You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Data Deletion Rules allow you to quickly and easily request the removal of ingested data from Sumo Logic. This helps you with removal of inadvertently ingested sensitive data.
Copy file name to clipboardExpand all lines: docs/cse/schema/username-and-hostname-normalization.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,7 +44,7 @@ The following fields of the schema are normalized.
44
44
|`srcDevice_hostname`| hostname |
45
45
|`user_username`| username |
46
46
47
-
When a username is normalized, the original, un-normalized name is placed in a `_raw` name attribute, for example, `user_useraname_raw`. The normalized name is placed in the attribute field `user_username`. The rules engine allows the `_raw` username forms to be used in rule creation.
47
+
When a username is normalized, the original, un-normalized name is placed in a `_raw` name attribute, for example, `user_username_raw`. The normalized name is placed in the attribute field `user_username`. The rules engine allows the `_raw` username forms to be used in rule creation.
48
48
49
49
If a name normalization configuration exists, the name attribute will be populated with the form `<username>:<friendly_domain>` where the `<friendly domain name>` portion is not populated for the normalized default domain. When name normalization is enabled all name fields (not-raw) will be lowercase. For more information, see [Single domain example](#single-domain-example) and [Multiple domains example](#multiple-domains-example) below.
50
50
@@ -182,4 +182,4 @@ Following is an example configuration for a case where the customer has a domain
182
182
183
183
## Additional resources
184
184
185
-
Blog: [What’s going on? The power of normalization in Cloud SIEM](https://www.sumologic.com/blog/whats-going-on-normalization-cloud-siem)
185
+
Blog: [What’s going on? The power of normalization in Cloud SIEM](https://www.sumologic.com/blog/whats-going-on-normalization-cloud-siem)
Copy file name to clipboardExpand all lines: docs/integrations/saml/onelogin.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,6 +24,7 @@ To use this feature, you'll need to enable access to your OneLogin logs and inge
24
24
:::
25
25
26
26
Once you begin uploading data, your daily data usage will increase. It's a good idea to check the **Account** page in Sumo Logic to ensure that you have enough quota to accommodate additional data in your account. If you need additional quota, you can [upgrade your account](/docs/manage/manage-subscription/upgrade-account/upgrade-cloud-flex-legacy-account) at any time.
27
+
-**OneLogin Enterprise** or **Unlimited** plan subscription.
To know about Deletion requests API, refer to the [Data Deletion Rules APIs](/docs/api/data-deletion-rules).
30
+
:::
31
+
28
32
## Create a deletion request
29
33
30
34
:::warning
@@ -34,6 +38,7 @@ After a data deletion request is approved, data will be deleted from the organiz
34
38
:::note
35
39
- During the data deletion process, existing messages may temporarily appear duplicated for a few seconds. These duplicated messages will automatically disappear once the data deletion is complete.
36
40
- Pinned queries may continue to display data identified for deletion for up to 24 hours from the initial run, prior to the data deletion request approval.
41
+
- Data deletion requests are automatically canceled after 30 days if no action is taken.
37
42
:::
38
43
39
44
:::info
@@ -52,7 +57,11 @@ Data cannot be recovered once it gets deleted. Ensure that you have appropriatel
52
57
:::
53
58
1. Select the **Time Range** when the data was ingested.
54
59
1. When you're done, click **Save**.
55
-
1. Your request will go to a Sumo Logic Customer Support Manager (CSM) for review and approval. You can check on your request in the **Status** column. <br/><img src={useBaseUrl('img/search/get-started-search/deletion-request-status.png')} alt="deletion request status" style={{border: '1px solid gray'}} width="400"/>
60
+
1. An email about your request will be sent to 50 most recently active approval users with [approval access](#approve-the-deletion-request). You can check on your request in the **Status** column.
61
+
:::note
62
+
If you require an approval apart from this 50 users, you can forward the deletion request approval email to the required users.
@@ -88,12 +97,27 @@ To cancel a data deletion request:
88
97
89
98
<img src={useBaseUrl('img/search/get-started-search/deletion-request-cancel.png')} alt="screenshot showing how to cancel a deletion request" style={{border: '1px solid gray'}} width="800"/>
90
99
100
+
## Approve the deletion request
101
+
102
+
:::note
103
+
To approve or reject a request, ensure you have the **Review Deletion Requests**[role capability](/docs/manage/users-roles/roles/role-capabilities/). By default, **Manage Deletion Requests** and **View Deletion Requests** capabilities will be added if you have the **Review Deletion Requests** capability.
104
+
:::
105
+
106
+
Once the deletion request is created, an email notification will be sent to the users who have approval access. To approve or reject the request, follow the steps below:
107
+
108
+
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to **Manage Data > Logs > Deletion Requests**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Logs** select **Deletion Requests**.
109
+
1. Filter for the status with **Pending review**. <img src={useBaseUrl('img/search/get-started-search/pending-requests.png')} alt="filter for pending deletion requests" style={{border: '1px solid gray'}} width="800"/>
110
+
1. Click the deletion request to review it.
111
+
1.**Approve** or **Reject** the request based on your requirement.<br/><img src={useBaseUrl('img/search/get-started-search/approve-reject-deletion-request.png')} alt="Approve/Reject deletion requests side panel" style={{border: '1px solid gray'}} width="400"/>
112
+
-**Approve**. Enter **Delete** in the **Approve Deletion Request** pop-up to permanently delete the data, and click the **Delete Data** button. <br/><img src={useBaseUrl('img/search/get-started-search/approve-deletion-request.png')} alt="Approve deletion requests pop-up" style={{border: '1px solid gray'}} width="400"/>
113
+
-**Reject**. Enter the reason for rejection in the **Reject Deletion Request** pop-up to help the requester understand the reason for rejection and take any necessary actions, and click the **Reject Request** button.<br/><img src={useBaseUrl('img/search/get-started-search/reject-deletion-request.png')} alt="Reject deletion requests pop-up" style={{border: '1px solid gray'}} width="400"/>
114
+
91
115
## Limitations
92
116
93
117
- Deletion requests will be processed one by one.
94
118
- You can create upto 100 deletion requests at a time.
95
119
- Each deletion request can include up to 1 petabyte (PB) of scanned data.
96
-
- You can delete up to 1,000,000 messages per request.
120
+
- You can delete up to 1,000,000 messages per request.
97
121
- The maximum time range for each deletion request is one year.
98
122
- Your system can support up to 10 active concurrent deletion tasks across different customers.
99
123
- Ensure that the requests initiated are not deleting the data prior to `1st February 2024`. Any request before this timestamp will fail in creation.
@@ -106,7 +130,7 @@ Customers must manage the future ingestion of sensitive data using [processing r
106
130
107
131
### Deletion scope
108
132
109
-
Deletion is restricted to partitions and the default view (sumologic_default) in Sumo Logic. Deletion is currently not supported for other view types, such as [Scheduled Views](/docs/manage/scheduled-views) or ad hoc views created using the save view operator. Sensitive data may still be present in these unsupported views.
133
+
Deletion is restricted to [Partitions](/docs/manage/partitions/), Default view (sumologic_default), [Scheduled Views](/docs/manage/scheduled-views), [Scheduled Search](/docs/alerts/scheduled-searches/), and ad hoc views in Sumo Logic. Deletion is currently not supported for audit indexes, security indexes, and other view types. Sensitive data may still be present in these unsupported views.
0 commit comments