Skip to content

Commit 272a08b

Browse files
JV0812JV0812
authored
Merge branch 'main' into Symantec-Endpoint-Security-App
2 parents 94f4425 + 8f00edb commit 272a08b

File tree

24 files changed

+1295
-79
lines changed

24 files changed

+1295
-79
lines changed

‎blog-service/2025-01-10-apps.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
---
2-
title: Symantec Endpoint Security Service (Apps)
2+
title: New SaaS and Cloud Apps Release (Apps)
33
image: https://help.sumologic.com/img/sumo-square.png
44
keywords:
55
- apps
66
- symantec-endpoint-security-service
7+
- jamf
78
hide_table_of_contents: true
89
---
910

1011
import useBaseUrl from '@docusaurus/useBaseUrl';
1112

1213
<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
1314

14-
We're excited to introduce the new Symantec Endpoint Security Service app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Symantec Endpoint Security source that collects incident and event logs data from the Symantec Endpoint Security platform. This app provides real-time insights into the log data that allows you to monitor and manage endpoint security in real time, enhancing quick responses to threats. [Learn more](/docs/integrations/saas-cloud/symantec-endpoint-security-service/).
15+
- **Symantec Endpoint Security Service**. We're excited to introduce the new Symantec Endpoint Security Service app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Symantec Endpoint Security source that collects incident and event logs data from the Symantec Endpoint Security platform. This app provides real-time insights into the log data that allows you to monitor and manage endpoint security in real time, enhancing quick responses to threats. [Learn more](/docs/integrations/saas-cloud/symantec-endpoint-security-service/).
16+
17+
- **Jamf**. We're excited to introduce the new Jamf app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Jamf source that collects inventory data from the Jamf platform. This app helps security analysts with critical insights into their organization's Jamf environment. [Learn more](/docs/integrations/saas-cloud/jamf/).
18+

‎cid-redirects.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1578,6 +1578,7 @@
15781578
"/cid/10111": "/docs/integrations/app-development/jfrog-xray",
15791579
"/cid/10188": "/docs/integrations/saas-cloud/miro",
15801580
"/cid/10187": "/docs/integrations/saas-cloud/digital-guardian-arc",
1581+
"/cid/10114": "/docs/integrations/saas-cloud/jamf",
15811582
"/cid/10208": "/docs/integrations/saas-cloud/cisco-meraki-c2c",
15821583
"/cid/10209": "/docs/integrations/security-threat-detection/cisco-meraki",
15831584
"/cid/10210": "/docs/integrations/saas-cloud/proofpoint-tap",

‎docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -259,10 +259,10 @@ import CreateMonitors from '../../../reuse/apps/create-monitors.md';
259259

260260
| Name | Description | Alert Condition | Recover Condition |
261261
|:--|:--|:--|:--|
262-
| `Artifactory - Excessive Denied Login Attempts` | This alert is triggered when there are multiple denied login attempts from the same IP or user. | Count `>` 5 | Count `<=` 5 |
263-
| `Artifactory - High 4xx Status Codes` | This alert is triggered when there's a high number of HTTP 4xx error responses. | Count `>` 10 | Count `<=` 10 |
264-
| `Artifactory - High 5xx Status Codes` | This alert is triggered when there's a high number of HTTP 5xx error responses. | Count `>` 10 | Count `<=` 10 |
265-
| `Artifactory - High Denied Deploys to Cached Repos` | This alert is triggered when there's a high number of denied deploy attempts to cached repositories. | Count `>` 5 | Count `<=` 5 |
266-
| `Artifactory - High Denied Deploys to Non-Cached Repos` | This alert is triggered when there's a spike in denied deploy attempts to non-cached repositories. | Count `>` 5 | Count `<=` 5 |
267-
| `Artifactory - High Denied Downloads` | This alert is triggered when there's a high number of denied download attempts. | Count `>` 5 | Count `<=` 5 |
268-
| `Artifactory - Slow HTTP Response Times` | This alert is triggered when Artifactory response times are high. | Count `>` 5 | Count `<=` 5 |
262+
| `Artifactory - Excessive Denied Login Attempts` | This alert is triggered when there are multiple denied login attempts from the same IP or user. | Count > 5 | Count \<= 5 |
263+
| `Artifactory - High 4xx Status Codes` | This alert is triggered when there's a high number of HTTP 4xx error responses. | Count > 10 | Count \<= 10 |
264+
| `Artifactory - High 5xx Status Codes` | This alert is triggered when there's a high number of HTTP 5xx error responses. | Count > 10 | Count \<= 10 |
265+
| `Artifactory - High Denied Deploys to Cached Repos` | This alert is triggered when there's a high number of denied deploy attempts to cached repositories. | Count > 5 | Count \<= 5 |
266+
| `Artifactory - High Denied Deploys to Non-Cached Repos` | This alert is triggered when there's a spike in denied deploy attempts to non-cached repositories. | Count > 5 | Count \<= 5 |
267+
| `Artifactory - High Denied Downloads` | This alert is triggered when there's a high number of denied download attempts. | Count > 5 | Count \<= 5 |
268+
| `Artifactory - Slow HTTP Response Times` | This alert is triggered when Artifactory response times are high. | Count > 5 | Count \<= 5 |

‎docs/integrations/app-development/opentelemetry/jira-opentelemetry.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,3 +277,21 @@ The **Jira - Sprints Events** dashboard provides insights on sprint events in Ji
277277
The **Jira - User Events** dashboard provides information about user events in Jira, including the number of user events, trends, and users that have been updated, created, and deleted.
278278
279279
<img src='https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Jira-OpenTelemetry/Jira-User-Events.png' alt="User Events" />
280+
281+
282+
## Create monitors for Jira app
283+
284+
import CreateMonitors from '../../../reuse/apps/create-monitors.md';
285+
286+
<CreateMonitors/>
287+
288+
### Jira alerts
289+
290+
| Name | Description | Alert Condition | Recover Condition |
291+
|:--|:--|:--|:--|
292+
| `Jira - Abnormal Session Creation Rate Alert` | This alert is triggered when there are unusual patterns in session creation/destruction that might indicate security issues or system problems. | Count >= 1 | Count < 1 |
293+
| `Jira - High Average Response Time Alert` | This alert is triggered when elevated response times in Jira are detected, indicating potential performance degradation. | Count >= 5000 | Count < 5000 |
294+
| `Jira - High HTTP 4xx Error Rate Alert` | This alert is triggered when there is increase in HTTP 4xx errors to detect service disruptions. | Count >= 50 | Count < 50 |
295+
| `Jira - High HTTP 5xx Error Rate Alert` | This alert is triggered when there is increase in HTTP 5xx errors to detect service disruptions. | Count >= 50 | Count < 50 |
296+
| `Jira - High Priority Issues Unassigned SLA Alert` | This alert is triggered when high-priority issues remain unassigned beyond the Default SLA threshold of 30 minutes (1800000 milliseconds). To adjust the SLA, update the value in the query to the desired time in milliseconds (e.g., 15 minutes = 900000, 1 hour = 3600000). | Count >= 1 | Count < 1 |
297+
| `Jira - Rapid Authentication Failures Alert` | This alert is triggered when a single user experiences more than 10 failed login attempts within 5 minutes, indicating potential password guessing attempts or account lockout issues. | Count > 10 | Count \<= 10 |

‎docs/integrations/app-development/opentelemetry/jmx-opentelemetry.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,4 +251,4 @@ import CreateMonitors from '../../../reuse/apps/create-monitors.md';
251251
| `JMX - High Heap Memory Usage Alert` | This alert gets triggered when heap memory usage exceeds threshold. | Count < 20 | Count >= 20 |
252252
| `JMX - High Memory Pool Usage Alert` | This alert gets triggered when memory pool usage exceeds threshold. | Count < 20 | Count >= 20 |
253253
| `JMX - High Non Heap Memory Usage Alert` | This alert gets triggered when non heap memory usage exceeds threshold. | Count < 20 | Count >= 20 |
254-
| `JMX - High Number Of Classes Loaded Alert` | This alert gets triggered when high number of classes are loaded. | Count > 1000 | Count < = 1000 |
254+
| `JMX - High Number Of Classes Loaded Alert` | This alert gets triggered when high number of classes are loaded. | Count > 1000 | Count \<= 1000 |

‎docs/integrations/app-development/opentelemetry/puppet-opentelemetry.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,3 +276,18 @@ This sample query is from the **Puppet - Overview** dashboard > **Node Requests
276276
### Node Puppet Runs Analysis: Puppet Node Runs Analysis
277277

278278
<img src='https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Puppet-OpenTelemetry/Puppet-Node-Puppet-Runs-Analysis.png' alt="Node Puppet Runs Analysis" />
279+
280+
## Create monitors for Puppet app
281+
282+
import CreateMonitors from '../../../reuse/apps/create-monitors.md';
283+
284+
<CreateMonitors/>
285+
286+
### Puppet alerts
287+
288+
| Name | Description | Alert Condition | Recover Condition |
289+
|:--|:--|:--|:--|
290+
| `Puppet - Catalog Compilation Performance` | This alert is triggered when average time taken to compile Puppet catalogs is greater than given value (Default 30 seconds). Extended compilation times can indicate Puppet master performance issues, complex catalogs, or resource constraints. | Count \>= 30 | Count \< 30 |
291+
| `Puppet - Erroneous Nodes` | This alert is triggered when a node has error more errors then given value (Default 5). | Count \>= 5 | Count \< 5 |
292+
| `Puppet - Error Pattern Analysis` | This alert is triggered when Puppet error logs show recurring patterns that may indicate issues, helping detect problems that need investigation. | Count \>= 20 | Count \< 20 |
293+
| `Puppet - Resource Status Failures` | This alert is triggered when there are specific resource failures greater than given value (Default 5). | Count \>= 5 | Count \< 5 |

‎docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,3 +223,19 @@ Use this dashboard to:
223223
- Monitor service usage and other system activity.
224224

225225
<img src='https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/Linux-Cloud-Security-Monitoring-and-Analytics/Opentelemetry/Linux-Security-Analytics-User-Service-and-System-Monitoring.png' style={{border: '1px solid gray'}} alt="Linux-Security-Analytics-User-Service-and-System-Monitoring" />
226+
227+
228+
## Create monitors for Linux - Cloud Security Monitoring and Analytics app
229+
230+
import CreateMonitors from '../../../reuse/apps/create-monitors.md';
231+
232+
<CreateMonitors/>
233+
234+
### Linux - Cloud Security Monitoring and Analytics alerts
235+
236+
| Name | Description | Alert Condition | Recover Condition |
237+
|:--|:--|:--|:--|
238+
| `Linux CSMA - Excessive Failed Authentication` | This alert is triggered when multiple failed login attempts from the same source are detected, indicating potential brute force attempts. | Count > 10 | Count \<= 10 |
239+
| `Linux CSMA - Root Login Detection` | This alert is triggered when direct login attempts using the root account are detected, indicating a potential security concern since root logins should typically be disabled. | Count \>= 1 | Count < 1 |
240+
| `Linux CSMA - System Shutdown Detection` | This alert is triggered when unexpected system shutdown events are detected through kernel stop messages, which may indicate unauthorized access, malicious activity, power issues, or system failures. | Count > 0 | Count \<= 0 |
241+
| `Linux CSMA - User Account Creation Spike` | This alert is triggered when multiple user accounts are created in a short time period, which may indicate automated account creation, compromised systems, or unauthorized bulk user provisioning. | Count > 3 | Count \<= 3 |

‎docs/integrations/microsoft-azure/microsoft-graph-identity-protection.md‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -120,16 +120,33 @@ _sourceCategory=msgip-app-src riskEventType
120120
| count(risk_id) by risk_level
121121
| sort by _count
122122
```
123+
## Collection configuration and app installation
123124

124-
## Collecting logs for Microsoft Graph Identity Protection API
125+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
125126

126-
This section explains how to collect logs from Microsoft Graph Identity Protection API and ingest them into Sumo Logic. For details, see [Cloud-to-Cloud-Integration for Microsoft Graph Identity Protection Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source/) to create the source and use the same source category while installing the app.
127+
<CollectionConfiguration/>
127128

128-
## Installing the Microsoft Graph Identity Protection app
129+
:::important
130+
Use the [Cloud-to-Cloud Integration for Microsoft Graph Identity Protection](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Microsoft Graph Identity Protection app is properly integrated and configured to collect and analyze your Microsoft Graph Identity Protection data.
131+
:::
129132

130-
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
133+
### Create a new collector and install the app
131134

132-
<AppInstall2/>
135+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
136+
137+
<AppCollectionOPtion1/>
138+
139+
### Use an existing collector and install the app
140+
141+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
142+
143+
<AppCollectionOPtion2/>
144+
145+
### Use an existing source and install the app
146+
147+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
148+
149+
<AppCollectionOPtion3/>
133150

134151
## Viewing Microsoft Graph Identity Protection dashboards
135152

‎docs/integrations/product-list/product-list-a-l.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
300300

301301
| Logo | Vendors and Products | Integrations |
302302
| :-- | :-- | :-- |
303-
| <img src={useBaseUrl('img/integrations/misc/jamf-logo.png')} alt="Thumbnail icon" width="50"/> | [Jamf](https://www.jamf.com/) | Automation integration: [Jamf](/docs/platform-services/automation-service/app-central/integrations/jamf/) <br/>Cloud SIEM integration: [Jamf](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/3fe48850-f882-43c3-ab80-1e0354cf2aba.md) <br/>Community app: [Sumo Logic for JAMF](https://github.com/SumoLogic/sumologic-content/tree/master/JAMF) <br/>Partner integration: [Jamf Protect App for Sumo Logic](https://github.com/SumoLogic/sumologic-public-partner-apps/tree/master/JamfProtect) <br/>Collector: [Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source) |
303+
| <img src={useBaseUrl('img/integrations/misc/jamf-logo.png')} alt="Thumbnail icon" width="50"/> | [Jamf](https://www.jamf.com/) | App: [Jamf](/docs/integrations/saas-cloud/jamf)<br/>Automation integration: [Jamf](/docs/platform-services/automation-service/app-central/integrations/jamf/) <br/>Cloud SIEM integration: [Jamf](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/3fe48850-f882-43c3-ab80-1e0354cf2aba.md) <br/>Community app: [Sumo Logic for JAMF](https://github.com/SumoLogic/sumologic-content/tree/master/JAMF) <br/>Partner integration: [Jamf Protect App for Sumo Logic](https://github.com/SumoLogic/sumologic-public-partner-apps/tree/master/JamfProtect) <br/>Collector: [Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source) |
304304
| <img src={useBaseUrl('img/integrations/app-development/jenkins.png')} alt="Thumbnail icon" width="50"/> | [Jenkins](https://www.jenkins.io/) | App: [Jenkins](/docs/integrations/app-development/jenkins/) |
305305
| <img src={useBaseUrl('img/integrations/app-development/jfrog-Artifactory.png')} alt="Thumbnail icon" width="75"/> | [JFrog Artifactory](https://jfrog.com/artifactory/) | Apps: <br/>- [Artifactory (6 and 7) - Classic](/docs/integrations/app-development/jfrog-artifactory/) <br/>- [Artifactory - OpenTelemetry](/docs/integrations/app-development/opentelemetry/jfrog-artifactory-opentelemetry/) |
306306
| <img src={useBaseUrl('img/integrations/app-development/jfrog-xray.png')} alt="Thumbnail icon" width="50"/> | [JFrog Xray](https://jfrog.com/help/r/get-started-with-the-jfrog-platform/jfrog-xray) | App: [JFrog Xray](/docs/integrations/app-development/jfrog-xray/) <br/>Collector: [JFrog Xray Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jfrog-xray-source/) |

‎docs/integrations/saas-cloud/armis.md‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -183,15 +183,33 @@ _sourceCategory=ArmisDashboards id
183183
| count_distinct(id)
184184
```
185185

186-
## Collecting logs for Armis API
186+
## Collection configuration and app installation
187187

188-
This section explains how to collect logs from Armis API and ingest them into Sumo Logic. Refer to the [Armis API Cloud-to-Cloud Integration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/armis-api-source/) to create the source and use the same source category while installing the app.
188+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
189189

190-
## Installing the Armis app
190+
<CollectionConfiguration/>
191191

192-
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
192+
:::important
193+
Use the [Cloud-to-Cloud Integration for Armis](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/armis-api-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Armis app is properly integrated and configured to collect and analyze your Armis data.
194+
:::
193195

194-
<AppInstall2/>
196+
### Create a new collector and install the app
197+
198+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
199+
200+
<AppCollectionOPtion1/>
201+
202+
### Use an existing collector and install the app
203+
204+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
205+
206+
<AppCollectionOPtion2/>
207+
208+
### Use an existing source and install the app
209+
210+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
211+
212+
<AppCollectionOPtion3/>
195213

196214
## Viewing the Armis dashboards
197215

0 commit comments

Comments
 (0)