You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This page describes the Sumo pipeline for ingesting logs from Google Cloud Platform (GCP) services, and provides instructions for collecting logs from Google Cloud Storage.
94
+
This section describes the Sumo Logic pipeline for ingesting logs from Google Cloud Platform (GCP) services, and explains how to collect logs from Google Cloud Storage.
95
95
96
96
### Collection Process for GCP Services
97
97
@@ -107,12 +107,12 @@ Follow the steps below to configure the collection for GCP:
107
107
108
108
1. Configure a GCP source on a hosted collector. You'll obtain the **HTTP URL for the source**.
109
109
2. Create a topic in Google Pub/Sub and subscribe the GCP source URL to that topic.
110
-
3. Create an export of GCP logs from Google Log Router. Exporting involves writing a filter that selects the log entries you want to export, and choosing a Pub/Sub as the destination. The filter and destination are held in an object called a sink.
110
+
3. Create an export of GCP logs from Google Log Router. Exporting involves writing a filter that selects the log entries you want to export and choosing a Pub/Sub as the destination. The filter and destination are held in an object called a sink.
111
111
112
112
Refer to the following sections for configuration instructions.
113
113
114
114
:::note
115
-
Logs from GCP services can be [exported](https://cloud.google.com/logging/docs/export/configure_export_v2) to any destination. Any GCP logs can be [excluded](https://cloud.google.com/logging/docs/exclusions) from Logs router.
115
+
Logs from GCP services can be [exported](https://cloud.google.com/logging/docs/export/configure_export_v2) to any destination. Any GCP logs can be [excluded](https://cloud.google.com/logging/docs/exclusions) from the Logs router.
116
116
:::
117
117
118
118
### Configure a Google Cloud Platform Source
@@ -122,10 +122,10 @@ The Google Cloud Platform (GCP) Source receives log data from Google Pub/Sub.
122
122
:::note
123
123
You can use the same GCP Source to receive log data from multiple GCP services. For example, you can send logs collected from Google Cloud Application Engine, Google Cloud IAM, and Google Cloud Audit.
124
124
125
-
However, this is not recommended since you cannot define specific Source Category values to each GCP service. If you create a GCP Source for each service you can define a specific Source Category to each service.
125
+
However, this is not recommended since you cannot define specific Source Category values for each GCP service. If you create a GCP Source for each service you can define a specific Source Category for each service.
126
126
:::
127
127
128
-
This Source will be a Google Pub/Sub-only Source, which means that it will only be usable for log data formatted as data coming from Google Pub/Sub.
128
+
This Source will be a Google Pub/Sub-only Source, indicating that it will only be usable for log data formatted as data coming from Google Pub/Sub.
129
129
130
130
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.
131
131
@@ -145,7 +145,7 @@ This Source will be a Google Pub/Sub-only Source, which means that it will only
145
145
8.**Advanced Options for Logs**.<br/><img src={useBaseUrl('img/integrations/google/GCP-advanced-options-Jan-22.png')} alt="Google integrations" />
146
146
147
147
***Timestamp Parsing**. This option is selected by default. If it's deselected, no timestamp information is parsed at all.
148
-
***Time Zone**. There are two options for Time Zone. You can use the time zone present in your log files, and then choose an option in case time zone information is missing from a log message. Or, you can have Sumo Logic completely disregard any time zone information present in logs by forcing a time zone. It's very important to have the proper time zone set, no matter which option you choose. If the time zone of logs cannot be determined, Sumo Logic assigns logs UTC; if the rest of your logs are from another time zone your search results will be affected.
148
+
***Time Zone**. There are two options for the Time Zone. You can use the time zone present in your log files, and then choose an option in case time zone information is missing from a log message. Or, you can have Sumo Logic completely disregard any time zone information present in logs by forcing a time zone. It's very important to have the proper time zone set, no matter which option you choose. If the time zone of logs cannot be determined, Sumo Logic assigns logs UTC; if the rest of your logs are from another time zone your search results will be affected.
149
149
***Timestamp Format**. By default, Sumo Logic will automatically detect the timestamp format of your logs. However, you can manually specify a timestamp format for a Source. See [Timestamps, Time Zones, Time Ranges, and Date Formats](/docs/send-data/reference-information/time-reference) for more information.
150
150
151
151
9.**Processing Rules**. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in [Create a Processing Rule](/docs/send-data/collection/processing-rules/create-processing-rule).
@@ -180,7 +180,7 @@ We recommend the following:
180
180
181
181
### Create export of Google Cloud Storage logs from Google Logging
182
182
183
-
In this step you export logs to the Pub/Sub topic you created in the previous step.
183
+
In this step, you export logs to the Pub/Sub topic you created in the previous step.
184
184
185
185
1. Go to **Logging** and click **Logs Router**.<br/><img src={useBaseUrl('img/integrations/google/GCP_logging_1.png')} alt="Google integrations" />
186
186
@@ -203,10 +203,10 @@ For metrics collection in Sumo Logic, use the [GCP Metric source](/docs/send-dat
203
203
204
204
1. Set up the [Google Service Account](/docs/send-data/hosted-collectors/google-source/gcp-metrics-source/#google-service-account).
205
205
206
-
2. Set up a [GCP Metric source](/docs/send-data/hosted-collectors/google-source/gcp-metrics-source/#set-up-a-gcp-metrics-source) in Sumo Logic. While setting up the source, select **Cloud Storage** as the service from dropdown to get the Google Cloud Storage metrics.
206
+
2. Set up a [GCP Metric source](/docs/send-data/hosted-collectors/google-source/gcp-metrics-source/#set-up-a-gcp-metrics-source) in Sumo Logic. While setting up the source, select **Cloud Storage** as the service from the dropdown to get the Google Cloud Storage metrics.
207
207
208
208
## Installing the Google Cloud Storage App
209
-
Now that you have set up collection for Google Cloud Storage, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.
209
+
Now that you have set up the collection for Google Cloud Storage, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.
210
210
211
211
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
212
212
@@ -263,7 +263,7 @@ See information about key Google Cloud Storage usage metrics, operational activi
263
263
264
264
### Google Cloud Storage - Storage Optimization and Authorization
265
265
266
-
See information about key Google Cloud Storage bucket optimization opportunities, including storage class distribution, object lifecycle management, and authorization patterns to identify potential cost savings and security improvements.
266
+
See information about key Google Cloud Storage bucket optimization opportunities, including the storage class distribution, object lifecycle management, and authorization patterns to identify potential cost savings and security improvements.
[Azure Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/overview) is a managed service hosted in the cloud that acts as a central message hub for communication between an IoT application and its attached devices. This integration helps in comprehensive monitoring of your key vaults requests, performance, failures, and latency.
11
+
[Azure Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/) is a cloud service that helps you securely store and manage secrets, keys, and certificates. You can use it to protect data for cloud apps and services. This integration helps in comprehensive monitoring of your Key Vault operations, requests, failures, and latency.
The Sumo Logic app for CyberArk Audit is a robhust tool that provides insights into your organization's cybersecurity practices. It helps IT and security teams monitor, analyze, and visualize audit trails of user activities, security events, and anomalies. By tracking data on security events, identity management, component usage, and administrative actions, the app delivers actionable intelligence to identify and mitigate security risks, ensuring compliance with regulations and internal policies. Customizable dashboards and detailed reporting enhance its ability to strengthen security.
12
+
The Sumo Logic app for CyberArk Audit is a robust tool that provides insights into your organization's cybersecurity practices. It helps IT and security teams monitor, analyze, and visualize audit trails of user activities, security events, and anomalies. By tracking data on security events, identity management, component usage, and administrative actions, the app delivers actionable intelligence to identify and mitigate security risks, ensuring compliance with regulations and internal policies. Customizable dashboards and detailed reporting enhance its ability to strengthen security.
13
13
14
14
:::info
15
15
This app includes [built-in monitors](#cyberark-audit-monitors). For details on creating custom monitors, refer to [Create monitors for CyberArk Audit app](#create-monitors-for-cyberark-audit-app).
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/about-automation-service.md
+1-6Lines changed: 1 addition & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -88,12 +88,7 @@ Access to the Automation Service is controlled by [role capabilities](/docs/mana
88
88
89
89
### Configure the connection for an integration resource
90
90
91
-
To use [integrations](/docs/platform-services/automation-service/automation-service-integrations), you must configure the connection for their resources.
92
-
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Automation** and then select **Integrations** in the left nav bar. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Automation > Integrations**. You can also click the **Go To...** menu at the top of the screen and select **Integrations**.
93
-
1. Select the integration whose resource you want to configure the connection for.
94
-
1. Hover over the resource name and click the **Edit** button that appears.<br/><img src={useBaseUrl('img/cse/automations-edit-resource.png')} style={{border:'1px solid gray'}} alt="Edit a resource" width="800"/>
95
-
1. Enter the connection configuration needed by the resource. (Find the integration in [Integrations in App Central](/docs/platform-services/automation-service/app-central/integrations/) for configuration instructions.)<br/>What you enter is specific to the resource you're using. Each resource's configuration screen may be different, but in most cases, you will need information such as IP addresses, API tokens, usernames, and passwords for the application you're integrating with. For example, in the following screen enter the **API URL** and **API Key**. <br/><img src={useBaseUrl('img/cse/automations-edit-resource-2.png')} style={{border:'1px solid gray'}} alt="Edit a resource" width="400"/>
96
-
1. Click **Save** to save the configuration.
91
+
To use [integrations](/docs/platform-services/automation-service/automation-service-integrations), you must first configure the connection for their resources. See [Configure Authentication for Integrations](/docs/platform-services/automation-service/configure-authentication-for-integrations/).
***Get Employee Information***(Enrichment)* - Get employee information.
27
27
28
-
## Abnormal Security in Automation Service and Cloud SOAR
28
+
## Configure Abnormal Security in Automation Service and Cloud SOAR
29
+
30
+
import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
31
+
32
+
<IntegrationsAuth/>
29
33
30
34
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation/).
31
35
1. After the list of the integrations appears, search for the integration and click on the row.
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/app-central/integrations/abuse.ch-sslbl-feed.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,11 @@ An SSL certificate can be associated with one or more servers (IP address:port c
22
22
* I strongly recommend you to not use the aggressive version of the Botnet C2 IP blacklist as it definitely will cause false positives. If you want to reduce the amount of false positives, do not use this option. If you want to get maximum protection and do not care about false positives, you can enable the action by selecting the checkbox (not recommended).
23
23
* More info: 'https://sslbl.abuse.ch/'
24
24
25
-
## Abuse.ch SSLBL Feed in Automation Service and Cloud SOAR
25
+
## Configure Abuse.ch SSLBL Feed in Automation Service and Cloud SOAR
26
+
27
+
import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
28
+
29
+
<IntegrationsAuth/>
26
30
27
31
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation).
28
32
1. After the list of the integrations appears, search/look for the integration and click on the row.
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/app-central/integrations/abuseipdb.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,11 @@ Enrich IP addresses with reputation information gathered from AbuseIPDB.
29
29
4. Click on **Create Key**.
30
30
5. Copy the **API key**.
31
31
32
-
## Configure AbuseIPDB
32
+
## Configure AbuseIPDB in Automation Service and Cloud SOAR
33
+
34
+
import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
35
+
36
+
<IntegrationsAuth/>
33
37
34
38
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation).
35
39
2. After the list of the integrations appears, search for the integration and click on the row.
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/app-central/integrations/acronis.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,11 @@ Follow these steps to get your API key from Arconis.
24
24
1. Click **+ Create API Client** and enter a name. <br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/acronis/acronis-3.png')} style={{border:'1px solid gray'}} alt="acronis-3" width="400"/> <br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/acronis/acronis-4.png')} style={{border:'1px solid gray'}} alt="acronis-4" width="400"/>
25
25
1. Copy and save the Client ID, Secret, and Data center URL. <br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/acronis/acronis-5.png')} style={{border:'1px solid gray'}} alt="acronis-5" width="400"/>
26
26
27
-
## Acronis in Automation Service and Cloud SOAR
27
+
## Configure Acronis in Automation Service and Cloud SOAR
28
+
29
+
import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
30
+
31
+
<IntegrationsAuth/>
28
32
29
33
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation).
30
34
1. After the list of the integrations appears, search for the integration and click on the row.
0 commit comments