Skip to content

Commit 1a19b73

Browse files
amee-sumoamee-sumo
authored
Merge branch 'main' into Docs-update-for-OTEL-CDN
2 parents dae0810 + c3e5977 commit 1a19b73

File tree

76 files changed

+905
-344
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+905
-344
lines changed

‎blog-cse/2025-09-19-content.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
title: September 19, 2025 - Content Release
3+
image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082
4+
keywords:
5+
- log mappers
6+
- rules
7+
- parsers
8+
hide_table_of_contents: true
9+
---
10+
11+
This content release includes:
12+
- New rules for passing through OCSF Findings, such as those generated by AWS Security Hub.
13+
- Updates to rules for impossible travel to exclude local system accounts.
14+
- New log mappers for Cisco Meraki Traffic Events, OCI Authentication Events, and TippingPoint TPS Cloud.
15+
- Updates to existing log mappers to support new event IDs and enhance functionality.
16+
- New parser for TippingPoint TPS Cloud.
17+
- Updates to existing parsers for Cisco ASA, Cisco Meraki C2C, Kaspersky Endpoint Security, and Oracle Cloud Infrastructure to support new events.
18+
- Schema update to include `ocsf` as an enforced value for `threat_ruleType`.
19+
20+
Changes are enumerated below.
21+
22+
### Rules
23+
24+
- [New] MATCH-S01053 OCSF Compliance Finding
25+
<br/>Passes through compliance findings from OCSF sources.
26+
- [New] MATCH-S01054 OCSF Detection Finding
27+
<br/>Passes through detection findings from OCSF sources.
28+
- [New] MATCH-S01055 OCSF Vulnerability Finding
29+
<br/>Passes through vulnerability findings from OCSF sources.
30+
- [Updated] THRESHOLD-S00097 Impossible Travel - Successful
31+
<br/>Exclude local system accounts from the rule.
32+
- [Updated] THRESHOLD-S00098 Impossible Travel - Unsuccessful
33+
<br/>Exclude local system accounts from the rule.
34+
35+
### Log Mappers
36+
37+
- [New] Cisco Meraki Traffic Events
38+
- [New] OCI Catch Authentication events
39+
- [New] TippingPoint TPS Cloud Catch All
40+
- [Updated] AWS GuardDuty - OCSF Finding Events
41+
<br/>Modified to support dedicated OCSF finding rules.
42+
- [Updated] AWS Inspector - OCSF Finding Events
43+
<br/>Modified to support dedicated OCSF finding rules.
44+
- [Updated] AWS Security Hub - OCSF Finding Events
45+
<br/>Modified to support dedicated OCSF finding rules.
46+
- [Updated] AWS Security Hub Coverage - OCSF Finding Events
47+
<br/>Modified to support dedicated OCSF finding rules.
48+
- [Updated] AWS Security Hub Exposure Detection - OCSF Finding Events
49+
<br/>Modified to support dedicated OCSF finding rules.
50+
- [Updated] Cisco ASA 109201|109207|113022
51+
- [Updated] Cisco ASA 722051|722022|722023|722028|722032|722033|722036|722037|722041|722011
52+
- [Updated] Kaspersky Endpoint Security Catch All
53+
- [Updated] Oracle Cloud Infrastructure Audit Catch All
54+
- [Updated] Windows - Security - 4624
55+
<br/>Added `user_role` field to identify admin users
56+
- [Updated] Windows - Security - 4648
57+
<br/>Added `user_role` field to identify admin users.
58+
59+
### Parsers
60+
61+
- [New] /Parsers/System/TippingPoint/TippingPoint TPS Cloud
62+
- [Updated] /Parsers/System/Cisco/Cisco ASA
63+
- [Updated] /Parsers/System/Cisco/Cisco Meraki C2C
64+
- [Updated] /Parsers/System/Kaspersky/Kaspersky Endpoint Security
65+
- [Updated] /Parsers/System/Oracle/Oracle Cloud Infrastructure Schema
66+
- [Updated] threat_ruleType
67+
<br/>Updated enforced values to include `ocsf` as an option for mappers representing Findings records as categorized in the Open Cybersecurity Schema Framework (OCSF).

‎blog-cse/2025-09-22-application.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: September 22, 2025 - Application Update
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- insights
6+
hide_table_of_contents: true
7+
---
8+
9+
import useBaseUrl from '@docusaurus/useBaseUrl';
10+
11+
### Insight summary
12+
13+
We’re excited to announce the new insight summary pane, an AI-generated synopsis for each insight that describes the threat incidents that led to its creation. This helps security teams understand incidents faster and accelerate response time. The summary is generated by Sumo Logic's Summary Agent, an agentic AI tool.
14+
15+
[Learn more](/docs/cse/get-started-with-cloud-siem/insight-summary/).
16+
17+
<img src={useBaseUrl('img/cse/insight-summary-pane.png')} alt="Insight summary" style={{border: '1px solid gray'}} width="300"/>

‎blog-csoar/2025-09-10-application-update.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
1212

1313
### New feature: Test nodes in playbooks
1414

15-
The new **Test Node** toggle on nodes allows you to test individual nodes in playbooks without having to run the entire playbook, offering greater control over node configuration and troubleshooting.
15+
The new **Test Mode** toggle on nodes allows you to test individual nodes in playbooks without having to run the entire playbook, offering greater control over node configuration and troubleshooting.
1616

1717
What's new:
1818
* Provide mock values for variables used in the node, and run the results to see the output and any errors.

‎blog-service/2025-09-19-apps.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Azure Security - Microsoft Defender for Office 365 (Apps)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- apps
6+
- azure
7+
- microsoft
8+
- azure-security-microsoft-defender-for-office-365
9+
hide_table_of_contents: true
10+
---
11+
12+
import useBaseUrl from '@docusaurus/useBaseUrl';
13+
14+
We're excited to introduce the new Sumo Logic app for Azure Security - Microsoft Defender for Office 365. This app provides insights into threats and alerts across Microsoft 365, helping you prioritize incidents, respond faster, and strengthen your Office 365 security posture. [Learn more](/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-office-365).

‎blog-service/2025-09-19-collection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Azure Metrics Source (Collection)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- collection
6+
- azure-metrics-source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We’re excited to announce the release of our new Azure Metrics Source for Sumo Logic. This source enables you to collect metrics from Azure platform and send them to Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source/).

‎blog-service/2025-09-22-collection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: ChatGPT Compliance Source (Collection)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- c2c
6+
- chatgpt-compliance-source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to announce the release of our new cloud-to-cloud source for ChatGPT Compliance. This source securely collects conversation logs from the ChatGPT Compliance platform and sends them to Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/chatgpt-compliance-source).

0 commit comments

Comments
 (0)