Add Google sources

Author: jpipkin1

docs/cse/ingestion/ingestion-sources-for-cloud-siem/fortigate-firewall.md

@@ -1,74 +1,24 @@
 ---
 id: fortigate-firewall
-title: Fortigate Firewall - Cloud SIEM
+title: Ingest Fortigate Firewall Data into Cloud SIEM
 sidebar_label: Fortigate Firewall
 description: Configure a syslog source to ingest Fortigate Firewall log messages to be parsed by Cloud SIEM’s system parser for Fortigate Firewall.
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This section has instructions for collecting FortiGate log messages and sending them to Sumo Logic to be ingested by Cloud SIEM.
-
-## Step 1: Configure collection
-
-In this step, you configure a Syslog Source to collect FortiGate log messages. You can configure the source on an existing Installed Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure a Syslog Source](#configure-a-syslog-source) below. Otherwise, create a new collector as described in [Configure an Installed Collector](#configure-an-installed-collector) below, and then create the Syslog Source on the collector.
-
-### Configure an Installed Collector
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. 
-1. Click **Add Collector**.
-1. Click **Installed Collector**.
-1. The **Add Installed Collector** popup appears.
-1. Download the appropriate collector for your operating system.
-1. Install the collector. Instructions for your preferred operating system and method of installation are available on the Installed Collectors page.
-1. Once the collector is installed, confirm it is available on the **Collection** page and select **Edit**.
-1. The **Edit Collector popup** appears.<br/><img src={useBaseUrl('img/cse/edit-collector.png')} alt="Edit collector" style={{border: '1px solid gray'}} width="500"/> 
-1. **Name**. Provide a Name for the Collector.
-1. **Description**. (Optional)
-1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. 
-1. **Fields**. 
-    * If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM.
-    * If you are planning that all sources you add to this collector will use the same log parser (if they are the same type of log), click the **+Add Field** link, and add a field whose name is `_parser` with the value */Parsers/System/Fortinet/Fortigate/Fortigate-Syslog*. This will cause all sources on the collector to use the specified parser.
+To ingest Fortigate Firewall data into Cloud SIEM:
+1. [Configure a Syslog source](/docs/send-data/installed-collectors/sources/syslog-source/#configure-a-syslog-source) on a collector. When you configure the source, do the following:
+    1. Click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will ensure all logs for this source are forwarded to Cloud SIEM.
+    1. Add another field named `_parser` with value */Parsers/System/Fortinet/Fortigate/Fortigate-Syslog*. This ensures that the Fortigate Firewall logs are parsed and normalized into structured records in Cloud SIEM.
+Configure FortiGate
+1. Configure forwarding to the the Syslog Source:
+    * If your FortiGate logs are aggregated by FortiAnalyzer, you can forward them to Sumo Logic  as described in [Configuring log forwarding](https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMG-FAZ/2400_System_Settings/1600_Log%20Forwarding/0400_Configuring.htm?Highlight=syslog) in FortiAnalyzer help.
+    * If your FortiGate logs are not aggregated by FortiAnalyzer, you can forward them to Sumo Logic directly from FortiGate as described in [FortiOS documentation for syslog forwarding](https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/610676/configuring-multiple-fortianalyzers-or-syslog-servers-per-vdom).
     :::note
-    It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section.
+    Cloud SIEM supports standard syslog, CEF, or JSON log formats from FortiGate. Different parsers are required for CEF and JSON format logs.
     :::
-1. Click **Save**.
-
-### Configure a Syslog Source
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. 
-1. Navigate to the Installed Collector where you want to create the source.
-1. On the **Collectors** page, click **Add Source** next to an Installed Collector.
-1. Select **Syslog**. 
-1. The page refreshes.<br/><img src={useBaseUrl('img/cse/syslog-source.png')} alt="Syslog source" style={{border: '1px solid gray'}} width="500"/>
-1. **Name**. Enter a name for the source. 
-1. **Description**. (Optional) 
-1. **Protocol**. Select the protocol that your syslog-enabled devices are currently using to send syslog data, UDP or TCP. For more information, see [Choosing TCP or UDP](/docs/send-data/installed-collectors/sources/syslog-source#choosing-tcp-or-udp) on the *Syslog Source* page.
-1. **Port**. Enter the port number for the Source to listen to. If the collector runs as root (default), use 514. Otherwise, consider 1514 or 5140. Make sure the devices are sending to the same port.
-1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. Make a note of the source category. You’ll supply it in [Step 2](#step-2-configure-fortigate) below.
-1. **Fields**. 
-    * If you *have not* configured the Installed Collector to forward all sources in the collector to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*.
-    * If you *have not* configured the Installed Collector to parse all sources in the collector with the same parser, click the **+Add Field** link, and add a field whose name is `_parser` with the value */Parsers/System/Fortinet/Fortigate/Fortigate-Syslog*. 
-1. Click **Save**.
-
-## Step 2: Configure FortiGate
-
-In this step, you configure forwarding to the the Syslog Source. 
-
-If your FortiGate logs are aggregated by  FortiAnalyzer, you can forward them to Sumo Logic  as described in [Configuring log forwarding](https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMG-FAZ/2400_System_Settings/1600_Log%20Forwarding/0400_Configuring.htm?Highlight=syslog) in FortiAnalyzer help.
-
-If your FortiGate logs are not aggregated by FortiAnalyzer, you can forward them to Sumo Logic directly from FortiGate as described in [FortiOS documentation for syslog forwarding](https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/610676/configuring-multiple-fortianalyzers-or-syslog-servers-per-vdom).
-
-Cloud SIEM supports standard syslog, CEF, or JSON log formats from FortiGate.
-
-:::note
-Different parsers are required for CEF and JSON format logs.
-:::
-
-## Step 3: Verify Ingestion
-
-In this step, you verify that your logs are successfully making it into Cloud SIEM. 
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
-1. On the **Log Mappings** tab search for "FortiGate" and check the **Records** columns. A list of mappers for FortiGate will appear and you can see if logs are coming in.
-1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for FortiGate security records.  <br/><img src={useBaseUrl('img/cse/fortigate-search.png')} alt="Fortigate search" style={{border: '1px solid gray'}} width="400"/>
+1. To verify that your logs are successfully making it into Cloud SIEM:
+    1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
+    1. On the **Log Mappings** tab search for "FortiGate" and check the **Records** columns. A list of mappers for FortiGate will appear and you can see if logs are coming in.
+    1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for FortiGate security records.  <br/><img src={useBaseUrl('img/cse/fortigate-search.png')} alt="Fortigate search" style={{border: '1px solid gray'}} width="400"/>

docs/cse/ingestion/ingestion-sources-for-cloud-siem/g-suite-alert-center.md

@@ -1,54 +1,17 @@
 ---
 id: g-suite-alert-center
-title: G Suite Alert Center - Cloud SIEM
+title: Ingest G Suite Alert Center Data into Cloud SIEM
 sidebar_label: G Suite Alert Center
 description: Collect log messages from G Suite Alert Center to be parsed by Cloud SIEM's system parser for G Suite Alert Center.
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-## Step 1: Configure collection
-
-In this step, you configure an HTTP Source to collect G Suite Alert Center log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure an HTTP Source below.](#configure-an-http-source) Otherwise, create a new collector as described in [Configure a Hosted Collector](#configure-a-hosted-collector) below, and then create the HTTP Source on the collector.
-
-### Configure a Hosted Collector
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. 
-1. Click **Add Collector**.
-1. Click **Hosted Collector.**
-1. The **Add Hosted Collector** popup appears. <br/><img src={useBaseUrl('img/cse/add-hosted-collector.png')} alt="Hosted collector" style={{border: '1px solid gray'}} width="600"/> 
-1. **Name**. Provide a Name for the Collector.
-1. **Description**. (Optional)
-1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. 
-1. **Fields**. 
-    1. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM.
-    1. If all sources in this collector will be G Suite Alert Center, add an additional field with key `_parser` and value */Parsers/System/Google/G Suite Alert Center*.
-    :::note
-    It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section.
-    :::
-
-### Configure an HTTP Source
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.  
-1. Navigate to the Hosted Collector where you want to create the source.
-1. On the **Collectors** page, click **Add Source** next to a Hosted Collector.
-1. Select **HTTP Logs & Metrics**. 
-1. The page refreshes.<br/><img src={useBaseUrl('img/cse/http-source.png')} alt="HTTP source" style={{border: '1px solid gray'}} width="600"/> 
-1. **Name**. Enter a name for the source. 
-1. **Description**. (Optional) 
-1. **Source Host.** (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called `_sourceHost.`
-1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`.
-1. **Fields.** If you are not parsing all sources in the hosted collector with the same parser, click the **+Add Field** link, and add a field whose name is `_parser` with value */Parsers/System/Google/G Suite Alert Center*.
-1. **Advanced Options for Logs**. Under **Timestamp Format**, select **Specify a format.**
-    1. **Format**. Enter `yyyy-MM-dd'T'HH:mm:ss.SSS'Z'`
-    1. **Timestamp locator**. Enter `\"createTime\":(.*),`
-    1. Click **Add.**
-1. Click **Save**.
-
-## Step 2: Verify ingestion
-
-In this step, you verify that your logs are successfully making it into Cloud SIEM. 
-
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
-1. On the **Log Mappings** tab search for "G Suite Alert Center" and check the **Records** columns. 
-1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for G Suite Alert Center security records. <br/><img src={useBaseUrl('img/cse/gsuite-search.png')} alt="GSuite search" style={{border: '1px solid gray'}} width="400"/> 
+To ingest G Suite Alert Center data into Cloud SIEM:
+1. [Configure an HTTP Logs and Metrics source](/docs/send-data/hosted-collectors/http-source/logs-metrics/#configure-an-httplogs-and-metrics-source) on a collector. When you configure the source, do the following:
+   1. Select the [**Forward to SIEM** option](/docs/c2c/info/#metadata-fields) in the source configuration UI. This will ensure all logs for this source are forwarded to Cloud SIEM.
+   1. Click the **+Add** link to add a field whose name is `_parser` with value */Parsers/System/Google/G Suite Alert Center*. This ensures that the G Suite Alert Center logs are parsed and normalized into structured records in Cloud SIEM.
+1. To verify that your logs are successfully making it into Cloud SIEM:
+   1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
+   1. On the **Log Mappings** tab search for "G Suite Alert Center" and check the **Records** columns. 
+   1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for G Suite Alert Center security records. <br/><img src={useBaseUrl('img/cse/gsuite-search.png')} alt="GSuite search" style={{border: '1px solid gray'}} width="400"/>