Skip to content

Commit 5d30828

Browse files
committed
added release note and updated the doc format
1 parent 2089375 commit 5d30828

File tree

2 files changed

+53
-25
lines changed

2 files changed

+53
-25
lines changed

blog-service/2025-06-23-manage.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: Manage Libraries for MSSPs - Beta (Manage)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- manage
6+
- organizations
7+
- mssps
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
We are excited to announce the ability to manage library content on the new **Content Management** tab. Now MSSP administrators can conveniently push content in the **Library** folder to multiple child organizations at once, including dashboards, saved searches, and scheduled searches. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps/).
14+
15+
:::note
16+
This feature is in Beta. To participate, contact your Sumo Logic account executive or our Support Team.
17+
:::
18+
19+
<img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items.png')} alt="Update Selected Items button" style={{border: '1px solid gray'}} width="800"/>

docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md

Lines changed: 34 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
1515

1616
This article describes how to manage organizations for Managed Security Service Providers (MSSPs). MSSP administrators must ensure that the content of their child organizations is properly configured. MSSPs often consist of a parent organization with child organizations that use [Cloud SIEM](/docs/cse/).
1717

18-
## Prerequisites
18+
## Considerations
1919

2020
### Roles
2121

@@ -26,16 +26,25 @@ You must have the following [organization role capabilities](/docs/manage/users-
2626
* Create Organizations
2727
* Manage Organizations
2828

29-
## Update content in child organizations
29+
### Multi-insights list page in Cloud SIEM
3030

31-
To ensure that content is consistent across child organizations, use the **Manage Content** tab.
31+
If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations).
32+
33+
<!-- After this article is no longer beta, show the following text:
34+
This multi-insights list page (also known as a "federated" page) shows insights just as in a normal insights list page. When you click an insight on the page, you are automatically signed in to the child organization (if SSO is enabled for the child organization), and the insight's details open in the child organization's UI. You can also use the board view on the multi-insights page to move insights to different statuses.
35+
36+
To be able to see insights in child organizations, add child organizations that use Cloud SIEM. Then when the parent organization user goes to their Cloud SIEM insights list page, all the child organizations' insights appear in the list.
37+
-->
38+
39+
## Manage content in organizations
40+
41+
To ensure that content is consistent across child organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
3242

3343
You can update the following:
3444
* Cloud SIEM [rules](/docs/cse/rules/)
3545
* Cloud SIEM [rule tuning expressions](/docs/cse/rules/rule-tuning-expressions/)
3646
* [Library](/docs/get-started/library)
3747

38-
To update content:
3948
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
4049
1. Select the **Manage Content** tab.
4150
1. In the **Source Org** field, select the organization that will provide the source data to be updated in other organizations.
@@ -45,25 +54,28 @@ To update content:
4554
* **Library**. For more information about Library items, refer to the [Managing Your Sumo Logic Library](/docs/get-started/library).
4655
1. Select individual items to be updated, or all items.
4756
1. Click **Update Selected Items**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items.png')} alt="Update Selected Items button" style={{border: '1px solid gray'}} width="800"/>
48-
1. On the **Update Selected Items** box, click **Destinations** to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/><br/>Tips:
49-
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
50-
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
51-
* When you update rule tuning expressions, select **Include Associated Cloud SIEM Rules** to also update all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
52-
* **Scheduled searches**. Select **Include and Update Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
53-
* **Scheduled Reports**. Select **Include and Update Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
54-
:::note
55-
Both **Scheduled searches** and **Scheduled Reports** will be available to update when you select a library *folder*.
56-
:::
57+
1. On the **Update Selected Items** box, navigate to the **Destinations** section to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
5758
1. Click **Update**. An **Updating in progress** dialog is displayed.
5859

59-
## Limitations
60+
### Tips
61+
62+
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
63+
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
64+
* When you update rule tuning expressions, select **Include Associated Cloud SIEM Rules** to also update all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
65+
* **Scheduled Searches Connection**. Select **Include and Update Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
66+
* **Scheduled Reports**. Select **Include and Update Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
67+
:::note
68+
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available to update when you select a library *folder*.
69+
:::
70+
71+
### Limitations
6072

6173
- If an item with the same name exists in the target organization, it will be replaced.
6274
- Once an update is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
6375
- If errors occur during update, administrators must manually re-attempt failed updates. To see failed updates, use [View History](#view-history).
6476
- Update operations may take longer based on the volume of content being updated.
6577
- Rule tuning expressions must be updated separately from rules.
66-
- Cloud SIEM Legacy Rule Type is not supported for sync or update.
78+
- *Cloud SIEM Legacy Rule Type* is not supported for sync or update.
6779

6880
## View history
6981

@@ -98,22 +110,19 @@ _index=sumologic_audit_events
98110

99111
## FAQs
100112

101-
* **Are rule tuning expressions included?**<br/>No, they are not included, but can be updated separately.
102113
* **What happens when a item with the same name already exists?**<br/>It will be replaced in the child organization.
103114
* **What happens if an item selected for update doesn't already exist in the target organization?**<br/>The item will be created in the target organization.
104115
* **What if errors occur during updating?**<br/>Affected items will be skipped. Once the rest of the content is updated, you can review errors in [View History](#view-history) and retry.
105116
* **Can I roll back changes after an update operation?**<br/>No, rollback is not supported. After an update operation is initiated, changes cannot be reversed.
106117
* **How can I monitor update progress?**<br/>During an update, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
107118
* **How can I view update history?**<br/>Click View History in the upper-right corner of the page. A query for update history will display, showing the email of the individual who performed the update and the updated items.
108-
* **What happens if the source tuning expression contains Cloud SIEM rules?**<br/>If the **Include Linked Cloud SIEM Rules** option is selected, existing rules with the same name in the destination organization will be linked to match the source tuning expression.
109-
* **What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.
110-
111-
## Multi-insights list page in Cloud SIEM
119+
* **Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.
112120

113-
If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations).
121+
#### Rules updates
114122

115-
<!-- After this article is no longer beta, show the following text:
116-
This multi-insights list page (also known as a "federated" page) shows insights just as in a normal insights list page. When you click an insight on the page, you are automatically signed in to the child organization (if SSO is enabled for the child organization), and the insight's details open in the child organization's UI. You can also use the board view on the multi-insights page to move insights to different statuses.
123+
**Are rule tuning expressions included?**<br/>No, they are not included, but can be updated separately.
117124

118-
To be able to see insights in child organizations, add child organizations that use Cloud SIEM. Then when the parent organization user goes to their Cloud SIEM insights list page, all the child organizations' insights appear in the list.
119-
-->
125+
#### Rule tuning expressions updates
126+
127+
* **What happens if the source tuning expression contains Cloud SIEM rules?**<br/>If the **Include Linked Cloud SIEM Rules** option is selected, existing rules with the same name in the destination organization will be linked to match the source tuning expression.
128+
* **What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.

0 commit comments

Comments
 (0)