Skip to content

Commit 3005a95

Browse files
jpipkin1jpipkin1
authored
Merge branch 'main' into docs-1215-dynamic-severity
2 parents 9294c8e + 1de9bf4 commit 3005a95

File tree

8 files changed

+169
-8
lines changed

8 files changed

+169
-8
lines changed

‎blog-cse/2025-10-28-content.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
title: October 28, 2025 - Content Release
3+
image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082
4+
keywords:
5+
- log mappers
6+
- parsers
7+
hide_table_of_contents: true
8+
---
9+
10+
This content release includes:
11+
- New mappers for Crowdstrike Falcon events.
12+
- Updates to existing mappers for Crowdstrike Falcon, F5, and Okta events to support additional fields and events.
13+
- Updates to F5 Networks and Okta SSO parsers.
14+
15+
Changes are enumerated below.
16+
17+
### Log Mappers
18+
- [New] CrowdStrike Falcon Host API IdpDetectionSummaryEvent
19+
- [New] CrowdStrike Falcon Identity Protection
20+
- [Updated] CrowdStrike UserActivity Logs
21+
- [Updated] F5 Authentication Catch All
22+
- [Updated] F5 HTTPd Audit - Custom Parser
23+
- [Updated] F5 Session and adfs proxy - Custom Parser
24+
- [Updated] Okta Authentication - auth_via_AD_agent
25+
- [Updated] Okta Authentication - auth_via_mfa
26+
- [Updated] Okta Authentication - auth_via_radius
27+
- [Updated] Okta Authentication - sso
28+
- [Updated] Okta Authentication Events
29+
- [Updated] Okta Catch All
30+
- [Updated] Okta Security Threat Events
31+
32+
### Parsers
33+
- [Updated] /Parsers/System/F5/F5 Syslog
34+
- [Updated] /Parsers/System/Okta/Okta

‎docs/api/index.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,11 @@ Use the Sumo Logic Application Programming Interfaces (APIs) to interact with ou
164164
<a href={useBaseUrl('docs/api/organizations-management')}><img src={useBaseUrl('img/icons/manage.png')} alt="Thumbnail icon" width="50"/><h4>Organizations</h4></a>
165165
</div>
166166
</div>
167+
<div className="box smallbox card">
168+
<div className="container">
169+
<a href={useBaseUrl('docs/api/parsers-library-management')}><img src={useBaseUrl('img/icons/operations/parsing-data.png')} alt="Thumbnail icon" width="50"/><h4>Parsers Library</h4></a>
170+
</div>
171+
</div>
167172
<div className="box smallbox card">
168173
<div className="container">
169174
<a href={useBaseUrl('docs/api/partition-management')}><img src={useBaseUrl('img/icons/operations/data-overage.png')} alt="Thumbnail icon" width="50"/><h4>Partitions</h4></a>
@@ -204,6 +209,11 @@ Use the Sumo Logic Application Programming Interfaces (APIs) to interact with ou
204209
<a href={useBaseUrl('docs/api/scheduled-views')}><img src={useBaseUrl('img/icons/general/calendar.png')} alt="Thumbnail icon" width="50"/><h4>Scheduled Views</h4></a>
205210
</div>
206211
</div>
212+
<div className="box smallbox card">
213+
<div className="container">
214+
<a href={useBaseUrl('docs/api/schema-base-management')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Thumbnail icon" width="50"/><h4>Schema Base</h4></a>
215+
</div>
216+
</div>
207217
<div className="box smallbox card">
208218
<div className="container">
209219
<a href={useBaseUrl('docs/api/scim-user')}><img src={useBaseUrl('img/icons/general/session.png')} alt="Thumbnail icon" width="50"/><h4>SCIM User</h4></a>
@@ -234,6 +244,11 @@ Use the Sumo Logic Application Programming Interfaces (APIs) to interact with ou
234244
<a href={useBaseUrl('docs/api/slo-management')}><img src={useBaseUrl('img/icons/observe.png')} alt="Thumbnail icon" width="50"/><h4>SLOs</h4></a>
235245
</div>
236246
</div>
247+
<div className="box smallbox card">
248+
<div className="container">
249+
<a href={useBaseUrl('docs/api/source-template-management')}><img src={useBaseUrl('img/icons/operations/topology-explorer.png')} alt="Thumbnail icon" width="50"/><h4>Source Template</h4></a>
250+
</div>
251+
</div>
237252
<div className="box smallbox card">
238253
<div className="container">
239254
<a href={useBaseUrl('docs/api/span-analytics')}><img src={useBaseUrl('img/icons/operations/distributed-operations.png')} alt="Thumbnail icon" width="50"/><h4>Span Analytics</h4></a>

‎docs/api/parsers-library-management.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
id: parsers-library-management
3+
title: Parsers Library Management APIs
4+
sidebar_label: Parsers Library
5+
description: Customize parsers using the API.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
import ApiIntro from '../reuse/api-intro.md';
10+
import ApiRoles from '../reuse/api-roles.md';
11+
12+
<img src={useBaseUrl('img/icons/operations/parsing-data.png')} alt="Thumbnail icon" width="50"/>
13+
14+
Use this API to customize parsers. The parsers library contains the parsers used in the `_parser` field for collector, FER, or query. For more information on customizing parsers, see [Parser Editor](/docs/cse/schema/parser-editor/).
15+
16+
## Documentation
17+
18+
<ApiIntro/>
19+
20+
| Deployment | Documentation URL |
21+
|:------------|:-------------------------------------------------------------|
22+
| AU | https://api.au.sumologic.com/docs/#tag/parsersLibraryManagement |
23+
| CA | https://api.ca.sumologic.com/docs/#tag/parsersLibraryManagement |
24+
| DE | https://api.de.sumologic.com/docs/#tag/parsersLibraryManagement |
25+
| EU | https://api.eu.sumologic.com/docs/#tag/parsersLibraryManagement |
26+
| FED | https://api.fed.sumologic.com/docs/#tag/parsersLibraryManagement |
27+
| JP | https://api.jp.sumologic.com/docs/#tag/parsersLibraryManagement |
28+
| KR | https://api.kr.sumologic.com/docs/#tag/parsersLibraryManagement |
29+
| US1 | https://api.sumologic.com/docs/#tag/parsersLibraryManagement |
30+
| US2 | https://api.us2.sumologic.com/docs/#tag/parsersLibraryManagement |
31+
32+
## Required role capabilities
33+
34+
<ApiRoles/>
35+
36+
* [Data Management](/docs/manage/users-roles/roles/role-capabilities/#data-management)
37+
* View Parsers

‎docs/api/schema-base-management.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
id: schema-base-management
3+
title: Schema Base Management APIs
4+
sidebar_label: Schema Base
5+
description: Customize schema base management APIs.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
import ApiIntro from '../reuse/api-intro.md';
10+
import ApiRoles from '../reuse/api-roles.md';
11+
12+
<img src={useBaseUrl('img/icons/operations/schema.png')} alt="Thumbnail icon" width="50"/>
13+
14+
Use this API to customize schema used by [OpenTelemetry Remote Management Source Templates](/docs/send-data/opentelemetry-collector/remote-management/source-templates/).
15+
16+
## Documentation
17+
18+
<ApiIntro/>
19+
20+
| Deployment | Documentation URL |
21+
|:------------|:-------------------------------------------------------------|
22+
| AU | https://api.au.sumologic.com/docs/#tag/schemaBaseManagement |
23+
| CA | https://api.ca.sumologic.com/docs/#tag/schemaBaseManagement |
24+
| DE | https://api.de.sumologic.com/docs/#tag/schemaBaseManagement |
25+
| EU | https://api.eu.sumologic.com/docs/#tag/schemaBaseManagement |
26+
| FED | https://api.fed.sumologic.com/docs/#tag/schemaBaseManagement |
27+
| JP | https://api.jp.sumologic.com/docs/#tag/schemaBaseManagement |
28+
| KR | https://api.kr.sumologic.com/docs/#tag/schemaBaseManagement |
29+
| US1 | https://api.sumologic.com/docs/#tag/schemaBaseManagement |
30+
| US2 | https://api.us2.sumologic.com/docs/#tag/schemaBaseManagement |
31+
32+
## Required role capabilities
33+
34+
<ApiRoles/>
35+
36+
* [Data Management](/docs/manage/users-roles/roles/role-capabilities/#data-management)
37+
* Manage Collectors
38+
* View Collectors

‎docs/api/source-template-management.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
id: source-template-management
3+
title: Source Template Management APIs
4+
sidebar_label: Source Template
5+
description: Manage OpenTelemetry Source Templates with APIs.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
import ApiIntro from '../reuse/api-intro.md';
10+
import ApiRoles from '../reuse/api-roles.md';
11+
12+
<img src={useBaseUrl('img/icons/operations/topology-explorer.png')} alt="Thumbnail icon" width="50"/>
13+
14+
Use this API to manage [OpenTelemetry Remote Management Source Templates](/docs/send-data/opentelemetry-collector/remote-management/source-templates/).
15+
16+
## Documentation
17+
18+
<ApiIntro/>
19+
20+
| Deployment | Documentation URL |
21+
|:------------|:-------------------------------------------------------------|
22+
| AU | https://api.au.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
23+
| CA | https://api.ca.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
24+
| DE | https://api.de.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
25+
| EU | https://api.eu.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
26+
| FED | https://api.fed.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
27+
| JP | https://api.jp.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
28+
| KR | https://api.kr.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
29+
| US1 | https://api.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
30+
| US2 | https://api.us2.sumologic.com/docs/#tag/sourceTemplateManagementExternal |
31+
32+
## Required role capabilities
33+
34+
<ApiRoles/>
35+
36+
* [Data Management](/docs/manage/users-roles/roles/role-capabilities/#data-management)
37+
* Manage Collectors
38+
* View Collectors

‎docs/cse/administration/create-cse-context-actions.md‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,8 @@ When you save the action, the URL template will be populated with your Sumo Logi
8787

8888
`{{sumobaseurl}}/ui/#/search/@{{timestamp[ms]-30m}}@_index=sec_record* AND user_username = {{value}}`
8989

90+
The `{{sumobaseurl}}` parameter applies to context actions that run a Sumo Logic log search. Assuming your Cloud SIEM instance is configured to communicate with the Sumo Logic platform, when you create an action that runs a Sumo Logic search, Cloud SIEM will automatically insert this placeholder in your URL template—you don’t need to explicitly insert `{{sumobaseurl}}` placeholder yourself.
91+
9092
### Create an URL to an external service
9193

9294
To create a URL to be sent to an external service, enter the URL in the format required by the external service, and use the `{{value}}` parameter placeholder for the target entity, record field, or IOC. 
@@ -121,12 +123,6 @@ The table below defines the parameters you can use in the URL template for a con
121123

122124
You can insert any field from the target of a context action into the action URL with the `{{field_name}}` placeholder. For example, you could include `device_ip` in the URL with `{{device_ip}}`.  
123125

124-
### Sumo Logic Base URL
125-
126-
The `{{sumobaseurl}}` parameter applies to context actions that run a Sumo Logic log search.
127-
128-
Assuming your Cloud SIEM instance is configured to communicate with the Sumo Logic platform, when you create an action that runs a Sumo Logic search, Cloud SIEM will automatically insert this placeholder in your URL template—you don’t need to explicitly insert `{{sumobaseurl}} `placeholder yourself.
129-
130126
### Timestamp
131127

132128
When you run an action on a Cloud SIEM record, if that record has a [timestamp](/docs/cse/schema/schema-attributes) field value, you can insert the timestamp in UTC format into the URL using the `{{timestamp}}` parameter.

‎docs/integrations/containers-orchestration/vmware.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ See the [vSphere product page](https://www.vmware.com/products/vsphere.html) for
2626

2727
The Sumo Logic vCenter logs source and vCenter metrics source use the installed collector to gather the following data from VMware:
2828

29-
* VMware Events using the Events API. See [Events API](https://code.vmware.com/apis/196/vsphere/doc/vim.event.EventManager.html) for more details.
30-
* VMware Metrics using the Performance API. For more information, see [Performance API](https://code.vmware.com/apis/196/vsphere/doc/vim.PerformanceManager.html).
29+
* VMware Events using the Events API. See [Events API](https://developer.broadcom.com/xapis/vsphere-web-services-api/latest/vim.event.EventManager.html) for more details.
30+
* VMware Metrics using the Performance API. For more information, see [Performance API](https://developer.broadcom.com/xapis/vsphere-web-services-api/latest/vim.PerformanceManager.html).
3131

3232
The dashboards provide real-time monitoring with visual data displays, allowing you to analyze events and performance metrics for efficient detection and troubleshooting.
3333

‎sidebars.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3163,6 +3163,7 @@ integrations: [
31633163
'api/monitors-management',
31643164
'api/muting-schedules',
31653165
'api/organizations-management',
3166+
'api/parsers-library-management',
31663167
'api/partition-management',
31673168
'api/password-policy',
31683169
'api/policies-management',
@@ -3171,12 +3172,14 @@ integrations: [
31713172
'api/saml-configuration',
31723173
'api/scan-budget',
31733174
'api/scheduled-views',
3175+
'api/schema-base-management',
31743176
'api/scim-user',
31753177
'api/search-job',
31763178
'api/service-accounts',
31773179
'api/service-allowlist',
31783180
'api/service-map',
31793181
'api/slo-management',
3182+
'api/source-template-management',
31803183
'api/span-analytics',
31813184
'api/threat-intel-ingest',
31823185
'api/token-management',

0 commit comments

Comments
 (0)