You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We're excited to announce the ability to manage your **Library** content across your Enterprise multi-orgs and MSSP (typically a parent organization with multiple child organizations). This lets you to save, share, and manage log searches, dashboards, apps, and other Sumo Logic content for launching searches and dashboards with a single click. Additionally, you can use the content that others in your organization have already developed to continually discover new insights in your data. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules).
Copy file name to clipboardExpand all lines: docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules.md
+13-7Lines changed: 13 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
---
2
2
id: manage-orgs-for-mssps-csiem-rules
3
-
title: Manage Organizations for MSSPs - Cloud SIEM
4
-
sidebar_label: Manage Orgs for MSSPs - Cloud SIEM
5
-
description: Learn how to manage organizational Cloud SIEM rules and rule tuning for Managed Security Service Providers (MSSPs).
3
+
title: Manage Organizations for MSSPs
4
+
sidebar_label: Manage Orgs for MSSPs
5
+
description: Learn how to manage organizational Cloud SIEM rules, rule tuning expressions, and organizational library content for Managed Security Service Providers (MSSPs).
6
6
---
7
7
import useBaseUrl from '@docusaurus/useBaseUrl';
8
8
9
-
This article describes how to manage Cloud SIEM rules and rule tuning expressions in organizations for Managed Security Service Providers (MSSPs). MSSP administrators must ensure that the content of their child organizations is properly configured. MSSPs often consist of a parent organization with child organizations that use [Cloud SIEM](/docs/cse/).
9
+
This article describes how to manage Cloud SIEM rules, rule tuning expressions, and organizational library content for Managed Security Service Providers (MSSPs). MSSP administrators must ensure that the content of their child organizations is properly configured. MSSPs often consist of a parent organization with child organizations that use [Cloud SIEM](/docs/cse/).
10
10
11
11
## Considerations
12
12
@@ -23,11 +23,9 @@ You must have the following [organization role capabilities](/docs/manage/users-
23
23
24
24
If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations).
25
25
26
-
<!-- After this article is no longer beta, show the following text:
27
26
This multi-insights list page (also known as a "federated" page) shows insights just as in a normal insights list page. When you click an insight on the page, you are automatically signed in to the child organization (if SSO is enabled for the child organization), and the insight's details open in the child organization's UI. You can also use the board view on the multi-insights page to move insights to different statuses.
28
27
29
28
To be able to see insights in child organizations, add child organizations that use Cloud SIEM. Then when the parent organization user goes to their Cloud SIEM insights list page, all the child organizations' insights appear in the list.
30
-
-->
31
29
32
30
## Manage Cloud SIEM rules
33
31
@@ -36,22 +34,30 @@ To ensure that content is consistent across child organizations, use the **Manag
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.<br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.
41
40
1. Select the **Manage Content** tab.
42
41
1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
43
42
1. In the **Content** bar, select the content to be pushed:
44
43
***Cloud SIEM Rules**. For more information about Cloud SIEM rules, refer to [Cloud SIEM Rules](/docs/cse/rules/).
45
44
***Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, refer to [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).
45
+
***Library**. For more information about Library items, refer to [Managing Your Sumo Logic Library](/docs/get-started/library).
46
46
1. Select individual items to be pushed, or all items.
1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
48
+
1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
49
49
1. Click **Push**. A **Pushing in progress** dialog is displayed.
50
50
51
51
### Tips
52
52
53
53
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
54
54
* When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
55
+
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
56
+
***Scheduled Searches Connection**. Select **Include Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
57
+
***Scheduled Reports**. Select **Include Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
58
+
:::note
59
+
Both **Scheduled Searches Connection** and **Scheduled Reports** will be available only when you select a library *folder*.
0 commit comments