Sumo Logic access ID/key. * Access Sumo Logic APIs. -* Use APIs with Sumo Logic's Cloud SIEM. +* Use APIs with Sumo Logic's SIEM. ## Create an access key @@ -105,8 +105,8 @@ Optionally, you can download the OpenAPI Specification for the Sumo Logic API an 1. Click the **Download** button at the top of the page.
Button to download Sumo Logic OpenAPI Specification 1. Import the downloaded file to your API test application. For example, to [import the file to Postman](https://learning.postman.com/docs/getting-started/importing-and-exporting/importing-data/), select **File > Import**. 1. The imported specification appears. Select any API to run it.
Imported API specification -1. You can also download the API specification for Cloud SIEM or Cloud SOAR from the following locations. Simply select the API documentation URL for your deployment and click the **Download** button at the top of the page: - * [Cloud SIEM API documentation](/docs/api/cloud-siem-enterprise/#documentation) +1. You can also download the API specification for SIEM or Cloud SOAR from the following locations. Simply select the API documentation URL for your deployment and click the **Download** button at the top of the page: + * [SIEM API documentation](/docs/api/siem-enterprise/#documentation) * [Cloud SOAR API documentation](/docs/api/cloud-soar/#documentation) ## Basic API GET commands @@ -336,15 +336,15 @@ Alternately, you can specify a different user to inherit the created content aft `[DELETE] https://api.sumologic.com/api/v1/users/[userID]?transferTo=[transferUserID]` -## Using the Sumo Logic APIs with Cloud SIEM +## Using the Sumo Logic APIs with SIEM -Sumo Logic's Cloud SIEM has a supported API that works similarly to the regular Sumo Logic service APIs. Users with an active access ID and key can send commands to Cloud SIEM with the same GET/PUT/POST/DELETE functionality. +Sumo Logic's SIEM has a supported API that works similarly to the regular Sumo Logic service APIs. Users with an active access ID and key can send commands to SIEM with the same GET/PUT/POST/DELETE functionality. -The [Cloud SIEM API](/docs/api/cloud-siem-enterprise/) documentation can be found [here](https://api.sumologic.com/docs/sec). The biggest difference to remember is that the base API URL has an `sec` included before the version for all Cloud SIEM API commands: +The [SIEM API](/docs/api/siem-enterprise/) documentation can be found [here](https://api.sumologic.com/docs/sec). The biggest difference to remember is that the base API URL has an `sec` included before the version for all SIEM API commands: `https://api.sumologic.com/api/sec/[version]/[commandName]` -For instance, you can query the list of current Cloud SIEM insights using the following URL: +For instance, you can query the list of current SIEM insights using the following URL: `[GET] https://api.sumologic.com/api/sec/v1/insights/all` @@ -366,4 +366,4 @@ Or add a new comment to an existing insight by creating comment text in the requ Insight comment -All elements of Cloud SIEM functionality are available through the API, including rules, match lists, automations, tags, and custom actions. Users can even use the API to generate their own insights based on a custom selection of signals. +All elements of SIEM functionality are available through the API, including rules, match lists, automations, tags, and custom actions. Users can even use the API to generate their own insights based on a custom selection of signals. diff --git a/docs/api/about-apis/terraform-with-sumo-logic.md b/docs/api/about-apis/terraform-with-sumo-logic.md index 67e9d68c08d..82abe8e654c 100644 --- a/docs/api/about-apis/terraform-with-sumo-logic.md +++ b/docs/api/about-apis/terraform-with-sumo-logic.md @@ -2,7 +2,7 @@ id: terraform-with-sumo-logic title: Use Terraform with Sumo Logic sidebar_label: Terraform with Sumo Logic -description: Use Terraform infrastructure-as-code to manage Sumo Logic resources including collectors, monitors, dashboards, Cloud SIEM rules, and field mappings. +description: Use Terraform infrastructure-as-code to manage Sumo Logic resources including collectors, monitors, dashboards, SIEM rules, and field mappings. --- import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -25,7 +25,7 @@ You can use Terraform resources to manage all sorts of Sumo Logic components. Fo * [Apps](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/app) * Automation service * [Playbooks](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/csoar_playbook) -* Cloud SIEM +* SIEM * [Automation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_automation) * [Context actions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_context_action) * Entities @@ -126,7 +126,7 @@ You can use Terraform data sources to retrieve Sumo Logic data from your Terrafo * [Apps](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/apps) * [Caller identity](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/caller_identity) * [Collectors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/collector) -* [Cloud SIEM log mapping](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/cse_log_mapping_vendor_product) +* [SIEM log mapping](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/cse_log_mapping_vendor_product) * [Folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/folder) * [HTTP sources](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/http_source) * [Partitions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/partitions) @@ -280,7 +280,7 @@ terraform { resource "sumologic_role" "cseAnalyst" { name = "CSE Analyst" - description = "This role is used for Analysts in Cloud SIEM Enterprise" + description = "This role is used for Analysts in SIEM Enterprise" capabilities = [ "cseManageRules", "cseViewCustomInsightStatuses", "cseCommentOnInsights", "cseManageInsightAssignee", "viewCse", "cseViewEntityCriticality", "cseViewEnrichments", "cseViewTagSchemas", "cseViewMatchLists", "cseManageCustomInsightStatuses", "cseManageEntityCriticality", "cseManageInsightTags","cseCreateInsights", "cseViewEntityConfiguration", "cseViewEntityGroups", "cseViewCustomEntityType", "cseManageInsightStatus", "cseManageMatchLists", "cseViewThreatIntelligence", "cseViewCustomInsights", "cseViewFileAnalysis", "cseViewMappings", "cseViewSuppressedEntities", "cseManageFavoriteFields","viewCollectors","cseViewNetworkBlocks", "cseInvokeInsights","cseViewRules","cseViewAutomations","cseViewEntity" ] @@ -363,6 +363,6 @@ The state file is used by Terraform to track the current infrastructure state in * Blogs: * [How to Use the New Sumo Logic Terraform Provider for Hosted Collectors](https://www.sumologic.com/blog/terraform-provider-hosted) * [Terraform and Sumo Logic – Build Monitoring into your Cloud Infrastructure](https://www.sumologic.com/blog/terraform-sumo-logic) - * [Build a detection-as-code pipeline: Your guide to managing Sumo Logic Cloud SIEM rules in GitHub](https://www.sumologic.com/guides/detections-as-code-setup) + * [Build a detection-as-code pipeline: Your guide to managing Sumo Logic SIEM rules in GitHub](https://www.sumologic.com/guides/detections-as-code-setup) * Terraform resource: [Sumo Logic Provider](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs) * GitHub: [terraform-provider-sumologic](https://github.com/SumoLogic/terraform-provider-sumologic) \ No newline at end of file diff --git a/docs/api/cloud-siem-enterprise.md b/docs/api/cloud-siem-enterprise.md deleted file mode 100644 index 90463790421..00000000000 --- a/docs/api/cloud-siem-enterprise.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -id: cloud-siem-enterprise -title: Cloud SIEM APIs -sidebar_label: Cloud SIEM -description: The Cloud SIEM API allows you to create and manage Entities, Custom Insights, log mappings, Match Lists, Network Blocks, and other Cloud SIEM features. ---- - -import useBaseUrl from '@docusaurus/useBaseUrl'; -import ApiIntro from '../reuse/api-intro.md'; -import CseTable from '../reuse/cse-api-table.md'; -import ApiRoles from '../reuse/api-roles.md'; - -Cloud SIEM icon - -The [Cloud SIEM](/docs/cse) API allows you to create and manage Entities, Custom Insights, log mappings, Match Lists, Network Blocks and other Cloud SIEM features. - -## Documentation - - - - - -## Required role capabilities - - - -* [Cloud SIEM](/docs/manage/users-roles/roles/role-capabilities/#cloud-siem) (all role capabilities) diff --git a/docs/api/index.md b/docs/api/index.md index 947ad8e3ee5..cbe9feb445e 100644 --- a/docs/api/index.md +++ b/docs/api/index.md @@ -49,7 +49,7 @@ To connect with other Sumo Logic users, post feedback, or ask a question, visit
- Cloud SIEM icon

Cloud SIEM

 + SIEM icon

SIEM
@@ -264,7 +264,7 @@ To connect with other Sumo Logic users, post feedback, or ask a question, visit
- Cloud SIEM icon

Threat Intel Ingest

 + SIEM icon

Threat Intel Ingest
diff --git a/docs/api/mcp-server.md b/docs/api/mcp-server.md index 2812036727d..e43ab856e94 100644 --- a/docs/api/mcp-server.md +++ b/docs/api/mcp-server.md @@ -136,7 +136,7 @@ Our MCP server provides access to Sumo Logic through these tool categories: * **Utility tools**. Discover relevant tools based on context. * **Alerts management**. Search and retrieve alerts. * **Dashboard management**. Create, retrieve, and update dashboards. -* **Cloud SIEM**. Manage insights, detection rules, and status updates. +* **SIEM**. Manage insights, detection rules, and status updates. * **Log search**. Run log search queries and retrieve results. * **Discovery**. List custom fields, field extraction rules, and partitions to help scope log searches. @@ -178,26 +178,26 @@ Tool identifiers are subject to change during the preview period. * `Create a new dashboard called "System Overview" that uses the previous query to power a dashboard panel called "Total Log Count Per Minute"` * `Add a second panel called "Error Logs Count Per Minute" that is a similar query but only has logs in it that contain the keyword "error" in them` -### Cloud SIEM +### SIEM #### Insights | Tool | Description | Required scope | | :--- | :---------- | :-------------- | -| `getAllInsights` | Get all insights (paginated via token). | View Cloud SIEM Enterprise (`viewCse`) | -| `getInsight` | Get a single insight by ID, including signals, artifacts, and entity details. | View Cloud SIEM Enterprise (`viewCse`) | -| `getInsights` | Get insights with filtering by severity, status, assignee, entity, confidence, tags, and more. | View Cloud SIEM Enterprise (`viewCse`) | -| `updateInsightAssignee` | Update the assignee of an insight. | View Cloud SIEM Enterprise, Manage Insight Assignee (`viewCse`, `cseManageInsightAssignee`) | -| `updateInsightStatus` | Update the status of an insight. | View Cloud SIEM Enterprise, Manage Insight Status (`viewCse`, `cseManageInsightStatus`) | +| `getAllInsights` | Get all insights (paginated via token). | View SIEM Enterprise (`viewCse`) | +| `getInsight` | Get a single insight by ID, including signals, artifacts, and entity details. | View SIEM Enterprise (`viewCse`) | +| `getInsights` | Get insights with filtering by severity, status, assignee, entity, confidence, tags, and more. | View SIEM Enterprise (`viewCse`) | +| `updateInsightAssignee` | Update the assignee of an insight. | View SIEM Enterprise, Manage Insight Assignee (`viewCse`, `cseManageInsightAssignee`) | +| `updateInsightStatus` | Update the status of an insight. | View SIEM Enterprise, Manage Insight Status (`viewCse`, `cseManageInsightStatus`) | #### Detection rules | Tool | Description | Required scope | | :--- | :---------- | :-------------- | -| `createTemplatedMatchRule` | Create a new match rule. | View Cloud SIEM Enterprise, Manage Rules (`viewCse`, `cseManageRules`) | -| `createThresholdRule` | Create a new threshold rule. | View Cloud SIEM Enterprise, Manage Rules (`viewCse`, `cseManageRules`) | -| `getRule` | Get a single rule by ID with optional tuning expressions. | View Cloud SIEM Enterprise, View Rules (`viewCse`, `cseViewRules`) | -| `getRules` | Get rules with filtering by category, enabled status, rule source, score, severity, stream, tags, and more. | View Cloud SIEM Enterprise, View Rules (`viewCse`, `cseViewRules`) | +| `createTemplatedMatchRule` | Create a new match rule. | View SIEM Enterprise, Manage Rules (`viewCse`, `cseManageRules`) | +| `createThresholdRule` | Create a new threshold rule. | View SIEM Enterprise, Manage Rules (`viewCse`, `cseManageRules`) | +| `getRule` | Get a single rule by ID with optional tuning expressions. | View SIEM Enterprise, View Rules (`viewCse`, `cseViewRules`) | +| `getRules` | Get rules with filtering by category, enabled status, rule source, score, severity, stream, tags, and more. | View SIEM Enterprise, View Rules (`viewCse`, `cseViewRules`) | #### Sample prompts diff --git a/docs/api/siem-enterprise.md b/docs/api/siem-enterprise.md new file mode 100644 index 00000000000..d182bcba52f --- /dev/null +++ b/docs/api/siem-enterprise.md @@ -0,0 +1,27 @@ +--- +id: siem-enterprise +title: SIEM APIs +sidebar_label: SIEM +description: The SIEM API allows you to create and manage Entities, Custom Insights, log mappings, Match Lists, Network Blocks, and other SIEM features. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; +import ApiIntro from '../reuse/api-intro.md'; +import CseTable from '../reuse/cse-api-table.md'; +import ApiRoles from '../reuse/api-roles.md'; + +SIEM icon + +The [SIEM](/docs/cse) API allows you to create and manage Entities, Custom Insights, log mappings, Match Lists, Network Blocks and other SIEM features. + +## Documentation + + + + + +## Required role capabilities + + + +* [SIEM](/docs/manage/users-roles/roles/role-capabilities/#siem) (all role capabilities) diff --git a/docs/api/threat-intel-ingest.md b/docs/api/threat-intel-ingest.md index 8f3b4b2c4f3..ce7818358eb 100644 --- a/docs/api/threat-intel-ingest.md +++ b/docs/api/threat-intel-ingest.md @@ -9,7 +9,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; import ApiIntro from '../reuse/api-intro.md'; import ApiRoles from '../reuse/api-roles.md'; -Cloud SIEM icon +SIEM icon The Threat Intel Ingest Management API allows you to: diff --git a/docs/cloud-soar/automation.md b/docs/cloud-soar/automation.md index 3cf3564a28d..d6aa914cb6e 100644 --- a/docs/cloud-soar/automation.md +++ b/docs/cloud-soar/automation.md @@ -33,7 +33,7 @@ In Cloud SOAR, playbooks are run from [incidents](/docs/cloud-soar/incidents-tri When you [create a playbook](/docs/platform-services/automation-service/playbooks/create-playbooks/#create-a-new-playbook) to use in incident response, do the following: 1. Click the **Edit** icon on the **Start** node:
Start node 1. Ensure that the **Add one or more params as a playbook input** field is left blank:
Edit node dialog
Do *not* click the field to show the dropdown menu:
Types of start node parameters
The other values in the field are used for automation outside of Cloud SOAR: - * **Insight** and **Entity** are for launching a playbook from a Cloud SIEM automation. + * **Insight** and **Entity** are for launching a playbook from a SIEM automation. * **Alert** is for launching a playbook from a monitor. * **Parse from JSON** is for launching a playbook from another playbook. 1. Proceed to create the playbook as needed. diff --git a/docs/cloud-soar/compared-to-automation-service.md b/docs/cloud-soar/compared-to-automation-service.md index 38c0e5d2dd0..35cc7ef31d7 100644 --- a/docs/cloud-soar/compared-to-automation-service.md +++ b/docs/cloud-soar/compared-to-automation-service.md @@ -21,7 +21,7 @@ The Automation Service does not include any of Cloud SOAR’s case management or ### Daemon and trigger action types -The Automation Service does not support [daemon](/docs/platform-services/automation-service/integration-framework/about-integration-framework/#daemon-action-definitions) and [trigger](/docs/platform-services/automation-service/integration-framework/about-integration-framework/#trigger-action-definitions) action types. The Automation Service can only use triggers built into Cloud SIEM and the Log Analytics platform. So you cannot configure a playbook in the Automation Service to monitor an external process or file and fire a trigger in response like you can with Cloud SOAR. A trigger can only fire in the Automation Service for limited events, such as when an Insight is created in Cloud SIEM. +The Automation Service does not support [daemon](/docs/platform-services/automation-service/integration-framework/about-integration-framework/#daemon-action-definitions) and [trigger](/docs/platform-services/automation-service/integration-framework/about-integration-framework/#trigger-action-definitions) action types. The Automation Service can only use triggers built into SIEM and the Log Analytics platform. So you cannot configure a playbook in the Automation Service to monitor an external process or file and fire a trigger in response like you can with Cloud SOAR. A trigger can only fire in the Automation Service for limited events, such as when an Insight is created in SIEM. ### Additional features @@ -34,7 +34,7 @@ Cloud SOAR also offers many more features than the Automation Service, including | App Central
- Integrations
- Playbooks | ✓ | ✓ | | Automation (full features) | ✓ | ✓ | | Automation Bridge | ✓ | ✓ | -| Integration with Cloud SIEM and Log Analytics | ✓ | ✓ | +| Integration with SIEM and Log Analytics | ✓ | ✓ | | Integrations management | ✓ | ✓ | | Open Integration Framework (OIF)
- Custom docker images for action execution
- Custom integration capabilities
- Integration Builder (almost no-code) | ✓ | ✓ | | Playbooks
- Execution in the cloud (without using an Automation Bridge)
- Execution in local network with an Automation Bridge
- Management
- Slack integration for node activation | ✓ | ✓ | diff --git a/docs/cloud-soar/incidents-triage.md b/docs/cloud-soar/incidents-triage.md index 54034852d97..ab04cad9fc7 100644 --- a/docs/cloud-soar/incidents-triage.md +++ b/docs/cloud-soar/incidents-triage.md @@ -407,13 +407,13 @@ New types must be added from the incidents section of the **Custom Fields** page Note that to be able to filter events in the triage module based on the values of a field, **Use as filter** must be checked when adding or modifying a field. As fields are created, they will be assigned a number starting at `1`, which will be used to identify the field when adding events via the API. The first field added will be identified as `opt_1`, the second as `opt_2`, and so on. Regardless of the ordering of the fields on the screen, these numbers will remain the same. If a field is deleted, the number will not be reused. For example, if you have defined `opt_1` through `opt_8` and delete the field `opt_8`, the next field added will still become `opt_9`. It is important to remember these field numbers, as they will be used when the API is invoked. -#### Attributes sent from Cloud SIEM +#### Attributes sent from SIEM -You can ingest Cloud SIEM Insights into Cloud SOAR for incident triage using the `GetInsight` Cloud SOAR API. The following Insight attributes are returned. +You can ingest SIEM Insights into Cloud SOAR for incident triage using the `GetInsight` Cloud SOAR API. The following Insight attributes are returned. When you create an incident from an Insight, you can map the Insight attributes to fields in Cloud SOAR as follows: -| Attribute in Cloud SIEM | Field in Cloud SOAR | +| Attribute in SIEM | Field in Cloud SOAR | | :-- | :-- | | `assignee` | `Insight Assignee` (custom field) | | `created` | `Start time` | diff --git a/docs/cloud-soar/introduction.md b/docs/cloud-soar/introduction.md index bd2d417b68f..7714ecd86a9 100644 --- a/docs/cloud-soar/introduction.md +++ b/docs/cloud-soar/introduction.md @@ -34,7 +34,7 @@ The cybersecurity cycle is an iterative, scientific process, much like troublesh While Security Information and Event Management (SIEM) tools help automate the threat hunting and investigation process, Security Orchestration, Automation, and Response (SOAR) tools are typically used in response to an active or potential threat. Both these tools work together as part of the security pipeline in your security operations center (SOC). -All of Sumo Logic’s security solutions can help with every step of this process. However, broadly speaking, [Cloud SIEM](/docs/cse/) focuses on the investigation phase, and Cloud SOAR focuses on the response phase. All our solutions can be used on their own, or together. For example, you can investigate an insight in Cloud SIEM, then use the **Actions** button inside the insight to send the information to Cloud SOAR, where you can orchestrate the response to the incident. +All of Sumo Logic’s security solutions can help with every step of this process. However, broadly speaking, [SIEM](/docs/cse/) focuses on the investigation phase, and Cloud SOAR focuses on the response phase. All our solutions can be used on their own, or together. For example, you can investigate an insight in SIEM, then use the **Actions** button inside the insight to send the information to Cloud SOAR, where you can orchestrate the response to the incident. In this introduction, we'll focus on learning how to use Sumo Logic's Cloud SOAR to automate many parts of incident response and streamline your SOC. @@ -48,16 +48,16 @@ Your company's apps and services generate logs, metrics, and tracing data. When you ingest that data into Sumo Logic, you have one centralized location to query and visualize all that data. Sumo Logic’s Log Analytics Platform uses [threat intelligence](/docs/security/threat-intelligence/), so you can start getting security alerts and hunt threats. -You can take your security one step further with [Cloud SIEM](/docs/cse/). When you forward your log messages to Cloud SIEM, they are parsed, mapped, and enriched into Cloud SIEM records. These records are compared to security rules. If a rule is triggered, an entity is extracted, a severity score is assigned, and a signal is created. If enough signals with the same entity cluster together, they become an insight. Insights are likely risks that need your attention. +You can take your security one step further with [SIEM](/docs/cse/). When you forward your log messages to SIEM, they are parsed, mapped, and enriched into SIEM records. These records are compared to security rules. If a rule is triggered, an entity is extracted, a severity score is assigned, and a signal is created. If enough signals with the same entity cluster together, they become an insight. Insights are likely risks that need your attention. -Finally, you can take the insights from Cloud SIEM and automatically respond to them with Cloud SOAR. Cloud SOAR helps orchestrate and automate the incident response cycle. +Finally, you can take the insights from SIEM and automatically respond to them with Cloud SOAR. Cloud SOAR helps orchestrate and automate the incident response cycle. ##### Why use Cloud SOAR? * **Faster responses**. Cloud SOAR can automate parts of your SOC, leading to faster response time. * **Close the skills gap**. Analysts of all skill levels can deploy playbooks. Veteran analysts can spend more time on threat hunting. * **Consolidate tools**. Orchestrate all your security tools in one location with integrations and custom APIs. -* **Part of a security suite**. Cloud SOAR integrates with Sumo Logic's Log Analytics Platform and Cloud SIEM for a complete, end-to-end security solution. +* **Part of a security suite**. Cloud SOAR integrates with Sumo Logic's Log Analytics Platform and SIEM for a complete, end-to-end security solution. #### Inside Sumo Logic Cloud SOAR @@ -131,7 +131,7 @@ Before you can respond to an incident, you must investigate it to determine who Remember, threat investigation is reactive while threat hunting is proactive. Typically, threat investigation happens in reaction to an alert. Once you’ve investigated a threat, you can proactively hunt for similar threats and take precautionary steps to prevent attacks from happening again. -You can do both threat investigation and threat hunting using Cloud SOAR. You may have gotten an alert from Sumo Logic, Cloud SIEM, or directly from Cloud SOAR. Armed with this information, you can log in to Cloud SOAR. You can click the **Incidents** page to learn more about what happened, or click the **Entities** page to learn more about who the potential threat actors are. +You can do both threat investigation and threat hunting using Cloud SOAR. You may have gotten an alert from Sumo Logic, SIEM, or directly from Cloud SOAR. Armed with this information, you can log in to Cloud SOAR. You can click the **Incidents** page to learn more about what happened, or click the **Entities** page to learn more about who the potential threat actors are. Only after you’ve gathered enough information about the incident can you decide how to respond to the incident. @@ -166,7 +166,7 @@ In this section, you’ll investigate an incident, gather information, and decid 1. Make sure **Short Description** is under the **Active** column. If it isn’t, click the **+** next to **Short Description** in the **Available** column. Do the same with the **Type** and **Category** fields. Then click **Apply**. You’ll now see a short description based on the [MITRE ATT&CK framework](https://attack.mitre.org/matrices/enterprise/) of each incident. 1. Click any incident with a status of **Open**. 1. As you click the incident, you'll see a popup asking if you want to make yourself the investigator for this incident. Select the role to assign yourself (for example, **Analyst**), then click **Yes** to add yourself as an investigator.
Add investigator example -1. Click the **Overview** tab. Here you’ll see basic information about the incident, like the entities involved in the incident and the time the incident was opened. If the incident was imported from Sumo Logic Cloud SIEM, it contains the Cloud SIEM incident ID as well as a short description based on the MITRE ATT&CK framework. +1. Click the **Overview** tab. Here you’ll see basic information about the incident, like the entities involved in the incident and the time the incident was opened. If the incident was imported from Sumo Logic SIEM, it contains the SIEM incident ID as well as a short description based on the MITRE ATT&CK framework. 1. On the right side of the **Overview** tab you can open up a sidebar with various widgets showing the list of investigators, ownership history, relationships, incident status history, and/or incident description.
Sidebar example 1. Click the **Operations** tab, and click the **War Room** tab underneath it.
War Room example
The War Room contains a history of the incident, including any tasks and investigators that have been assigned, playbooks that have been executed, entities that are being tracked, and any other notes or attachments. 1. Under the **Operations** tab, click **Notes**. @@ -210,7 +210,7 @@ Cloud SOAR has hundreds of prebuilt playbooks and templates, so you can quickly #### App Central, custom integrations, and other automations -Cloud SOAR has hundreds of [pre-built playbooks](/docs/platform-services/automation-service/playbooks-in-app-central/) which you can use as-is or customize. You can also build your own custom playbooks, which you can learn about in the Cloud SIEM Administration class. +Cloud SOAR has hundreds of [pre-built playbooks](/docs/platform-services/automation-service/playbooks-in-app-central/) which you can use as-is or customize. You can also build your own custom playbooks, which you can learn about in the SIEM Administration class. Both pre-built and custom playbooks are simply combinations of various integrations and automations. These integrations can also be used stand-alone rather than as part of a playbook. Typically, an integration in Cloud SOAR contains one or more of these actions: * **Enrichment**. Adds information, metadata, or context, such as from a threat intelligence database. @@ -409,7 +409,7 @@ Within Automation, you’ll see subsections for: #### Fields -Fields are used to map data that is imported into Cloud SOAR to various attributes used by Cloud SOAR. Fields are often pre-populated as data is imported into Cloud SOAR. However, there are some times you may wish to customize fields. For example, you can use a custom field to make sure the data you’re importing from Cloud SIEM, such as an entity, gets mapped properly to the equivalent entity field in Cloud SOAR. Or, you might want to create a custom field called "Time to Manage" that calculates the difference between incident "Open Time" and "Close Time". You could then track "Time to Manage" across different incident types or different analysts to find pain points in your SOC. +Fields are used to map data that is imported into Cloud SOAR to various attributes used by Cloud SOAR. Fields are often pre-populated as data is imported into Cloud SOAR. However, there are some times you may wish to customize fields. For example, you can use a custom field to make sure the data you’re importing from SIEM, such as an entity, gets mapped properly to the equivalent entity field in Cloud SOAR. Or, you might want to create a custom field called "Time to Manage" that calculates the difference between incident "Open Time" and "Close Time". You could then track "Time to Manage" across different incident types or different analysts to find pain points in your SOC. Administrators can edit existing fields, delete fields, and add new fields for almost every section of Cloud SOAR. Fields can be customized one by one manually, or an administrator can import a CSV file to customize them in bulk. Any existing field can have its name or value edited, but its type cannot be changed. Field types include date, text, numeric, timezone, email address, IP address, and many others. @@ -462,9 +462,9 @@ In this section, we’ll create a custom incident label. This new label will mak 1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu select **Cloud SOAR**, and then under **Cloud SOAR Configurations** select **Incident Labels**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). Click the gear icon Settings menu icon in the top right, select **Settings**, and on the left menu select **Customization > Incident labels**. 1. Click the **+** icon to create a new incident label. -1. For **Name**, enter a name that designates what the incident is for. For example, to create a label for incidents originating in Cloud SIEM, you could enter **Cloud SIEM Alert**. +1. For **Name**, enter a name that designates what the incident is for. For example, to create a label for incidents originating in SIEM, you could enter **SIEM Alert**. 1. Optionally, you can include a short **Description**. -1. For **Value**, type the label as you want it to appear in the UI. For example, type **Cloud SIEM Alert -**. +1. For **Value**, type the label as you want it to appear in the UI. For example, type **SIEM Alert -**. 7. Double-click entries you want to add to the value. For example, double-click **Counter**. The fields inside the brackets will be replaced by the appropriate variable when this incident label is used. For example, if the incident is created in October, the `[=MONTH]` field will be replaced by 10. 1. Click **Save**. @@ -563,19 +563,19 @@ Custom actions can also include trigger actions, which run based on an event typ Before you begin creating or customizing a playbook, decide what you’d like to automate. Think about what conditions you want met, and what actions or integrations you want to accomplish based on different flows. Once you have a design in mind for the flow of your playbook, you can create or customize a new one. Search App Central to see if an out-of-the-box playbook that does what you want already exists, or if you can modify a existing playbook that’s similar to what you have in mind. -#### Create a custom playbook for Cloud SIEM insights +#### Create a custom playbook for SIEM insights -Cloud SOAR allows us to create automations that will run whenever Cloud SIEM insights are created or closed. These automations are powered through playbooks, predefined actions run in an automated workflow to respond to an incident. +Cloud SOAR allows us to create automations that will run whenever SIEM insights are created or closed. These automations are powered through playbooks, predefined actions run in an automated workflow to respond to an incident. -Let’s create a playbook for use in Cloud SIEM. +Let’s create a playbook for use in SIEM. 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Automation > Playbooks**. You can also click the **Go To...** menu at the top of the screen and select **Playbooks**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Automation > Playbooks**. 1. To explore an existing playbook, click it to open the playbook diagram in the right sidebar. Here, you can view the individual nodes and sequences, providing insight into the types of actions and structures you can create with custom playbooks. Playbooks can include multiple actions and branching conditions to handle different action sequences based on specific criteria. Click any playbook component to see detailed information about each node. 1. Click the **+** icon near the top to create a new playbook. - 1. Enter a name, for example, **Test Playbook**. You can optionally enter a description. Select **Cloud SIEM** as the **Type** for the playbook. + 1. Enter a name, for example, **Test Playbook**. You can optionally enter a description. Select **SIEM** as the **Type** for the playbook. 1. Click **Create** when finished.
On the following screen you will see the starting template for your new (empty) playbook, with "Start" and "End" nodes. 1. Switch to edit mode by clicking the **Edit** (pencil) icon in the bottom toolbar. -1. Before we start adding actions to our playbook, we’ll want to set up the initial configuration of the playbook so we get the proper inputs from the Cloud SIEM insight. +1. Before we start adding actions to our playbook, we’ll want to set up the initial configuration of the playbook so we get the proper inputs from the SIEM insight. 1. Mouse over the Start node, and click the Edit (pencil) icon. 1. In the Edit Node popup, select **Insight** from the playbook input parameters dropdown. Choosing **Insight** will automatically populate the popup with input parameters that will be added to the playbook from the corresponding insight. 1. Click **Update** to save and close the input parameters. @@ -583,7 +583,7 @@ Let’s create a playbook for use in Cloud SIEM. 1. Click the **+** button on the Start node. 1. Select **Action** from the node type options. 1. Fill in a node name, for example, “Get Insight Details”. - 1. From the **Integration** options, select **Sumo Logic Cloud SIEM**. + 1. From the **Integration** options, select **Sumo Logic SIEM**. 1. For **Type**, ensure **Enrichment** is selected. 1. As the **Action**, select **Get Insight V2**. 1. As the **Insight ID**, select **Insight ID**. @@ -597,7 +597,7 @@ Let’s create a playbook for use in Cloud SIEM. 1. Click **Create** to save the new action. 1. Add another action to the playbook by clicking the **+** icon on the **Get VirusTotal Info** node you just created and selecting **Action**. Use the parameters outlined below: 1. **Name**: "Add Entity Enrichment". - 1. **Integration**: **Sumo Logic Cloud SIEM Internal**. + 1. **Integration**: **Sumo Logic SIEM Internal**. 1. **Type**: **Notification**. 1. **Action**: **Add Entity Enrichment**. 1. **Entity ID**: Click the cog icon on the right, and select the **Get Insight Details** action. Then find the **output.entity.id** field and select it. @@ -649,9 +649,9 @@ In this section, we’ll create a custom incident template. This template will a Automation rules define what happens when data is received from a source. These rules allow specific data to be parsed from the incoming data sources and then acted upon automatically. For more information, see [Automation rules](/docs/cloud-soar/automation/#automation-rules). -Automation rules can automatically pull information from sources. They can also execute playbooks based on certain criteria. For example, you might want to pull insights from Cloud SIEM once an hour and create incidents from them. Then, you could configure a rule that runs a playbook based on the tags in the incident. This way, the entire incident response cycle is automated: Cloud SIEM identifies a threat, and playbooks in Cloud SOAR are automatically deployed to contain and eradicate the threats, restore systems, and email a final report for an analyst to review. +Automation rules can automatically pull information from sources. They can also execute playbooks based on certain criteria. For example, you might want to pull insights from SIEM once an hour and create incidents from them. Then, you could configure a rule that runs a playbook based on the tags in the incident. This way, the entire incident response cycle is automated: SIEM identifies a threat, and playbooks in Cloud SOAR are automatically deployed to contain and eradicate the threats, restore systems, and email a final report for an analyst to review. -Let's create a custom automation rule. This rule will pull information from Cloud SIEM every 5 hours. +Let's create a custom automation rule. This rule will pull information from SIEM every 5 hours. 1. [**New UI**](/docs/get-started/sumo-logic-ui/). In the main Sumo Logic menu select **Automation > Rules**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic/). Click the gear icon Settings menu icon in the top right, select **Automation**, and then select **Rules** in the left nav bar. 1. Near the top, click the **+** icon to create a new rule. diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index 2be2982c609..f24085c1a1c 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -34,7 +34,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Autocomplete](/docs/search/get-started-with-search/search-basics/search-autocomplete)**. On the Search page of the Sumo Logic user interface, the search autocomplete dropdown dialog offers suggestions to make query writing easier. Suggestions include simple logic that offers common default queries, keywords, metadata terms, and search operators. The autocomplete dialog also includes links to Help topics for more information. -**[Automation Service](/docs/cse/automation/about-automation-service-and-cloud-siem)**. In Cloud SIEM, a service that automatically runs tasks such as sending notifications or adding data to records when security incidents occur. +**[Automation Service](/docs/cse/automation/about-automation-service-and-siem)**. In SIEM, a service that automatically runs tasks such as sending notifications or adding data to records when security incidents occur. ## B @@ -54,7 +54,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Clobber](/docs/send-data/installed-collectors/collector-installation-reference/force-collectors-name-clobber/)**. During the installation process, use the clobber flag in situations where you're creating a new Collector that will use a name that is already in use by another Collector. Clobber deletes (clobbers) the existing collector with the same name. -[**Cloud SIEM**](/docs/cse). A cloud-native security information and event management solution that automatically normalizes, correlates, and analyzes your security data. Cloud SIEM surfaces insights that help security analysts detect and investigate threats faster. +[**SIEM**](/docs/cse). A cloud-native security information and event management solution that automatically normalizes, correlates, and analyzes your security data. SIEM surfaces insights that help security analysts detect and investigate threats faster. [**Cloud SOAR**](/docs/cloud-soar). A security orchestration, automation, and response platform that helps security teams streamline incident response. Cloud SOAR automates repetitive tasks, orchestrates workflows across security tools, and tracks the full incident lifecycle. @@ -108,9 +108,9 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Endpoints](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several pods that are assigned depending on the geographic location and the date an account is created. Sumo Logic redirects your browser to the correct login URL and also redirects Collectors to the correct endpoint. However, if you're using an API you'll need to manually direct requests to the correct API endpoint; API calls are not redirected to another endpoint. -**[Enrichment](/docs/cse/integrations/enrichments-and-indicators)**. In Cloud SIEM, addition of data to records that provides more information for analysis of security incidents. +**[Enrichment](/docs/cse/integrations/enrichments-and-indicators)**. In SIEM, addition of data to records that provides more information for analysis of security incidents. -**[Entity](/docs/cse/records-signals-entities-insights/view-manage-entities)**. In Cloud SIEM, a unique actor encountered in incoming messages, such as a user, IP address, or host. +**[Entity](/docs/cse/records-signals-entities-insights/view-manage-entities)**. In SIEM, a unique actor encountered in incoming messages, such as a user, IP address, or host. **[Exclude rule](/docs/send-data/collection/processing-rules/include-and-exclude-rules)**. Exclude rules are a type of Processing Rule that specifies log messages that you do not want to send to Sumo Logic, think of it as an "allowlist" filter. @@ -156,7 +156,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Ingest Budget](/docs/manage/ingestion-volume/ingest-budgets)**. Ingest budgets control the capacity of daily log ingestion volume sent to Sumo Logic from Collectors. -**[Insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a group of signals clustered around a single entity that are generated when an entity’s Activity Score exceeds a threshold. +**[Insight](/docs/cse/get-started-with-siem/about-cse-insight-ui)**. In SIEM, a group of signals clustered around a single entity that are generated when an entity’s Activity Score exceeds a threshold. **[Installed Collector](/docs/send-data/installed-collectors)**. Installed Collectors are deployed in your environment, either on a local machine, a machine in your organization, or even an Amazon Machine Image (AMI). Installed Collectors require a software download and installation. Upgrades to Collector software are released regularly by Sumo Logic. @@ -189,7 +189,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos ## M -**[Mapper](/docs/cse/schema/create-structured-log-mapping)**. In Cloud SIEM, a script that maps message fields to record attributes. +**[Mapper](/docs/cse/schema/create-structured-log-mapping)**. In SIEM, a script that maps message fields to record attributes. **[Markdown](/docs/dashboards/panels/markdown-syntax)**. Used in Dashboards, you can add Text Panels to include titles or text descriptions. Use Markdown syntax to add bold or italic formatting, bullet lists, code font, and other formatting. See Help for details. @@ -237,7 +237,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Parse operator](/docs/search/search-query-language/parse-operators/parse-predictable-patterns-using-an-anchor)**. The parse operator (also called the parse anchor) parses strings according to specified start and stop anchors, and then labels them as fields for use in subsequent functions in the query such as sorting, grouping, or other functions. Parse options include "parse anchor" or "parse regex" for using regular expressions to form more complex parse queries. It is acceptable to use "parse" for "parse anchor", or "extract" for "parse regex". -**[Parser](/docs/cse/schema/parser-editor)**. In Cloud SIEM, a script that parses logs and normalizes them into structured records. +**[Parser](/docs/cse/schema/parser-editor)**. In SIEM, a script that parses logs and normalizes them into structured records. **[Partition](/docs/manage/partitions)**. Sumo Logic allows you to filter a subset of the messages in an Index into a Partition. Partitioning messages in an Index improves search query performance, as the total number of messages that need to be searched is reduced. Once messages are routed to a Partition, you can limit your search to those messages using the Partition name in a search query. @@ -263,7 +263,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[RBAC](/docs/manage/users-roles/roles/role-based-access-control/)**. Sumo Logic supports Role-Based Access Control (RBAC) to allow Administrators to customize system access. With RBAC, Administrators create roles for groups of users who perform various job functions. Users are not assigned permissions directly, but inherit permissions through roles (or even through a single role). Role assignments can grant users permissions to access some data sets, or can restrict users from accessing types of data. -**[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. +**[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In SIEM, a collection of normalized data created from a message. **[Relative expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m. @@ -273,7 +273,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Rollup tables](/docs/metrics/manage-metric-volume/metric-ingestion-and-storage)**. Metric data is stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data is retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months. -**[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, set of logic that creates signals based on information in incoming records. +**[Rule](/docs/cse/rules/about-cse-rules)**. In SIEM, set of logic that creates signals based on information in incoming records. @@ -293,7 +293,7 @@ We also maintain a [DevOps and Security Glossary](https://www.sumologic.com/glos **[Service Allowlist Settings](/docs/manage/security/create-allowlist-ip-cidr-addresses)**. Service Allowlist Settings allow you to explicitly grant access to specific IP addresses and/or CIDR notations. -**[Signal](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, an indicator of an event of interest that fires when rule conditions are met. +**[Signal](/docs/cse/records-signals-entities-insights/view-records-signal)**. In SIEM, an indicator of an event of interest that fires when rule conditions are met. **[Single Value Chart](/docs/dashboards/panels/single-value-charts)**. A Single Value chart is useful for displaying the results of a query that returns only a single value or record, in order to make that value stand out at a glance. If the query returns more than one value in the Aggregation tab, only the first value is displayed in the Single Value chart. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index b49020ae4ca..23a5d1dac83 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -1354,7 +1354,7 @@ In the UI, avoid periods for single sentences on their own. Whenever there are t Our release notes (also known as changelog) are posted to the both the docs site and corresponding RSS feed. Check out the categories [here](/docs/release-notes). Keep your them concise and add links to documentation. If there are updated UI elements, add an image or gif. -1. In the appropriate blog folder ([blog-collector](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-collector), [blog-cse](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-cse), [blog-csoar](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-csoar), [blog-developer](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-developer), [blog-service](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-service)), add a new file that follows the format of the other posts in that folder. For example, for blog-service release notes, the format is `YYYY-MM-DD-`. For Cloud SIEM and SOAR, the format is `YYYY-MM-DD-application-update` or `YYYY-MM-DD-content-update`.
Release notes menu +1. In the appropriate blog folder ([blog-collector](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-collector), [blog-cse](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-cse), [blog-csoar](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-csoar), [blog-developer](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-developer), [blog-service](https://github.com/SumoLogic/sumologic-documentation/tree/main/blog-service)), add a new file that follows the format of the other posts in that folder. For example, for blog-service release notes, the format is `YYYY-MM-DD-`. For SIEM and SOAR, the format is `YYYY-MM-DD-application-update` or `YYYY-MM-DD-content-update`.
Release notes menu 1. Add the following frontmatter, swapping out these example values with your own. Because there's no `image`, we'll use the Sumo Logic logo in its place. ```markdown --- diff --git a/docs/contributing/templates/c2c-source.md b/docs/contributing/templates/c2c-source.md index b398b245df6..b2028f4b935 100644 --- a/docs/contributing/templates/c2c-source.md +++ b/docs/contributing/templates/c2c-source.md @@ -89,7 +89,7 @@ To configure a Dropbox source: 1. Select **Dropbox**. 1. Enter a **Name** for the Source. The **description** is optional. 1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`. -1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value. * Green check circle A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema. * Orange exclamation point An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**. diff --git a/docs/cse/administration/create-a-custom-tag-schema.md b/docs/cse/administration/create-a-custom-tag-schema.md index 747c2983c60..29b3562c9d8 100644 --- a/docs/cse/administration/create-a-custom-tag-schema.md +++ b/docs/cse/administration/create-a-custom-tag-schema.md @@ -7,17 +7,17 @@ description: Custom tag schemas allow you to ensure that users apply consistent import useBaseUrl from '@docusaurus/useBaseUrl'; -This topic has instructions for creating a custom tag schema in Cloud SIEM.  +This topic has instructions for creating a custom tag schema in SIEM.  -## About tags in Cloud SIEM +## About tags in SIEM -Tags are metadata you can attach to insights, signals, entities, and rules. Tags are useful for adding context to these Cloud SIEM items. You can also search for and filter items by tag. There are two types of tags: *keyword tags*, which are arbitrary, freeform strings; and *schema keys*, which are predefined key-value pairs. Cloud SIEM provides built-in schemas keys that display in the Cloud SIEM UI with a Sumo Logic label, as shown in the example below. You can’t edit the built-in schemas. +Tags are metadata you can attach to insights, signals, entities, and rules. Tags are useful for adding context to these SIEM items. You can also search for and filter items by tag. There are two types of tags: *keyword tags*, which are arbitrary, freeform strings; and *schema keys*, which are predefined key-value pairs. SIEM provides built-in schemas keys that display in the SIEM UI with a Sumo Logic label, as shown in the example below. You can’t edit the built-in schemas. Built-in schema keys Schema tags can enforce specific tag values and prevent confusion from variations in tag values. For example, you might want to ensure the use of standard server identifiers, such as “FinanceServer”, rather than “Server-Finance” or “Finance_Server”.  -For more information about tags in Cloud SIEM, see [Using Tags with Insights, Signals, Entities, and Rules](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules). +For more information about tags in SIEM, see [Using Tags with Insights, Signals, Entities, and Rules](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules). import TerraformLink from '../../reuse/terraform-link.md'; @@ -29,7 +29,7 @@ You can use Terraform to manage custom tag schemas with the [`sumologic_cse_tag_ ## Define a custom tag schema -1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM**, and then under **Cloud SIEM Workflow** select **Tag Schemas**. You can also click the **Go To...** menu at the top of the screen and select **Tag Schemas**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top Cloud SIEM menu select **Configuration**, and then under **Workflow** select **Tag Schemas**. +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **SIEM**, and then under **SIEM Workflow** select **Tag Schemas**. You can also click the **Go To...** menu at the top of the screen and select **Tag Schemas**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top SIEM menu select **Configuration**, and then under **Workflow** select **Tag Schemas**. 1. On the **Tag Schemas** page, click **+Add Tag Schema**. 1. The **Add Tag Schemas** popup appears.
Create tag schema 1. **Key**. Enter an identifier for the tag you’re defining. It won’t appear in the UI for assigning tags to a content item, unless you leave the **Label** field blank. @@ -43,5 +43,5 @@ You can use Terraform to manage custom tag schemas with the [`sumologic_cse_tag_ 1. If **Allow Custom Values** is not checked, you must define at least one value for the tag: * **Enter Value**. Enter an allowable value for the tag. * **Enter Label**. Enter a label for the value. - * **Enter Link** (optional). Enter a URL for it to appear in the Actions menu of the tag in any content items to which it’s been applied. Cloud SIEM’s built-in schema tags are examples of schema tags that include a link. The screenshot below shows a link from the **Tactic:TA0002** to associated information on the MITRE site.
Example MITRE link + * **Enter Link** (optional). Enter a URL for it to appear in the Actions menu of the tag in any content items to which it’s been applied. SIEM’s built-in schema tags are examples of schema tags that include a link. The screenshot below shows a link from the **Tactic:TA0002** to associated information on the MITRE site.
Example MITRE link diff --git a/docs/cse/administration/create-cse-actions.md b/docs/cse/administration/create-cse-actions.md index a696a661488..9fdf899001f 100644 --- a/docs/cse/administration/create-cse-actions.md +++ b/docs/cse/administration/create-cse-actions.md @@ -1,22 +1,22 @@ --- id: create-cse-actions -title: Create Cloud SIEM Actions -sidebar_label: Create Cloud SIEM Actions -description: You can use Cloud SIEM actions to issue notifications to another service when certain events occur in Cloud SIEM. +title: Create SIEM Actions +sidebar_label: Create SIEM Actions +description: You can use SIEM actions to issue notifications to another service when certain events occur in SIEM. --- import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe';  -This topic has instructions for configuring Cloud SIEM actions. +This topic has instructions for configuring SIEM actions. :::tip -The Automation Service is a newer way to perform actions. For more information about how to use the Automation Service instead of Cloud SIEM actions, see [Migrate from legacy actions and enrichments to the Automation Service](/docs/cse/automation/automations-in-cloud-siem/#migrate-from-legacy-actions-and-enrichments-to-the-automation-service). +The Automation Service is a newer way to perform actions. For more information about how to use the Automation Service instead of SIEM actions, see [Migrate from legacy actions and enrichments to the Automation Service](/docs/cse/automation/automations-in-siem/#migrate-from-legacy-actions-and-enrichments-to-the-automation-service). ::: -## About Cloud SIEM actions +## About SIEM actions -You can use Cloud SIEM actions to issue a notification to another service when certain events occur in Cloud SIEM. The supported action types are: +You can use SIEM actions to issue a notification to another service when certain events occur in SIEM. The supported action types are: * AWS Simple Notification Service (SNS) * Demisto (Cortex XSOAR) @@ -37,7 +37,7 @@ Watch this micro lesson to learn how to configure an action.