Merge branch 'main' into docs-448-normalization

jpipkin1 · web-flow · commit 2801173020ee · 2024-10-31T14:30:12.000-05:00
diff --git a/blog-collector/2024-10-31.md b/blog-collector/2024-10-31.md
@@ -0,0 +1,21 @@
+---
+title: Version 19.514-1
+hide_table_of_contents: true
+image: https://help.sumologic.com/img/sumo-square.png
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-collector/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+In this release, we've enhanced the security and stability of the Collector with added support for security patches and bug fixes.
+
+### Security Fixes
+
+- Upgraded `com.fasterxml.jackson.core` to version 2.15.4 to address jackson-core vulnerability (CVE-2023-0067).
+- Upgraded `org.apache.avro:avro` to version 1.11.4 to address ion-java vulnerability (CVE-2024-47561).
+
+### Bug Fix
+
+- Fixed the intermittent collector crash issue for AD source.
+
diff --git a/blog-cse/2024-10-31-content.md b/blog-cse/2024-10-31-content.md
diff --git a/blog-service/2024-10-14-manage.md b/blog-service/2024-10-14-manage.md
@@ -17,7 +17,7 @@ We're excited to announce that when you create a role, you can select **Index Ac
 This feature was [previously only available to participants in our beta program](/release-notes-service/2023/12/31/#october-27-2023-manage-account). It is now available for general use.
 
 :::note
-These changes are rolling out across deployments incrementally and will be available on all deployments by October 25, 2024.
+These changes are rolling out across deployments incrementally and will be available on all deployments by November 15, 2024.
 :::
 
 [Learn more](/docs/manage/users-roles/roles/create-manage-roles/#create-a-role).
diff --git a/blog-service/2024-10-22-alerts.md b/blog-service/2024-10-22-alerts.md
@@ -14,7 +14,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 <a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
 
-We're excited to announce the general availability of AI-driven alerts for metrics anomalies, extending our AI-driven alerting to metrics-based monitors. This release helps reduce alert fatigue and enables faster incident resolution with automated playbooks.
+We're excited to announce the preview of AI-driven alerts for metrics anomalies, extending our AI-driven alerting to metrics-based monitors. This preview release helps reduce alert fatigue and enables faster incident resolution with automated playbooks.
 
 ### Key Features
 
diff --git a/blog-service/2024-10-29-manage.md b/blog-service/2024-10-29-manage.md
@@ -0,0 +1,22 @@
+---
+title: Scan Budgets (Manage) 
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - scan-budgets
+  - manage
+hide_table_of_contents: true
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+We are happy to introduce our new **Usage Management** tab under the **Accounts** section. This feature allows you to define query spending limits, helping prevent unexpected charges and manage Sumo Logic credits, particularly in pay-per-use scenarios by limiting search volume.
+
+Key features include:
+
+- **Org-wide query budget**. Set a budget for queries that applies to all users in the organization.
+- **User level and role level query budget**. Set limits on query data volume at the user level and role level.
+- **Flexible actions**. Choose what happens when the budget limit is reached. Options include **Display a warning to the user** or **Restrict queries to background scans only**.
+
+Explore our technical documentation [here](/docs/manage/manage-subscription/usage-management/) to learn how to set up and use Scan Budgets.
diff --git a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md
@@ -89,7 +89,7 @@ By default, when an entity’s Activity Score exceeds the threshold of 12, Clou
 
 After Cloud SIEM fires a particular Signal on a particular Entity, it suppresses Signals for that Signal-Entity combination for 12 to 24 hours. For more information, see [Redundant Signal suppression](#redundant-signal-suppression), below. 
 
-### Example of an Entity that has reached Activity Score threshold
+### Example of an Entity that has exceeded Activity Score threshold
 
 In the screenshot below, the **Details** pane on the left shows that the Insight was created for the entity “217.xxx.x.x”, an IP address. The right side of the page shows the Signals that contributed to the Insight. You can see each of the Signals relate to the IP address for which the Insight was created; in the Record underlying each of the Signals, is mapped to the `srcDevice_ip` schema attribute. 
 
diff --git a/docs/cse/introduction-to-cloud-siem.md b/docs/cse/introduction-to-cloud-siem.md
@@ -207,7 +207,7 @@ Cloud SIEM automatically normalizes, enriches, and correlates all your data acro
 
 <img src={useBaseUrl('img/cse/intro-cloud-siem-insight-generation-process-1.png')} alt="Records creation" style={{border: '1px solid gray'}} width="800"/>
 
-When records enter Cloud SIEM, rules analyze Entities on the records to produce Signals. The Signals are correlated, and if an Entity's activity score is 12 or more in a two-week period, [an Insight is generated](/docs/cse/get-started-with-cloud-siem/insight-generation-process/) for that Entity.
+When records enter Cloud SIEM, rules analyze Entities on the records to produce Signals. The Signals are correlated, and if an Entity's activity score exceeds 12 or more in a two-week period, [an Insight is generated](/docs/cse/get-started-with-cloud-siem/insight-generation-process/) for that Entity.
 
 <img src={useBaseUrl('img/cse/intro-cloud-siem-insight-generation-process-2.png')} alt="Insights creation" style={{border: '1px solid gray'}} width="725"/>
 
@@ -273,7 +273,7 @@ On the Cloud SIEM main page, you'll see a panel similar to this one. In this cas
 
 Cloud SIEM takes everything one step further and correlates those Signals into a manageable number of Insights. Here, just one Insight was created out of all those Signals.
 
-An Insight is a group of Signals clustered around a single entity. An Insight is created when the sum of the severity scores of Signals with the same entity goes above a certain activity score within a certain timeframe. By default, this is an activity score of 12 within the last 14 days. For example, if a rule was triggered with a severity of 5, and then ten days later another rule with the same entity and a severity of 5 was triggered, the total activity score would only be 10 in the last 14 days, so an Insight would not be created. However, if those same two rules had a severity score of 7, an Insight would be created.
+An Insight is a group of Signals clustered around a single entity. An Insight is created when the sum of the severity scores of Signals with the same entity goes above a certain activity score within a certain timeframe. By default, this is an activity score of 12 within the last 14 days. For example, if a rule was triggered with a severity of 5, and then ten days later another rule with the same entity and a severity of 5 was triggered, the total activity score would only be 10 in the last 14 days, so an Insight would not be created. However, if those same two rules had a severity score of 7, an Insight would be created because the total activity score exceeds 12.
 
 ## Get started with threat investigation
 
@@ -330,7 +330,7 @@ When you click into a Signal, you’ll have the option to see the full details o
 
 #### Entities
 
-The Entities tab lists all the entities that your rules have detected in the last 14 days, by default. Each entity has an Activity Score associated with it. The activity score is the sum of all the severity scores of all the unique signals associated with that entity. When an entity’s activity score reaches at least 12, an Insight is created. If you have several entities with relatively high activity scores, they might be a good starting point for a threat hunt.
+The Entities tab lists all the entities that your rules have detected in the last 14 days, by default. Each entity has an Activity Score associated with it. The activity score is the sum of all the severity scores of all the unique signals associated with that entity. When an entity’s activity score exceeds 12, an Insight is created. If you have several entities with relatively high activity scores, they might be a good starting point for a threat hunt.
 
 <img src={useBaseUrl('img/cse/intro-cloud-siem-entities.png')} alt="Entities tab" style={{border: '1px solid gray'}} width="800"/>
 
diff --git a/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md b/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold.md
@@ -17,8 +17,8 @@ To change the Insight generation settings:
 <br/>Your current detection settings are displayed on the Insight Detection page.<br/><img src={useBaseUrl('img/cse/detection-threshold-popup.png')} alt="Detection threshold settings" style={{border: '1px solid gray'}} width="600"/>
 1. Enter values for **Detection Threshold** and **Signal Suppression**:
      *  **Standard Threshold**
-         * **Detection Window (Days)**. Enter the duration, in days, during which an Entity's Activity Score must reach the threshold to result in an Insight being generated for the Entity. 
-         * **Threshold**. Enter the threshold Activity Score value that an Entity must reach during the detection window to result in an Insight being generated for the Entity. 
+         * **Detection Window (Days)**. Enter the duration, in days, during which an Entity's Activity Score must exceed the threshold to result in an Insight being generated for the Entity. 
+         * **Threshold**. Enter the threshold Activity Score value that an Entity must exceed during the detection window to result in an Insight being generated for the Entity. 
      * **Global Signal Suppression**
          * **Maximum Period (Hours)**. By default, redundant Signals for a Signal-Entity combination are automatically suppressed for a maximum period of 72 hours to avoid repeated Signals contributing to Insight generation. This setting lets you modify this period based upon your organizational needs. To change this setting, select the number of hours to suppress Signals, anywhere from 24 hours to 72 hours. For additional ways to control signal suppression, see [About Signal Suppression](/docs/cse/records-signals-entities-insights/about-signal-suppression/).
 1. Click **Save**. 
diff --git a/docs/cse/schema/parsing-language-reference-guide.md b/docs/cse/schema/parsing-language-reference-guide.md
@@ -837,6 +837,23 @@ If `<field_name>` isn’t specified, the field dictionary is passed through inst
 
 `r|` syntax can be used here.
 
+:::tip
+`TRANSFORM*` operators only work on fields that contain a value, or a subfield within a JSON structure. 
+
+Suppose you had the following JSON array:
+
+```
+{
+"foo":
+{
+"bar":
+{
+"field":"value"
+```
+
+The `TRANSFORM*` operator must be placed on a subfield that contains a valid string or integer, in this case, `"field"`. Placing it on the top-level field, in this case `"foo"` or `"bar"`, will be ignored by the system.
+:::
+
 ### TRANSFORM_ALL
 
 Applies `<transfer_stanza_nam>` stanza to all fields (that have already been parsed or created by SET) that match the regular expression.
diff --git a/docs/integrations/cloud-security-monitoring-analytics/palo-alto-firewall-10.md b/docs/integrations/cloud-security-monitoring-analytics/palo-alto-firewall-10.md
@@ -94,7 +94,7 @@ To create a server profile specifying  the log destination, do the following:
 
 To configure syslog forwarding for traffic and threat logs, follow the steps to [Configure Log Forwarding](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/configure-log-forwarding) as described in the Palo Networks documentation.
 
-As of March 24, 2022, some Palo Alto Network systems have experienced troubles with validating the Sumo Logic certificate due to their OCSP checking logic. Please contact Palo Alto’s support for  a workaround, and if needed, contact Sumo Logic’s support for the related Palo Alto Case number.
+As of March 24, 2022, some Palo Alto Network systems have experienced troubles with validating the Sumo Logic certificate due to their OCSP checking logic. If you encounter this problem, try disabling OCSP checking logic in the firewall. If you continue to have issues, contact Palo Alto’s support, and if needed, contact Sumo Logic’s support for the related Palo Alto case number.
 
 
 ### Step 4. Verify logs in Palo Alto Networks
diff --git a/docs/manage/ingestion-volume/ingest-budgets/minute-volume.md b/docs/manage/ingestion-volume/ingest-budgets/minute-volume.md
@@ -91,7 +91,7 @@ _index=sumologic_audit_events minuteVolume stopCollecting
 
 1. Identify sources which are not critical data sources where stricter data controls can be added to prevent your organization from being throttled.
 1. Identify `_sourceCategory` or any other identifier for the sources.
-1. Run the following query. The goal of this query is to understand previous data ingestion trends and suggest to you the peak volume seen per minute.
+1. Run the following query. The goal of this query is to understand previous data ingestion trends and suggest to you the peak volume seen per minute. To obtain the most accurate ingest rates, run the query using the [Receipt Time](/docs/search/get-started-with-search/build-search/use-receipt-time/).
    ```sql    
     _sourceCategory=<source category> AND _index=<partition name>
     | timeslice 1m
diff --git a/docs/manage/manage-subscription/usage-management.md b/docs/manage/manage-subscription/usage-management.md
@@ -28,6 +28,12 @@ To manage the query size limit using the **Basic** configuration:
 1. **Enable Query Limit**. Select this checkbox and enter the GB value based on your needs. Sumo Logic recommends setting a GB value per query based on the 95th percentile to stay within safe limits. You can also check the query size of the last 10 queries by clicking on **Click here** to help you determine the appropriate size limit. If you leave this checkbox unchecked, no limits will be added to the query.
 1. Click **Save Limit**.
 
+:::info
+Sumo Logic defines scan as two types:
+  - **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
+  - **Background search**. API, Scheduled Search, Monitor, and SLO. 
+:::
+
 :::note
 It may take up to 5 minutes for a newly created budget to become active and enforceable in the system.
 :::
@@ -52,7 +58,12 @@ To create the query size limit using the **Advanced** configuration:
 1. **Capacity**. Enter the GB value based on your needs. Sumo Logic recommends setting a GB value per query based on the 95th percentile to stay within safe limits. You can also check the query size of the last 10 queries by clicking on **Click here** to help you determine the appropriate size limit.
 1. **Action**. Select the type of action/response you require when the budget limit is reached.
     - **Show Warning to the user**. Query result will be displayed with a the error message.
-    - **Only allow background query scans**. A warning message will be displayed if you run a query that exceeds the budget set, which will block the foreground searches, such as querying in the search UI and dashboards, but will not impact any background searches, such as scheduled search, monitors, SLO, and API.
+    - **Only allow background query scans**. A warning message will be displayed if you run a query that exceeds the budget set. This will block the foreground searches but will not impact any background searches/automated queries.
+    :::info
+    Sumo Logic defines scan as two types:
+    - **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
+    - **Background search**. API, Scheduled Search, Monitors, and SLO. 
+    :::
 1. **Details**. Enter the name for the scan budget.<br/><img src={useBaseUrl('/img/manage/account/create-scan-budget.png')} alt="create-scan-budget" style={{border:'1px solid gray'}} width="650"/>
 1. Click **Save** to create the scan budget.
 
diff --git a/docs/platform-services/automation-service/app-central/integrations/connectwise-manage.md b/docs/platform-services/automation-service/app-central/integrations/connectwise-manage.md
@@ -7,7 +7,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 <img src={useBaseUrl('/img/platform-services/automation-service/app-central/logos/connectwise-manage.png')} alt="connectwise-manage" width="100"/>
 
 ***Version: 1.3  
-Updated: Oct 28, 2024***
+Updated: Oct 29, 2024***
 
 Create, update, search, and gather ticket information from ConnectWise.
 
@@ -30,5 +30,5 @@ Create, update, search, and gather ticket information from ConnectWise.
 	+ renamed Get Tickets action to List Tickets
 	+ added new actions: Add Notes To Ticket, List Ticket Notes
 	+ removed Get Tickets Daemon
-* October 28, 2024 (v1.3) Beta Release
+* October 29, 2024 (v1.3) Beta Release
     + Added the "Priority" field to the Create Ticket and Update Ticket actions.
diff --git a/docs/platform-services/automation-service/app-central/integrations/google-chat.md b/docs/platform-services/automation-service/app-central/integrations/google-chat.md
@@ -8,7 +8,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 <img src={useBaseUrl('/img/platform-services/automation-service/app-central/logos/google.png')} alt="google" width="80"/>
 
 ***Version: 2.0  
-Updated: August 27, 2024***
+Updated: Oct 29, 2024***
 
 Google Chat is an intelligent and secure communication and collaboration tool, built for teams.
 
@@ -30,13 +30,15 @@ Google Chat is an intelligent and secure communication and collaboration tool, b
 3. Go to the **API&Services** > **Credentials** page.
 4. In the same page click on **ENABLES API AND SERVICES** and search for Google Chat and enable it.
 5. Click **CREATE CREDENTIALS** and select **Service Account**.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-1.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
-6. Enter a Service account name to display in the Google Cloud console. The Google Cloud console generates a service account ID based on this name.
+6. Enter a service account name to display in the Google Cloud console. The Google Cloud console generates a service account ID based on this name.
 7. (Optional) Enter a description of the service account.
 8. Skip two optional grant permissions steps and click **Done** to complete the service account creation.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-2.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
 9. Click on the generated service account to open the details.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-3.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
-10. Under the **KEYS** tab, Click **ADD KEY** and choose **Create new key**.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-4.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
+10. Under the **KEYS** tab, click **ADD KEY** and choose **Create new key**.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-4.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
 11. Click on **CREATE** (make sure **JSON** is selected).<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-5.png')} style={{border:'1px solid gray'}} alt="google-drive" width="400"/>
 12. The JSON file is downloaded. Make sure you save it in a safe place.
+13. To configure the app in Google Chat API, go to **APIs & Services**, select **Google Chat API**, and in **CONFIGURATION** provide the details and click on **SAVE**. <br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-10.png')} style={{border:'1px solid gray'}} alt="google-drive" width="800"/>
+14. Go to the **Google Chat App** and add the above app in that. Also, to add above app in space, go to **space** and in **Apps & integration** add the app.
 
 ## Google Chat in Automation Service and Cloud SOAR
 
@@ -46,4 +48,5 @@ Google Chat is an intelligent and secure communication and collaboration tool, b
 
 ## Change Log
 
-* August 27, 2024 (v2.0) - First upload
+* August 27, 2024 (v2.0) - First upload
+* October 29, 2024 (v2.0) - Updated the docs 
diff --git a/docs/platform-services/automation-service/app-central/integrations/microsoft-sentinel.md b/docs/platform-services/automation-service/app-central/integrations/microsoft-sentinel.md
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-bigquery-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-bigquery-source.md
diff --git a/docs/send-data/kubernetes/collecting-logs.md b/docs/send-data/kubernetes/collecting-logs.md
diff --git a/static/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-10.png b/static/img/platform-services/automation-service/app-central/integrations/google-drive/google-drive-10.png
