Skip to content

Commit ab638af

Browse files
Merge branch 'main' into SUMO-263520
2 parents cef44a2 + 8290092 commit ab638af

File tree

19 files changed

+162
-68
lines changed

19 files changed

+162
-68
lines changed

blog-service/2025-06-30-manage.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: Timezone field for Scheduled Views (Manage)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- timezone
6+
- manage
7+
- scheduled-view
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
14+
We're happy to include the **Timezone** field for the Scheduled Views. Previously, *America/Los_Angeles (Includes DST)* was considered as the default timezone. Going forward, you can select/edit the timezone of your choice. If you do not make a selection, the Scheduled View will default to the timezone preference in Sumo Logic.
15+
16+
[Learn more](/docs/manage/scheduled-views/add-scheduled-view/).

cid-redirects.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2898,6 +2898,7 @@
28982898
"/cid/21035": "/docs/integrations/google/cloud-traffic-director",
28992899
"/cid/21036": "/docs/integrations/google/cloud-vertex-ai",
29002900
"/cid/21037": "/docs/integrations/google/cloud-vpn",
2901+
"/cid/21097": "/docs/integrations/saas-cloud/confluent-cloud",
29012902
"/cid/21040": "/docs/manage/manage-subscription/create-and-manage-orgs/create-manage-orgs-service-providers",
29022903
"/cid/21038": "/docs/integrations/containers-orchestration/vmware-tanzu-application-service",
29032904
"/cid/10999": "/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source",

docs/cloud-soar/introduction.md

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@ Finally, you can take the Insights from Cloud SIEM and automatically respond to
6464
Sumo Logic’s Cloud SOAR is a cloud-based web application available as an add-on to existing Sumo Logic deployments. Some of Cloud SOAR’s key features include:
6565

6666
* **War Room**. A central location for all the information, analysis, and actions related to an incident. This includes notes, documentation, and knowledge transfer as well as tools for collecting data and assessing, investigating, and correlating different incidents.
67-
* **ARK**. The Automated Responder Knowledge (ARK) learns from past incidents and threat intel to recommend relevant playbooks for future incidents.
6867
* **App Central**. A large out-of-the-box library of playbooks, integrations, and use cases for different threats to get you started.
6968
* **Cybersecurity best practices**. Cloud SOAR’s design and architecture meets many cybersecurity industry standards, regulatory frameworks, and best practices from organizations like ISO, GDPR, OASIS, NIST, and many others.
7069

@@ -210,12 +209,6 @@ Here are some other workflows you could automate with a playbook:
210209

211210
Cloud SOAR has hundreds of prebuilt playbooks and templates, so you can quickly and easily automate any of these tasks, or create new custom playbooks to suit your specific business needs. Normally, playbooks are automatically attached to incidents based on information like entities and severity scores.
212211

213-
##### ARK suggestions
214-
215-
Playbooks automate the individual tasks of incident response. But Cloud SOAR's Automated Responder Knowledge (ARK) suggestions take things one step further. ARK uses machine learning to suggest the most appropriate playbook for your incidents based on what you've done on similar incidents in the past. This frees up even more resources for analysts, as they don't have to spend time choosing a playbook before responding.
216-
217-
When ARK suggests a playbook to you, you have the option to add the playbook to the incident, run it, or dismiss the suggestion.
218-
219212
#### App Central, custom integrations, and other automations
220213

221214
Cloud SOAR has hundreds of pre-built playbooks which you can use as-is or customize. You can also build your own custom playbooks, which you can learn about in the Cloud SIEM Administration class.

docs/cloud-soar/legacy/legacy-cloud-soar-architecture.md

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,3 @@ All multi-tenant installations offer:
2525
- Isolation of external actions (e.g., enrichment of indicators of compromise, containment actions prescribed to a host)
2626

2727
<img src={useBaseUrl('img/cloud-soar/image5.png')} alt="Multiple database symbols" width="600"/>
28-
29-
## Automated Responder Knowledge (DF-ARK)
30-
31-
Cloud SOAR's Automated Responder Knowledge (DF-ARK) module utilizes machine
32-
learning through historical responses to past incidents and threat
33-
intelligence feeds to enrich new incidents. This enrichment allows
34-
Cloud SOAR to recommend relevant Playbooks and plans of action to expedite
35-
detection and response times.

docs/cloud-soar/legacy/legacy-global-functions-menu.md

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -32,49 +32,6 @@ When a search result is located within an incident, the incident number will be
3232

3333
<img src={useBaseUrl('img/cloud-soar/image12.png')} alt="Global Search Results" style={{border: '1px solid gray'}} width="800"/>
3434

35-
## Automation
36-
37-
### ARK
38-
39-
ARK or Automated Responder Knowledge is the Machine Learning component of Cloud SOAR which implements the Supervised learning in Case-Based Reasoning (CBR) algorithm.
40-
CBR solves new problems by adapting previously successful solutions to similar problems. In Cloud SOAR, this can be leveraged by analyzing solved incidents to hint steps and procedures to operators in new similar threats.<br/> <img src={useBaseUrl('img/cloud-soar/image15e.png')} alt="Automation menu" style={{border: '1px solid gray'}} width="250"/>
41-
42-
ARK assists operators during investigations in two main areas: Automatically suggesting/prompting next actions/tasks in Playbooks (until version 5) and Correlation/ Deduplication of similar threats into 1 unique incident.
43-
44-
#### Enable ARK
45-
46-
To enable ARK, click the cog icon, then **Settings** > **ARK** and make sure you have it set to **ON**.
47-
48-
From this page, it’s possible to configure also other ARK Settings such as the Neighbor incidents considered for each recommendation and an age relevance threshold. Those two parameters will allow you to tune the incidents that the Machine Learning algorithm will consider.
49-
50-
<img src={useBaseUrl('img/cloud-soar/image16b.png')} alt="ARK Settings" style={{border: '1px solid gray'}} width="800"/>
51-
52-
When an incident is created in Cloud SOAR, the Incident Type field will be the one defining which Playbooks you can attach to that incident.
53-
54-
#### ARK Usage
55-
56-
ARK has a correlation and deduplication or merging mechanism you can use with the ARK OIF.
57-
58-
ARK 2.0 OIF is a custom Sumo Logic integration which allows investigators to implement a mechanism for deduplication and correlation of ingested alerts and Cloud SOAR incidents.
59-
60-
<img src={useBaseUrl('img/cloud-soar/image16d.png')} alt="ARK OIF" style={{border: '1px solid gray'}} width="800"/>
61-
62-
<img src={useBaseUrl('img/cloud-soar/image16e.png')} alt="Test Action" style={{border: '1px solid gray'}} width="800"/>
63-
64-
OIF ARK enrichment action “Get parents for incident” allows you to retrieve every incident (as proposed parents) that is similar to the analyzed one.
65-
66-
Each optional field allows you to fine tune the weight of the fields, acceptance thresholds and of the algorithm which needs to be trained and fine-tuned in order to get correct and reliable results.
67-
68-
<img src={useBaseUrl('img/cloud-soar/image16f.png')} alt="Field Weight" style={{border: '1px solid gray'}} width="800"/>
69-
70-
Alert deduplication or merging can be achieved by utilizing ARK OIF enrichment actions and Cloud SOAR’s unique Triage capability.
71-
72-
Triage is a customizable section which can be used for enriching and preprocessing multiple different scenarios.
73-
74-
By dispatching the ingested alerts into Triage events, Cloud SOAR can automatically enrich each event, deduplicate them based on the logic configured in our associated Playbooks (which can invoke Ark OIF enrichment) and decide if Cloud SOAR should aggregate multiple entries in one unique incident, create multiple incidents for each event or if a similar incident has already been created, to update the existing incident with updated information.
75-
76-
Cloud SOAR can also correlate existing incidents to check if specific data is already present in the Cloud SOAR Database. It is crucial that all merging or deduplication must be done prior to conversion of an alert into incident. For example, a Triage event that allows you to invoke one or multiple playbooks for each Triage event created.
77-
7835
## Settings
7936

8037
### General Settings

docs/cloud-soar/overview.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -402,8 +402,6 @@ Cloud SOAR has been designed with Interoperability for Cybersecurity Industry st
402402

403403
Cloud SOAR design and architecture follows Cybersecurity Industry standards and regulatory frameworks, and adheres to best Industry practices to meet best Cybersecurity practices followed by ISO, GDPR, OASIS, NIST, Sec Regulations, and more.
404404

405-
Cloud SOAR offers a patent-pending Automated Responder Knowledge (DF-ARK) module which applies machine learning to historical responses and threats. It recommends relevant Playbooks, paths of action to expedite the process, and responses to manage and mitigate similar incidents with better response time.
406-
407405
Cloud SOAR provides static egress for Cloud executions. IP addresses can be entered into the allowlist. For a list of Cloud SOAR addresses by region, contact [Support](https://support.sumologic.com/support/s/).
408406

409407
<img src={useBaseUrl('img/cloud-soar/image3.png')} alt="Cloud SOAR architecture diagram" style={{border: '1px solid gray'}} width="800"/>

docs/integrations/product-list/product-list-a-l.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
162162
| <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/cofense.png')} alt="Thumbnail icon" width="50"/> | [Cofense](https://cofense.com/) | Automation integration: [Cofense](/docs/platform-services/automation-service/app-central/integrations/cofense/) |
163163
| <img src={useBaseUrl('img/integrations/misc/commscope-logo.svg')} alt="Thumbnail icon" width="100"/> | [CommScope](https://www.commscope.com/) | Cloud SIEM integration: [CommScope](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/e69bff14-6237-4997-a447-4fc02feaeeaf.md) |
164164
| <img src={useBaseUrl('img/integrations/misc/configcat-logo.png')} alt="Thumbnail icon" width="50"/> | [ConfigCat](https://configcat.com/) | Webhook: [ConfigCat](/docs/integrations/webhooks/configcat/) |
165-
| <img src={useBaseUrl('img/send-data/confluent-cloud-metrics.png')} alt="Thumbnail icon" width="100"/> | [Confluent](https://www.confluent.io/) | Collector: [Confluent Cloud Metrics Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/confluent-cloud-metrics-source) |
165+
| <img src={useBaseUrl('img/integrations/saas-cloud/confluent-cloud.png')} alt="Thumbnail icon" width="100"/> | [Confluent](https://www.confluent.io/) | App: [Confluent Cloud](/docs/integrations/saas-cloud/confluent-cloud)<br/>Collector: [Confluent Cloud Metrics Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/confluent-cloud-metrics-source) |
166166
| <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/connectwise-manage.png')} alt="Thumbnail icon" width="100"/> | [ConnectWise PSA](https://info.connectwise.com/professional-services-automation/manage/demo/sem/demo) | Automation integration: [ConnectWise Manage](/docs/platform-services/automation-service/app-central/integrations/connectwise-manage/) |
167167
| <img src={useBaseUrl('img/integrations/misc/contrast-security-logo.png')} alt="Thumbnail icon" width="100"/> | [Contrast Security](https://www.contrastsecurity.com/) | Cloud SIEM integration: [Contrast Security](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/024b4302-9a57-4c60-9d0d-693b2d18225b.md) |
168168
| <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/coralogix-query-logs.png')} alt="Thumbnail icon" width="75"/> | [Coralogix](https://coralogix.com/) | Automation integrations: <br/>- [Coralogix - Query Logs](/docs/platform-services/automation-service/app-central/integrations/coralogix-query-logs/) <br/>- [Coralogix - Send Logs](/docs/platform-services/automation-service/app-central/integrations/coralogix-send-logs/) |
Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
id: confluent-cloud
3+
title: Confluent Cloud
4+
sidebar_label: Confluent Cloud
5+
description: The Sumo Logic app for Confluent Cloud offers deep visibility into your environment with dashboards that monitor Kafka performance, consumer lag, producer latency, connector health, Flink compute pools, KSQL activity, and schema registry operations, enabling proactive troubleshooting and efficient data streaming.
6+
---
7+
8+
import useBaseUrl from '@docusaurus/useBaseUrl';
9+
10+
<img src={useBaseUrl('img/integrations/saas-cloud/confluent-cloud.png')} alt="Thumbnail icon" width="100"/>
11+
12+
Confluent Cloud is a fully managed, cloud-native data streaming platform based on Apache Kafka. It enables real-time data processing, integration, and movement across applications and systems without managing infrastructure. With built-in support for connectors, ksqlDB, and stream governance, it simplifies building scalable, event-driven architectures.
13+
14+
The Sumo Logic app for Confluent Cloud provides deep visibility into your Confluent Cloud environment based on key platform metrics. The app’s dashboards use preconfigured searches and filters to help you monitor Kafka cluster performance, topic-level throughput, consumer lag, producer latency, connector health, Flink compute pool utilization, KSQL activity, and schema registry operations—enabling proactive troubleshooting and streamlined data streaming operations.
15+
16+
## Metrics type
17+
18+
The Confluent Cloud app uses metrics:
19+
20+
* [Confluent Cloud runtime metrics](https://api.telemetry.confluent.cloud/docs/descriptors/datasets/cloud).
21+
22+
### Collecting metrics for the Confluent Cloud app
23+
24+
Sumo Logic supports collecting metrics using the Cloud-to-Cloud integration framework:
25+
26+
* Configure a [Confluent Cloud Metrics Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/confluent-cloud-metrics-source/)
27+
28+
## Installing the Confluent Cloud app
29+
30+
Now that you have set up a collection for **Confluent Cloud**, install the Sumo Logic app to use the pre-configured [dashboards](#viewing-the-confluent-cloud-dashboards) that provide visibility into your environment for real-time analysis of overall usage.
31+
32+
import AppInstall from '../../reuse/apps/app-install-v2.md';
33+
34+
<AppInstall/>
35+
36+
## Viewing the Confluent Cloud dashboards
37+
38+
### Compute Pool
39+
40+
The **Confluent Cloud - Compute Pool** dashboard provides details on the status and utilization of compute resources in your Confluent Cloud environment.
41+
42+
Use this dashboard to:
43+
* Monitor the average Flink statement status to identify potential issues with stream processing jobs.
44+
* Track CPU utilization against the set limit to ensure optimal resource allocation and prevent performance bottlenecks.
45+
* Analyze trends in CPU minutes consumed over time to optimize cost and capacity planning for your Confluent Cloud deployment.
46+
* Compare current CPU usage across different compute pools to balance workloads and improve overall system efficiency.
47+
48+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Compute-Pool.png')} alt="Confluent Cloud - Compute Pool" style={{border: '1px solid gray'}} width="800" />
49+
50+
### Connectors
51+
52+
The **Confluent Cloud - Connectors** dashboard provides details on the status, performance, and health of Confluent Cloud connectors.
53+
54+
Use this dashboard to:
55+
* Monitor the status of connectors and their tasks to quickly identify any that are failed, paused, or provisioning.
56+
* Track the volume of sent and received records across different connectors to ensure data flow is as expected.
57+
* Analyze the average sent and received bytes to detect any unusual spikes or drops in data transfer.
58+
* Identify potential bottlenecks by correlating connector status with sent/received records and bytes.
59+
* Monitor dead letter queue records to catch any messages that failed to be processed correctly.
60+
61+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Connectors.png')} alt="Confluent Cloud - Connectors" style={{border: '1px solid gray'}} width="800" />
62+
63+
### Kafka Cluster
64+
65+
The **Confluent Cloud - Kafka Cluster** dashboard provides details on key performance metrics and operational statistics for your Kafka cluster in Confluent Cloud.
66+
67+
Use this dashboard to:
68+
* Monitor producer latency and cluster load to ensure optimal performance of your Kafka cluster.
69+
* Track active connections, request bytes, and response bytes to identify potential bottlenecks or unusual traffic patterns.
70+
* Analyze request count trends over time to understand usage patterns and plan for capacity needs.
71+
72+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Kafka-Cluster.png')} alt="Confluent Cloud - Kafka Cluster" style={{border: '1px solid gray'}} width="800" />
73+
74+
### Kafka Cluster Links
75+
76+
The **Confluent Cloud – Kafka Cluster Link** dashboard provides key insights into cluster link performance and health. It tracks link task counts, mirror topic states, offset lags, data volume, and response metrics—helping monitor cross-cluster replication efficiency, detect mirror errors, and ensure seamless data delivery across environments.
77+
78+
Use this dashboard to:
79+
* Monitor link counts and task activity to ensure proper setup and functioning of cluster replication.
80+
* Track mirror topic count, bytes, and offset lag to assess replication volume and delays.
81+
* Analyze destination response bytes for throughput visibility across clusters.
82+
* Detect mirror transition errors to troubleshoot sync failures efficiently.
83+
84+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Kafka-Cluster-Links.png')} alt="Confluent Cloud - Kafka Cluster Topic" style={{border: '1px solid gray'}} width="800" />
85+
86+
### Kafka Cluster Topic
87+
88+
The **Confluent Cloud - Kafka Cluster Topic** dashboard provides details on topic-level metrics for Kafka clusters in Confluent Cloud, including consumer lag, data throughput, and partition information.
89+
90+
Use this dashboard to:
91+
* Monitor consumer lag offsets to identify potential bottlenecks in data processing and ensure timely consumption of messages.
92+
* Analyze the relationship between received and sent bytes to detect any data loss or transmission issues within the Kafka cluster.
93+
* Track the number of received and sent records over time to understand topic usage patterns and optimize resource allocation.
94+
* Observe retained bytes and partition count to manage storage utilization and ensure proper topic scaling.
95+
96+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Kafka-Cluster-Topic.png')} alt="Confluent Cloud - Kafka Cluster Topic" style={{border: '1px solid gray'}} width="800" />
97+
98+
### KSQL
99+
100+
The **Confluent Cloud - KSQL** dashboard provides details on query performance, data processing, and resource utilization for KSQL operations in Confluent Cloud.
101+
102+
Use this dashboard to:
103+
* Monitor query saturation and identify potential bottlenecks in KSQL operations.
104+
* Track processing errors and query restarts to ensure smooth data flow and query execution.
105+
* Analyze storage utilization and streaming unit consumption to optimize resource allocation.
106+
* Correlate offset lag with processing errors to troubleshoot data processing delays.
107+
* Examine produced and consumed bytes to understand data throughput and potential network issues.
108+
109+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-KSQL.png')} alt="Confluent Cloud - KSQL" style={{border: '1px solid gray'}} width="800" />
110+
111+
### Schema Registry
112+
113+
The **Confluent Cloud - Schema Registry** dashboard provides details on schema operations, request counts, and traffic types for your Confluent Cloud Schema Registry.
114+
115+
Use this dashboard to:
116+
* Monitor the distribution of schema operations (CREATE, READ, DELETE) to ensure proper usage and identify potential issues with schema management.
117+
* Analyze the ratio of public vs. private traffic to understand access patterns and potential security concerns.
118+
* Track schema count trends over time to manage growth and capacity planning for your Schema Registry.
119+
* Correlate request counts with operation types to identify unusual spikes or drops in schema-related activities.
120+
121+
<img src={useBaseUrl('https://sumologic-app-data-v2.s3.amazonaws.com/dashboards/ConfluentCloud/Confluent-Cloud-Schema-Registry.png')} alt="Confluent Cloud - Schema Registry" style={{border: '1px solid gray'}} width="800" />

0 commit comments

Comments
 (0)