Skip to content

Commit 187b52f

Browse files
ntanwar-sumontanwar-sumo
authored
Merge branch 'main' into doc_pr_validations
2 parents 6bcc8f2 + 9138808 commit 187b52f

File tree

184 files changed

+3167
-2205
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

184 files changed

+3167
-2205
lines changed

‎.github/workflows/pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,5 +44,5 @@ jobs:
4444
name: Check spelling
4545
with:
4646
skip: "*.svg,*.js,*.map,*.css,*.scss"
47-
ignore_words_list: "aks,atleast,cros,ddress,fiel,ist,nd,ot,pullrequest,ser,shttp,wast,fo,seldomly,delt,cruzer,plack,secur,te,nginx,Nginx,notin"
47+
ignore_words_list: "aks,atleast,cros,ddress,delink,fiel,ist,nd,ot,pullrequest,ser,shttp,wast,fo,seldomly,delt,cruzer,plack,secur,te,nginx,Nginx,notin"
4848
path: docs

‎blog-cse/2025-06-12-content.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
title: June 12, 2025 - Content Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- log mappers
6+
- parsers
7+
- rules
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
This content release includes:
14+
- New detection rules for browser extension persistence, Kerberos certificate authentication, GitHub vulnerability alerts, Okta application access monitoring, and threat intelligence email matching.
15+
- New product support for Atlassian audit and login events.
16+
- Enhanced Azure Event Hub Windows Defender integration with new threat event mapping for passthrough alerts.
17+
- Cisco ASA updates with new network event support and NAT IP handling improvements.
18+
- Citrix NetScaler mapping updates to support additional events.
19+
- Update to Auth0 successful/unsuccessful login mappings to properly classify each.
20+
- CrowdStrike NextGen SIEM Alert event support.
21+
- Mimecast security event mapping improvements across several event types.
22+
- AWS CloudTrail network event enhancements with event success/failure handling and protocol support.
23+
- Parser updates to support additional event formats for multiple platforms.
24+
25+
Changes are enumerated below.
26+
27+
### Rules
28+
- [New] MATCH-S00897 Chromium Extension Installed
29+
- Threat actors may install browser extensions as a form of persistence on victim systems. Look up the 32 character extension ID in order to ensure that the extension is valid and expected to be installed as part of normal business operations. This extension ID can be found in the following values: `file_path` and/or `changeTarget` depending on the source of the telemetry. This rule logic utilizes Sysmon file creation events, which need to be enabled and configured on relevant assets.
30+
- [New] FIRST-S00064 First Seen Certificate Thumbprint in Successful Kerberos Authentication
31+
- This alert looks for a first seen certificate thumbprint being used to authenticate to an Active Directory environment, resulting in a Kerberos ticket being successfully issued. This alert is designed to catch Active Directory Certificate Services related attacks, ensure the certificate thumprint is valid, correlate the thumbprint ID with other Certificate Services events, particularly looking for recently issued templates.
32+
- [New] MATCH-S00949 GitHub - Vulnerability Alerts
33+
- Detects vulnerability alerts created for a GitHub repository.
34+
- [New] FIRST-S00070 Okta - First Seen Application Accessed by User
35+
- This signal looks for a user that is accessing an application behind Okta SSO that is first seen since the baseline period. Ensure that access of this application is expected and authorized, look for other Okta events around the user account in question to determine whether access to this application is expected and authorized.
36+
- [New] AGGREGATION-S00007 Okta - Session Anomaly (Multiple Operating Systems)
37+
- This rule detects when a user has utilized multiple distinct operating systems when performing authentication through Okta. This activity could potentially indicate credential theft or a general session anomaly. Examine other Okta related events surrounding the time period for this signal, pivoting off the username value to examine if any other suspicious activity has taken place. If this rule is generating false positives, adjust the threshold value and consider excluding certain user accounts via tuning expression or a match list.
38+
- [New] MATCH-S01020 Threat Intel - Matched Target Email
39+
- Detects email addresses associated with known malicious actor(s) or campaign(s) as designated by a threat intelligence provider.
40+
- [New] MATCH-S01019 Threat Intel - Matched User Email
41+
- Detects email addresses associated with known malicious actor(s) or campaign(s) as designated by a threat intelligence provider.
42+
- [Updated] MATCH-S00170 Windows - Scheduled Task Creation
43+
- Fixed spelling error.
44+
45+
### Log Mappers
46+
- [New] Altassian audit events
47+
- [New] Altassian login events
48+
- [New] Azure Event Hub - Windows Defender Azure Alert
49+
- [New] Cisco ASA 4180(18|19|44)
50+
- [New] Cisco ASA 713nnn JSON
51+
- [New] Cisco ASA Network events
52+
- [New] Citrix NetScaler - SSL Handshake Failure
53+
- [New] CrowdStrike NextGen SIEM
54+
- [Updated] Auth0 Failed Authentication
55+
- [Updated] Auth0 Successful Authentication
56+
- [Updated] Azure Event Hub - Windows Defender Logs
57+
- [Updated] Cisco ASA 106010 JSON
58+
- [Updated] Cisco ASA 20900(4|5) JSON
59+
- [Updated] Cisco ASA 50000(4|3) JSON
60+
- [Updated] Citrix NetScaler - TCP Connection
61+
- [Updated] CloudTrail - ec2.amazonaws.com - All Network Events
62+
- [Updated] F5 HTTP Request
63+
- [Updated] Mimecast AV Event
64+
- [Updated] Mimecast Audit Authentication Logs
65+
- [Updated] Mimecast Audit Hold Messages
66+
- [Updated] Mimecast Audit Logs
67+
- [Updated] Mimecast DLP Logs
68+
- [Updated] Mimecast Email logs
69+
- [Updated] Mimecast Impersonation Event
70+
- [Updated] Mimecast Spam Event
71+
- [Updated] Mimecast Targeted Threat Protection Logs
72+
73+
### Parsers
74+
- [New] /Parsers/System/Atlassian/Atlassian Audit Events
75+
- [Updated] /Parsers/System/Cisco/Cisco ASA
76+
- [Updated] /Parsers/System/Cisco/Cisco Umbrella CSV
77+
- [Updated] /Parsers/System/Citrix/Citrix NetScaler Syslog
78+
- [Updated] /Parsers/System/AWS/CloudTrail
79+
- [Updated] /Parsers/System/CrowdStrike/CrowdStrike Falcon Endpoint - JSON
80+
- [Updated] /Parsers/System/F5/F5 Syslog
81+
- [Updated] /Parsers/System/Microsoft/Microsoft Azure JSON
82+
- [Updated] /Parsers/System/Microsoft/Windows-JSON-Open Telemetry

‎blog-service/2025-06-16-apps-2.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Snyk (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- snyk
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to introduce the new Snyk app for Sumo Logic. This app enables you to gain real-time visibility into security vulnerabilities across your software projects and dependencies. This app also helps security and DevOps teams track risk exposure, prioritize remediation, and maintain a strong security posture. [Learn more](/docs/integrations/webhooks/snyk).

‎blog-service/2025-06-16-apps.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
title: AWS CloudTrail Updates (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- aws-cloudtrail
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
AWS is streamlining [CloudTrail](https://aws.amazon.com/cloudtrail/) events for [IAM Identity Center](https://aws.amazon.com/iam/identity-center/) to retain only the essential fields needed for audit and incident response workflows. These changes improve user identification and integration with directories like Okta and Microsoft Active Directory, and do not impact CloudTrail events from other AWS services.
13+
14+
- To support this AWS update, Sumo Logic has revised several AWS apps and Cloud SIEM parsers. You are requested to reinstall the affected apps.
15+
- If you use CloudTrail data in the saved searches, dashboards, or detection rules, you are required to update your custom content before AWS enforces the changes on July 14, 2025.
16+
17+
To learn more, see [Important changes to CloudTrail events for AWS IAM Identity Center](https://aws.amazon.com/blogs/security/modifications-to-aws-cloudtrail-event-data-of-iam-identity-center/).
18+
19+
### Impact following the AWS CloudTrail updates
20+
21+
AWS is updating CloudTrail events for IAM Identity Center, affecting how user identity data is structured. So, if you are using the updated fields in your Cloud SIEM content or across the Sumo Logic platform, you need to update any saved queries, dashboards, or detection rules to reflect these changes and ensure continued functionality.
22+
23+
Key actions required while updating the AWS CloudTrail include:
24+
- Sumo Logic provided apps must be manually reinstalled to incorporate the updated event field mappings.
25+
- Cloud SIEM parsers have auto-updated and require no customer intervention.
26+
27+
### Action plan for Sumo Logic users
28+
29+
#### Step 1: Reinstall the relevant Sumo Logic apps
30+
31+
If you're using any of the following apps that consume CloudTrail data, you must reinstall them:
32+
- [Amazon CloudTrail – Cloud Security Monitoring and Analytics](/docs/integrations/cloud-security-monitoring-analytics/aws-cloudtrail/)
33+
- [AWS CloudTrail](/docs/integrations/amazon-aws/cloudtrail/)
34+
- [CIS AWS Foundations Benchmark](/docs/integrations/amazon-aws/cis-aws-foundations-benchmark/)
35+
- [PCI Compliance for AWS CloudTrail](/docs/integrations/amazon-aws/cloudtrail-pci-compliance/)
36+
- [Threat Intel for AWS](/docs/integrations/amazon-aws/threat-intel/)
37+
- [Cloud Infrastructure Security for AWS](/docs/security/additional-security-features/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/)
38+
39+
To reinstall any of the above apps, follow the steps below:
40+
41+
1. Navigate to the **App Catalog**.
42+
1. Search for the relevant app.
43+
1. Install to deploy updated content under a new folder.
44+
45+
:::info
46+
These are Classic apps (V1), and reinstalling them will create a new folder in your Content Library with updated dashboards.
47+
:::
48+
49+
#### Step 2: Update the custom saved searches and dashboards
50+
51+
If you’ve created custom content based on CloudTrail fields, manual field updates as given below will be required to accommodate the new schema:
52+
- Move the `userName` field from the `userIdentity` element to the `additionalEventData` element.
53+
- Remove the `principalId` field from the schema.
54+
- Move the `userId`, `identityStoreArn`, and `credentialId` fields to the `userIdentity` element.
55+
56+
For more information on field changes, see [AWS Security Blog](https://aws.amazon.com/blogs/security/modifications-to-aws-cloudtrail-event-data-of-iam-identity-center/#:~:text=How%20to%20prepare%20your%20workflows%20for%20the%20upcoming%20changes%20to%20IAM%20Identity%20Center%20user%20identification%20in%20CloudTrail).
57+
58+
:::note
59+
AWS plans to implement these enhancements on [July 14, 2025](https://aws.amazon.com/blogs/security/modifications-to-aws-cloudtrail-event-data-of-iam-identity-center/#:~:text=Effective%20July%2014%2C%202025).
60+
61+
Sumo Logic apps are backward-compatible, allowing you to update the apps ahead of time. For any custom content outside of Sumo Logic’s apps or parsers, ensure your changes are backward compatible and deploy updates before July 14, 2025.
62+
:::
63+
64+
### FAQ
65+
66+
#### What happens if I don’t update my applications or searches?
67+
68+
Failure to update your apps, saved searches, or dashboards will result in user-related fields not being parsed correctly. Consequently, visualizations and panels relying on those fields will appear empty or display inaccurate data.

‎blog-service/2025-06-17-apps.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Palo Alto Networks 11 (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- palo-alto-networks-11
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to introduce the new Palo Alto Networks 11 app for Sumo Logic. This app enables you to analyze traffic and understand your Palo Alto Networks environments. In addition, you can dive deeper into the data, which is broken down by threat detection indicators, malware type, and so on. [Learn more](/docs/integrations/cloud-security-monitoring-analytics/palo-alto-networks-11).

‎blog-service/2025-06-18-dashboards.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Scope-Based Variable (Dashboards)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- dashboard
6+
- scope-based-variable
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We’re excited to introduce a new dashboard variable type: Scope-Based Variables. Scope-Based Variables act as log filters that can be automatically applied to all or selected panels within a dashboard. This helps you to easily filter data across multiple panels without needing to manually edit each panel’s query to accept the variable. [Learn more](/docs/dashboards/filter-template-variables).

‎blog-service/2025-06-20-apps.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: New SaaS and Cloud Apps Release (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- snowflake-logs
7+
- akamai-cpc
8+
hide_table_of_contents: true
9+
---
10+
11+
- **Akamai CPC**.We're excited to introduce the new Akamai CPC app for Sumo Logic. This app enables you to monitor threats and respond to them in real time, enforcing compliance for client-side web applications using rich dashboards and Akamai CPC data. [Learn more](/docs/integrations/saas-cloud/akamai-cpc).
12+
13+
- **Snowflake Logs**. We're excited to introduce the new Snowflake Logs app for Sumo Logic. This app enables you to gain real-time insights into key metrics, query performance, and overall health of the Snowflake environments to optimize operations, support informed decisions, and maximize Snowflake's potential. [Learn more](/docs/integrations/saas-cloud/snowflake-logs).

‎blog-service/2025-06-20-manage.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: Deactivate and Delink the Child Orgs (Manage)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- manage
6+
- child-org
7+
- deactivate-and-delink
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
We're happy to introduce the deactivate and delink option to child orgs, this helps you to deactivate the child org when it is no longer needed and eventually delink it after the 48 hours cooling-off period.
14+
15+
[Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/).

0 commit comments

Comments
 (0)