Skip to content

Commit 7d34e11

Browse files
committed
minor formatting
1 parent e00cd2e commit 7d34e11

File tree

2 files changed

+34
-34
lines changed

2 files changed

+34
-34
lines changed

docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules.md

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -31,27 +31,27 @@ To be able to see insights in child organizations, add child organizations that
3131

3232
## Manage Cloud SIEM rules
3333

34-
To ensure that content is consistent across child organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
34+
To ensure that content is consistent across child organizations, use the **Manage Content** tab to push content in target organizations with content from a source organization.
3535

36-
You can update the following:
36+
You can push the following:
3737
* Cloud SIEM [rules](/docs/cse/rules/)
3838
* Cloud SIEM [rule tuning expressions](/docs/cse/rules/rule-tuning-expressions/)
3939

4040
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
4141
1. Select the **Manage Content** tab.
42-
1. In the **Source Org** field, select the organization that will provide the source data to be updated in other organizations.
43-
1. In the **Content** bar, select the content to be updated:
42+
1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
43+
1. In the **Content** bar, select the content to be pushed:
4444
* **Cloud SIEM Rules**. For more information about Cloud SIEM rules, refer to the [Cloud SIEM Rules](/docs/cse/rules/).
4545
* **Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, refer to the [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).
46-
1. Select individual items to be updated, or all items.
47-
1. Click **Push to Orgs**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-csiem.png')} alt="Update Selected Items button" style={{border: '1px solid gray'}} width="800"/>
48-
1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
46+
1. Select individual items to be pushed, or all items.
47+
1. Click **Push to Orgs**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-csiem.png')} alt="Push Selected Items button" style={{border: '1px solid gray'}} width="800"/>
48+
1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
4949
1. Click **Push**. A **Pushing in progress** dialog is displayed.
5050

5151
### Tips
5252

53-
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
54-
* When you update rule tuning expressions, select **Include Associated Cloud SIEM Rules** to also update all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
53+
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
54+
* When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
5555

5656
### Limitations
5757

@@ -64,13 +64,13 @@ You can update the following:
6464

6565
## View history
6666

67-
1. Click **View History** in the upper-right corner of the page. A query for update history displays:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query.png')} alt="View history query" style={{border: '1px solid gray'}} width="800"/>
68-
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The update history displays. The email of the individual who performed the update appears in the **user_email** column, and the updated items appear in the **content** column. <br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query-results.png')} alt="View history query results" style={{border: '1px solid gray'}} width="800"/>
69-
1. Investigate any updates that failed and re-run the update if needed.
67+
1. Click **View History** in the upper-right corner of the page. A query for push history displays:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query.png')} alt="View history query" style={{border: '1px solid gray'}} width="800"/>
68+
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The push history displays. The email of the individual who performed the push appears in the **user_email** column, and the pushed items appear in the **content** column. <br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query-results.png')} alt="View history query results" style={{border: '1px solid gray'}} width="800"/>
69+
1. Investigate any push that failed and re-run the push if needed.
7070

71-
## View updates in the audit log​
71+
## View push in the audit log​
7272

73-
You can view all content management updates in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
73+
You can view all content management push in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
7474

7575
```sql
7676
_index=sumologic_audit_events
@@ -100,14 +100,14 @@ _index=sumologic_audit_events
100100
* **What if errors occur during pushing?**<br/>Affected items will be skipped. Once the rest of the content is pushed, you can review errors in [View History](#view-history) and retry.
101101
* **Can I roll back changes after a push operation?**<br/>No, rollback is not supported. After a push operation is initiated, changes cannot be reversed.
102102
* **How can I monitor push progress?**<br/>During a push, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
103-
* **How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the updated items.
103+
* **How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the pushed items.
104104
* **Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.
105105

106-
#### Rules updates
106+
#### Pushing Cloud SIEM Rules
107107

108-
**Are rule tuning expressions included?**<br/>No, they are not included, but can be updated separately.
108+
**Are rule tuning expressions included?**<br/>No, they are not included, but can be pushed separately.
109109

110-
#### Rule tuning expressions updates
110+
#### Pushing Cloud SIEM Rule tuning expressions
111111

112112
* **What happens if the source tuning expression contains Cloud SIEM rules?**<br/>If the **Include Linked Cloud SIEM Rules** option is selected, existing rules with the same name in the destination organization will be linked to match the source tuning expression.
113-
* **What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.
113+
* **What if no matching Cloud SIEM rules are found in the destination organization?**<br/>Push will complete with a warning, and missing rules will be logged in the audit log. You can push those rules separately and re-run the tuning expression push.

docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,35 +30,35 @@ You must have the following [organization role capabilities](/docs/manage/users-
3030

3131
## Manage content in organizations
3232

33-
To ensure that [Library](/docs/get-started/library) content is consistent across child organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
33+
To ensure that [Library](/docs/get-started/library) content is consistent across child organizations, use the **Manage Content** tab to push content in target organizations with content from a source organization.
3434

3535
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
3636
1. Select the **Manage Content** tab.
37-
1. In the **Source Org** field, select the organization that will provide the source data to be updated in other organizations.
37+
1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
3838
1. In the **Content** bar, select **Library**. For more information about Library items, refer to the [Managing Your Sumo Logic Library](/docs/get-started/library).
39-
1. Select individual items to be updated, or all items.
40-
1. Click **Push Selected Items**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items.png')} alt="Update Selected Items button" style={{border: '1px solid gray'}} width="800"/>
41-
1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to update the selected items to. You can update to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
39+
1. Select individual items to be pushed, or all items.
40+
1. Click **Push Selected Items**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items.png')} alt="Push Selected Items button" style={{border: '1px solid gray'}} width="800"/>
41+
1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
4242
1. Click **Push**. A **Pushing in progress** dialog is displayed.
4343

4444
### Tips
4545

46-
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to update to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
46+
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
4747
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
48-
* **Scheduled Searches Connection**. Select **Include and Update Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
49-
* **Scheduled Reports**. Select **Include and Update Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
48+
* **Scheduled Searches Connection**. Select **Include Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
49+
* **Scheduled Reports**. Select **Include Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
5050
:::note
51-
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available to update when you select a library *folder*.
51+
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available only when you select a library *folder*.
5252
:::
5353

5454
### Limitations
5555

5656
- If an item with the same name exists in the target organization, it will be replaced.
57-
- Once an update is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
58-
- If errors occur during update, administrators must manually re-attempt failed updates. To see failed updates, use [View History](#view-history).
59-
- Update operations may take longer based on the volume of content being updated.
60-
- Rule tuning expressions must be updated separately from rules.
61-
- *Cloud SIEM Legacy Rule Type* is not supported for sync or update.
57+
- Once a push is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
58+
- If errors occur during the push, administrators must manually re-attempt failed push. To see failed push, use [View History](#view-history).
59+
- Push operations may take longer based on the volume of content being pushed.
60+
- Rule tuning expressions must be pushed separately from rules.
61+
- *Cloud SIEM Legacy Rule Type* is not supported for sync or push.
6262

6363
:::info
6464
To know how to view history and view updates in the audit log​, refer to the [Manage Organizations for MSSPs - CSIEM](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules).
@@ -71,5 +71,5 @@ To know how to view history and view updates in the audit log​, refer to the [
7171
* **What if errors occur during pushing?**<br/>Affected items will be skipped. Once the rest of the content is pushed, you can review errors in [View History](#view-history) and retry.
7272
* **Can I roll back changes after a push operation?**<br/>No, rollback is not supported. After a push operation is initiated, changes cannot be reversed.
7373
* **How can I monitor push progress?**<br/>During a push, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
74-
* **How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the updated items.
74+
* **How can I view push history?**<br/>Click **View History** in the upper-right corner of the page. A query for push history will display, showing the email of the individual who performed the push and the pushed items.
7575
* **Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.

0 commit comments

Comments
 (0)