You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules.md
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,27 +31,27 @@ To be able to see insights in child organizations, add child organizations that
31
31
32
32
## Manage Cloud SIEM rules
33
33
34
-
To ensure that content is consistent across child organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
34
+
To ensure that content is consistent across child organizations, use the **Manage Content** tab to push content in target organizations with content from a source organization.
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
41
41
1. Select the **Manage Content** tab.
42
-
1. In the **Source Org** field, select the organization that will provide the source data to be updated in other organizations.
43
-
1. In the **Content** bar, select the content to be updated:
42
+
1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
43
+
1. In the **Content** bar, select the content to be pushed:
44
44
***Cloud SIEM Rules**. For more information about Cloud SIEM rules, refer to the [Cloud SIEM Rules](/docs/cse/rules/).
45
45
***Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, refer to the [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).
46
-
1. Select individual items to be updated, or all items.
1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
46
+
1. Select individual items to be pushed, or all items.
1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
49
49
1. Click **Push**. A **Pushing in progress** dialog is displayed.
50
50
51
51
### Tips
52
52
53
-
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
54
-
* When you update rule tuning expressions, select **Include Associated Cloud SIEM Rules** to also update all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
53
+
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
54
+
* When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
55
55
56
56
### Limitations
57
57
@@ -64,13 +64,13 @@ You can update the following:
64
64
65
65
## View history
66
66
67
-
1. Click **View History** in the upper-right corner of the page. A query for update history displays:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query.png')} alt="View history query" style={{border: '1px solid gray'}} width="800"/>
68
-
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The update history displays. The email of the individual who performed the update appears in the **user_email** column, and the updated items appear in the **content** column. <br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query-results.png')} alt="View history query results" style={{border: '1px solid gray'}} width="800"/>
69
-
1. Investigate any updates that failed and re-run the update if needed.
67
+
1. Click **View History** in the upper-right corner of the page. A query for push history displays:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query.png')} alt="View history query" style={{border: '1px solid gray'}} width="800"/>
68
+
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The push history displays. The email of the individual who performed the push appears in the **user_email** column, and the pushed items appear in the **content** column. <br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query-results.png')} alt="View history query results" style={{border: '1px solid gray'}} width="800"/>
69
+
1. Investigate any push that failed and re-run the push if needed.
70
70
71
-
## View updates in the audit log
71
+
## View push in the audit log
72
72
73
-
You can view all content management updates in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
73
+
You can view all content management push in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
***What if errors occur during pushing?**<br/>Affected items will be skipped. Once the rest of the content is pushed, you can review errors in [View History](#view-history) and retry.
101
101
***Can I roll back changes after a push operation?**<br/>No, rollback is not supported. After a push operation is initiated, changes cannot be reversed.
102
102
***How can I monitor push progress?**<br/>During a push, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
103
-
***How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the updated items.
103
+
***How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the pushed items.
104
104
***Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.
105
105
106
-
#### Rules updates
106
+
#### Pushing Cloud SIEM Rules
107
107
108
-
**Are rule tuning expressions included?**<br/>No, they are not included, but can be updated separately.
108
+
**Are rule tuning expressions included?**<br/>No, they are not included, but can be pushed separately.
109
109
110
-
#### Rule tuning expressions updates
110
+
#### Pushing Cloud SIEM Rule tuning expressions
111
111
112
112
***What happens if the source tuning expression contains Cloud SIEM rules?**<br/>If the **Include Linked Cloud SIEM Rules** option is selected, existing rules with the same name in the destination organization will be linked to match the source tuning expression.
113
-
***What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.
113
+
***What if no matching Cloud SIEM rules are found in the destination organization?**<br/>Push will complete with a warning, and missing rules will be logged in the audit log. You can push those rules separately and re-run the tuning expression push.
Copy file name to clipboardExpand all lines: docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md
+15-15Lines changed: 15 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,35 +30,35 @@ You must have the following [organization role capabilities](/docs/manage/users-
30
30
31
31
## Manage content in organizations
32
32
33
-
To ensure that [Library](/docs/get-started/library) content is consistent across child organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
33
+
To ensure that [Library](/docs/get-started/library) content is consistent across child organizations, use the **Manage Content** tab to push content in target organizations with content from a source organization.
34
34
35
35
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
36
36
1. Select the **Manage Content** tab.
37
-
1. In the **Source Org** field, select the organization that will provide the source data to be updated in other organizations.
37
+
1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
38
38
1. In the **Content** bar, select **Library**. For more information about Library items, refer to the [Managing Your Sumo Logic Library](/docs/get-started/library).
39
-
1. Select individual items to be updated, or all items.
1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
39
+
1. Select individual items to be pushed, or all items.
1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
42
42
1. Click **Push**. A **Pushing in progress** dialog is displayed.
43
43
44
44
### Tips
45
45
46
-
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
46
+
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
47
47
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
48
-
***Scheduled Searches Connection**. Select **Include and Update Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
49
-
***Scheduled Reports**. Select **Include and Update Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
48
+
***Scheduled Searches Connection**. Select **Include Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
49
+
***Scheduled Reports**. Select **Include Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
50
50
:::note
51
-
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available to update when you select a library *folder*.
51
+
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available only when you select a library *folder*.
52
52
:::
53
53
54
54
### Limitations
55
55
56
56
- If an item with the same name exists in the target organization, it will be replaced.
57
-
- Once an update is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
58
-
- If errors occur during update, administrators must manually re-attempt failed updates. To see failed updates, use [View History](#view-history).
59
-
-Update operations may take longer based on the volume of content being updated.
60
-
- Rule tuning expressions must be updated separately from rules.
61
-
-*Cloud SIEM Legacy Rule Type* is not supported for sync or update.
57
+
- Once a push is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
58
+
- If errors occur during the push, administrators must manually re-attempt failed push. To see failed push, use [View History](#view-history).
59
+
-Push operations may take longer based on the volume of content being pushed.
60
+
- Rule tuning expressions must be pushed separately from rules.
61
+
-*Cloud SIEM Legacy Rule Type* is not supported for sync or push.
62
62
63
63
:::info
64
64
To know how to view history and view updates in the audit log, refer to the [Manage Organizations for MSSPs - CSIEM](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules).
@@ -71,5 +71,5 @@ To know how to view history and view updates in the audit log, refer to the [
71
71
***What if errors occur during pushing?**<br/>Affected items will be skipped. Once the rest of the content is pushed, you can review errors in [View History](#view-history) and retry.
72
72
***Can I roll back changes after a push operation?**<br/>No, rollback is not supported. After a push operation is initiated, changes cannot be reversed.
73
73
***How can I monitor push progress?**<br/>During a push, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
74
-
***How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the updated items.
74
+
***How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the pushed items.
75
75
***Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.
0 commit comments