Add Symantec and Zscaler

Author: jpipkin1

docs/cse/ingestion/ingestion-sources-for-cloud-siem/index.md

@@ -167,12 +167,6 @@ This section shows examples of sources you can use to ingest data into Cloud SIE
   <p>Configure a Syslog source to collect and send Symantec Proxy Secure Gateway (ProxySG) log messages to Cloud SIEM.</p>
   </div>
  </div>
-<div className="box smallbox card">
-  <div className="container">
-  <a href="/docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway"><img src={useBaseUrl('img/send-data/symantec-logo.svg')} alt="Symantec Proxy Secure Gateway icon" width="110"/><h4>Symantec Proxy Secure Gateway</h4></a>
-  <p>Configure a syslog source to ingest Symantec Proxy Secure Gateway log messages to be parsed by Cloud SIEM.</p>
-  </div>
- </div>
 <div className="box smallbox card">
   <div className="container">
   <a href="/docs/cse/ingestion/ingestion-sources-for-cloud-siem/zscaler-nss"><img src={useBaseUrl('img/integrations/security-threat-detection/zscaler.png')} alt="ZScaler NSS icon" width="160"/><h4>ZScaler NSS</h4></a>

docs/cse/ingestion/ingestion-sources-for-cloud-siem/sentinelone.md

@@ -15,7 +15,7 @@ To ingest SentinelOne data into Cloud SIEM:
     1. To ensure that the SentinelOne logs are parsed and normalized into structured records in Cloud SIEM, add another field whose name is `_parser` and set the value to:
         * */Parsers/System/SentinelOne/SentinelOne CEF* if your logs  are in CEF format.
         * */Parsers/System/SentinelOne/SentinelOne Syslog* if your logs are in Syslog format.
-    1. Make a note of the **Source Category**, **Token**, and **Host** that are displayed in the configuration UI. You’ll supply them in the next step.
+    1. Make a note of the **Source Category**, **Token**, and **Host** for the syslog source. You’ll supply them in the next step.
 1. Configure SentinelOne to send log messages to the Sumo Logic platform. If you have a SentinelOne account, you can follow directions on the SentinelOne Support [knowledge base](https://support.sentinelone.com/hc/en-us/articles/360007044894-Syslog-Integration-with-Sumo-Logic), or the instructions in [Step 2 of the *Collecting Logs for SentinelOne* article](/docs/send-data/collect-from-other-data-sources/collect-logs-sentinelone/#step-2-configure-syslog-messages).
 1. To verify that your logs are successfully making it into Cloud SIEM:
     1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  

docs/cse/ingestion/ingestion-sources-for-cloud-siem/symantec-proxy-secure-gateway-blue-coat-proxy.md

@@ -1,72 +1,28 @@
 ---
 id: symantec-proxy-secure-gateway-blue-coat-proxy
-title: Symantec Proxy Secure Gateway (Blue Coat Proxy) - Cloud SIEM
+title: Ingest Symantec Proxy Secure Gateway (Blue Coat Proxy) Data into Cloud SIEM
 sidebar_label: Symantec Proxy Secure Gateway - Blue Coat Proxy
 description: Learn how to configure a Syslog source to collect and send Symantec Proxy Secure Gateway (ProxySG) log messages to Sumo Logic to be ingested by Cloud SIEM.
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This section has instructions for collecting Symantec Proxy Secure Gateway (ProxySG) log messages as comma-separated values (CSV) and sending them to Sumo Logic to be ingested by Cloud SIEM. While this document shows how to configure and ingest logs as CSV, Cloud SIEM also supports Common Event Format (CEF) ProxySG logs.
+This article has instructions for collecting Symantec Proxy Secure Gateway (ProxySG) log messages as comma-separated values (CSV) and sending them to Sumo Logic to be ingested by Cloud SIEM. While this article shows how to configure and ingest logs as CSV, Cloud SIEM also supports Common Event Format (CEF) ProxySG logs.
 
 Sumo Logic Cloud SIEM supports the following Proxy Secure Gateway logging fields:
 
 ```
 dt,time,c-ip,cs-username,x-exception-id,sc-filter-result,cs-categories,cs-referer,sc-status,proxy_cache_code,cs-method,cs-content-type,cs-protocol,cs-host,cs-uri-port,c-uri,cs-uri-query,cs-uri-extension,cs-user-agent,s-ip,sc-bytes,cs-bytes,x-bluecoat-access-type,x-bluecoat-application-name,r-ip
 ```
 
-Cloud SIEM supports collection either from a file or over syslog. Instructions for syslog are included in this document.
-
-## Step 1: Configure collection
-
-In this step, you configure a Syslog Source to collect ProxySG log messages. You can configure the source on an existing Installed Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure a Syslog Source](#configure-a-syslog-source) below. Otherwise, create a new collector as described in [Configure an Installed Collector](#configure-an-installed-collector) below, and then create the Syslog Source on the collector.
-
-### Configure an Installed Collector
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.  
-1. Click **Add Collector**.
-1. Click **Installed Collector**.
-1. The **Add Installed Collector** popup appears.
-1. Download the appropriate collector for your operating system.
-1. Install the collector. Instructions for your preferred operating system and method of installation are available on the [Installed Collectors](/docs/send-data/installed-collectors) page.
-1. Once the collector is installed, confirm it is available on the **Collection** page and select **Edit**.
-1. The **Edit Collector popup** appears.<br/><img src={useBaseUrl('img/cse/edit-collector.png')} alt="Edit collector" style={{border: '1px solid gray'}} width="500"/>
-1. **Name**. Provide a Name for the Collector.
-1. **Description**. (Optional)
-1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. 
-1. **Fields**. 
-    1. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM.
-    1. If you are planning that all sources you add to this collector will use the same log parser (if they are the same type of log), click the **+Add Field** link, and add a field whose name is `_parser` with the value */Parsers/System/Blue Coat/Blue Coat ProxySG CSV*. This will cause all sources on the collector to use the specified parser.
-    :::note
-    It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section.
-    :::
-1. Click **Save**.
-
-### Configure a Syslog Source
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. 
-1. Navigate to the Installed Collector where you want to create the source.
-1. On the **Collectors** page, click **Add Source** next to an Installed Collector.
-1. Select **Syslog**. 
-1. The page refreshes. <br/><img src={useBaseUrl('img/cse/syslog-source.png')} alt="Syslog source" style={{border: '1px solid gray'}} width="500"/>
-1. **Name**. Enter a name for the source. 
-1. **Description**. (Optional) 
-1. **Protocol**. Select the protocol that your syslog-enabled devices are currently using to send syslog data, UDP or TCP. For more information, see [Choosing TCP or UDP](/docs/send-data/installed-collectors/sources/syslog-source#choosing-tcp-or-udp) on the *Syslog Source* page.
-1. **Port**. Enter the port number for the Source to listen to. If the collector runs as root (default), use 514. Otherwise, consider 1514 or 5140. Make sure the devices are sending to the same port.
-1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. Make a note of the source category. You’ll supply it in [Step 2](#step-2-configure-symantec-proxy-secure-gateway) below.
-1. **Fields**. 
-    1. If you have not configured the Installed Collector to forward all sources in the collector to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*.
-    1. If you have not configured the Installed Collector to parse all sources in the collector with the same parser, click the **+Add Field** link, and add a field whose name is `_parser` with the value */Parsers/System/Blue Coat/Blue Coat ProxySG CSV*. 
-1. Click **Save**.
-
-## Step 2: Configure Symantec Proxy Secure Gateway
-
-In this step, you configure ProxySG to forward access logs to the the Syslog Source. For instructions, see [Sending Access Logs to a Syslog server](https://knowledge.broadcom.com/external/article/166529/sending-access-logs-to-a-syslog-server.html) on the Broadcom knowledge site. 
-
-## Step 3: Verify Ingestion
-
-In this step, you verify that your logs are successfully making it into Cloud SIEM. 
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
-1. On the **Log Mappings** tab search for "ProxySG" and check the **Records** columns. A list of mappers for ProxySG will appear and you can see if logs are coming in.
-1. For a more granular look at the incoming records, you can also search Sumo Logic for ProxySG records. <br/><img src={useBaseUrl('img/cse/proxysg-search.png')} alt="ProxySG search" style={{border: '1px solid gray'}} width="500"/> 
+Cloud SIEM supports collection either from a file or over syslog. Instructions for syslog are included in this article.
+
+To ingest Symantec Proxy Secure Gateway data into Cloud SIEM:
+1. [Configure a Syslog source](/docs/send-data/installed-collectors/sources/syslog-source/#configure-a-syslog-source) on a collector. When you configure the source, do the following:
+    1. Click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will ensure all logs for this source are forwarded to Cloud SIEM.
+    1. Add another field named `_parser` with value */Parsers/System/Blue Coat/Blue Coat ProxySG CSV*. This ensures that the Symantec Proxy Secure Gateway (Blue Coat Proxy) logs are parsed and normalized into structured records in Cloud SIEM.
+1. Configure ProxySG to forward access logs to the the syslog source. For instructions, see [Sending Access Logs to a Syslog Server](https://knowledge.broadcom.com/external/article/166529/sending-access-logs-to-a-syslog-server.html) on the Broadcom knowledge site. 
+1. To verify that your logs are successfully making it into Cloud SIEM:
+   1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
+   1. On the **Log Mappings** tab search for "ProxySG" and check the **Records** columns. A list of mappers for ProxySG will appear and you can see if logs are coming in.
+   1. For a more granular look at the incoming records, you can also search Sumo Logic for ProxySG records. <br/><img src={useBaseUrl('img/cse/proxysg-search.png')} alt="ProxySG search" style={{border: '1px solid gray'}} width="500"/>