Skip to content

Commit af8888f

Browse files
jpipkin1jpipkin1
committed
Merge branch 'docs-1015-automation-service-course' of github.com:SumoLogic/sumologic-documentation into docs-1015-automation-service-course
2 parents 979a0c0 + 11211a2 commit af8888f

File tree

333 files changed

+3879
-5051
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

333 files changed

+3879
-5051
lines changed

‎.clabot‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,10 @@
185185
"snyk-bot",
186186
"stephenthedev",
187187
"Apoorvkudesia-sumologic",
188-
"ntanwar-sumo"
188+
"ntanwar-sumo",
189+
"aj-sumo",
190+
"samiura",
191+
"naveenrama"
189192
],
190193
"message": "Thank you for your contribution! As this is an open source project, we require contributors to sign our Contributor License Agreement and do not have yours on file. To proceed with your PR, please [sign your name here](https://forms.gle/YgLddrckeJaCdZYA6) and we will add you to our approved list of contributors.",
191194
"label": "cla-signed",

‎blog-cse/2025-08-01-content.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
title: August 1, 2025 - Content Release
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- log mappers
6+
- parsers
7+
- rules
8+
- schema
9+
hide_table_of_contents: true
10+
---
11+
12+
This content release includes:
13+
- New rules to assist in detection of the ToolShell exploit against Microsoft SharePoint Server (CVE-2025-53770, CVE-2025-53771) and other web shell attack activity.
14+
- Updates to rules.
15+
- Parsing support for Open Cybersecurity Schema Framework (OCSF) logging.
16+
- Designed to support AWS Security Hub Findings via OCSF, but broadly compatible with other OCSF data sources.
17+
- Mapping support for AWS Security Hub Findings via OCSF.
18+
- AWS Security Hub via OCSF mapping support includes mappers which can be easily cloned and repurposed to support additional sources of data which use OCSF. Not all OCSF categories and classes are necessarily pertinent to AWS Security Hub data produced at this time.
19+
- Additional mappers for OCSF data sources will be added in future releases.
20+
- Updates to AWS Security Hub (non-OCSF) mapper to reduce signal volume by using a less granular field for `threat_signalName` and to map general resources into `resource` field.
21+
- New mappers for Citrix NetScaler and Palo Alto Firewall events.
22+
- Updates to existing mappers/parsers for AWS, Azure, Citrix NetScaler, Linux Sysmon, Windows Sysmon, and Zscaler to support additional events and field mappings.
23+
- Allows `resource` to be used as an entity in rules.
24+
25+
Other changes are enumerated below.
26+
27+
28+
### Rules
29+
- [New] MATCH-S01050 IIS - Executable File Added to Directory
30+
- Executable files added to Microsoft Internet Information Server (IIS) directories can indicate the installation of a web shell by an attacker. For example, the ToolShell exploit (CVE-2025-53770, CVE-2025-53771) included the installation of spinstall10.aspx in an executable directory.
31+
- [New] MATCH-S01051 SharePoint Server ToolShell Exploitation (CVE-2025-53770, CVE-2025-53771)
32+
- Exploits against two vulnerabilities in Microsoft SharePoint server, CVE-2025-53770 and CVE-2025-53771, are combined to execute code on Microsoft SharePoint without authentication. This attack has been nicknamed "ToolShell".
33+
- [New] MATCH-S01052 SharePoint Server ToolShell Web Shell Interaction (CVE-2025-53771)
34+
- Exploits against two vulnerabilities in Microsoft SharePoint server, CVE-2025-53770 and CVE-2025-53771, are combined to execute code on Microsoft SharePoint without authentication. This attack has been nicknamed "ToolShell".
35+
- [Updated] MATCH-S00402 Normalized Security Signal
36+
- Adjusted summary to remove `{{device_hostname}}` to avoid `null` values for blank hostnames.
37+
- Added `resource` to entity selector
38+
- [Updated] MATCH-S00061 Zscaler - Allowed Elevated Risk Score Events
39+
- Updated rule expression and severity score to use normalized fields.
40+
41+
### Log Mappers
42+
- [New] AWS Security Hub - OCSF Finding Events
43+
- [New] AWS Security Hub - Application Activity *
44+
- [New] AWS Security Hub - Authentication Event*
45+
- [New] AWS Security Hub - DHCP Activity*
46+
- [New] AWS Security Hub - DNS Activity*
47+
- [New] AWS Security Hub - Discovery Event*
48+
- [New] AWS Security Hub - Email Activity*
49+
- [New] AWS Security Hub - File System events*
50+
- [New] AWS Security Hub - HTTP Activity*
51+
- [New] AWS Security Hub - IAM Account change|Authorize Session|Entity Management|User Access Management|Group Management*
52+
- [New] AWS Security Hub - Kernel Extension Activity|Kernel Activity|Memory Activity|Module Activity|Scheduled Job Activity|Process Activity|Event Log Activity|Script Activity*
53+
- [New] AWS Security Hub - Network Activity|RDP Activity|SMB Activity|SMB Activity|SSH Activity|FTP Activity|NTP Activity|Tunnel Activity|Network Remediation Activity*
54+
- [New] AWS Security Hub - Remediation Activity|Process Remediation Activity*
55+
- [New] AWS Security Hub - Unmanned Systems*
56+
- [New] Citrix NetScaler - AAA-AUTH-REQ
57+
- [New] Palo Alto Audit Authentication logs
58+
- [New] Palo Alto Audit Catch All
59+
- [Updated] AWS Security Hub
60+
- [Updated] Azure Event Hub - Windows Defender Audit file events
61+
- [Updated] Citrix NetScaler - AAA-LOGIN_FAILED
62+
- [Updated] Citrix NetScaler - Command Executed
63+
- [Updated] Citrix NetScaler - MESSAGE
64+
- [Updated] Citrix NetScaler - SSL Handshake Success
65+
- [Updated] Citrix NetScaler - SSLVPN-LOGIN
66+
- [Updated] Keeper Authentication
67+
- [Updated] Keeper Catch All
68+
- [Updated] Mimecast AV Event
69+
- [Updated] Mimecast Email logs
70+
- [Updated] Linux-Sysmon/Operational - 11
71+
- Added more normalized fields
72+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 11
73+
- Added more normalized fields.
74+
- [Updated] Zscaler - Nanolog Streaming Service - JSON
75+
- Added normalizedAction for allow/deny actions and alternate values for IPs.
76+
77+
\* Security Hub via OCSF is currently limited to the OCSF Findings category. Additional mappers are in place to support potential future Security Hub events that utilize other OCSF categories and classes. These can be cloned and repurposed to support additional sources of data which use OCSF.
78+
79+
### Parsers
80+
- [Deleted] /Parsers/System/Mindpoint Group/Mindpoint SurePass
81+
- Updated erroneous vendor name in parser.
82+
- Any existing references to this parser path will need to be updated to the new parser path.
83+
- [New] /Parsers/System/Keeper/Keeper
84+
- New parser for Keeper with correct vendor name.
85+
- [New] /Parsers/System/OCSF/OCSF
86+
- [New] /Parsers/System/SurePass/SurePass
87+
- New parser path for Surepass to reflect correct vendor name.
88+
- [Updated] /Parsers/System/Mindpoint Group/Mindpoint Group Keeper
89+
- Updated parser to point to new parser path with correct vendor name.
90+
- [Updated] /Parsers/System/Microsoft/Office 365
91+
- Updated to fix issue with `normalizedLogon` field not being populated correctly.
92+
- [Updated] /Parsers/System/Citrix/Citrix NetScaler Syslog
93+
- Updated header regex, added support for new events, and added new time format.
94+
- [Updated] /Parsers/System/Palo Alto/PAN Firewall CSV
95+
- Updated to handle new log formats and fields.
96+
97+
### Schema
98+
- [Updated] resource
99+
- Enables `resource` as an entity.

‎blog-service/2025-07-28-alerts.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: Time range limits for subqueries in scheduled searches (Alerts)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- alerts
6+
- scheduled searches
7+
- subqueries
8+
hide_table_of_contents: true
9+
---
10+
11+
We've introduced time range limits for subqueries in scheduled searches. This change helps you prevent long-running, inefficient queries, especially those impacting system stability and that drive up costs. While maintaining flexibility, these optimizations protect system health and reduce operational overhead.
12+
13+
Key benefits of this enhancements include:
14+
15+
- Improved query performance and responsiveness.
16+
- Encourage efficient search practices.
17+
- Support sustainable resource usage.
18+
19+
[Learn more](/docs/alerts/scheduled-searches/schedule-search/#step-3-time-range).

‎blog-service/2025-07-31-apps.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: Apps, Solutions, and Collection Integrations - July Release
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- apps
6+
- july-release
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
### Enhancements
13+
14+
- **Updated the following OpenTelemetry apps**:
15+
- [Oracle - OpenTelemetry](/docs/integrations/databases/opentelemetry/oracle-opentelemetry/). Updated the dashboards and monitors with new metrics.
16+
- [SQL Server - OpenTelemetry](/docs/integrations/microsoft-azure/opentelemetry/sql-server-opentelemetry/). Fixed the collection form bug.
17+
- [SQL Server for Linux - OpenTelemetry](/docs/integrations/microsoft-azure/opentelemetry/sql-server-linux-opentelemetry/):
18+
- Updated the dashboards and monitors with new metrics.
19+
- The app now supports metric collection from both Windows and Linux environments.
20+
- **Updated the following Webhook app**:
21+
- Updated the event types for [Sentry](/docs/integrations/webhooks/sentry/).

‎blog-service/2025-07-31-collection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: OneLogin Source (Collection)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- c2c
6+
- onelogin-source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to announce the release of our new cloud-to-cloud source for OneLogin. This source aims to collect the user list logs from the OneLogin API and send it to Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/onelogin-source).

‎blog-service/2025-08-01-collection.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: Cloud Syslog Source Certificate Transition to ACM (Collection)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- certificates
6+
- Cloud Syslog Source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to announce that we are transitioning to AWS Certificate Manager (ACM) certificates for Transport Layer Security (TLS) communication between your cloud syslog sources and Sumo Logic.
13+
14+
Currently, Sumo Logic uses a DigiCert ALB certificate to secure communication with your cloud syslog sources. This certificate is set to expire on October 13, 2025, at which point Sumo Logic will transition to the ACM root certificates. This change provides the following benefits:
15+
* **Automated certificate renewal and deployment**. ACM eliminates the need for future manual renewals, reducing administrative overhead.
16+
* **Simplified infrastructure management for AWS customers**. ACM is deeply integrated into the AWS ecosystem, streamlining your overall infrastructure management. Because Sumo Logic is also on AWS, using ACM provides a seamless experience.
17+
18+
If you use cloud syslog sources to send data to Sumo Logic, please prepare for this transition by downloading and configuring the ACM certificate on your system. For more information and setup instructions, see:
19+
* [Cloud Syslog Source](/docs/send-data/hosted-collectors/cloud-syslog-source/)
20+
* [rsyslog](/docs/send-data/hosted-collectors/cloud-syslog-source/rsyslog)
21+
* [syslog-ng](/docs/send-data/hosted-collectors/cloud-syslog-source/syslog-ng/)
22+
* [Collect Logs for SentinelOne](/docs/send-data/collect-from-other-data-sources/collect-logs-sentinelone/)
23+
* [Acquia](/docs/integrations/saas-cloud/acquia/#step-2-configure-a-source)

‎blog-service/2025-08-04-apps.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: AWS Security Hub - OCSF (Apps)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- apps
6+
- aws-security-hub
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to introduce the new AWS Security Hub - OCSF app for Sumo Logic, which enables you to gain real-time visibility into your security hub findings data. This app can help security teams identify threats, track compliance violations, and investigate affected resources with speed and clarity. [Learn more](/docs/integrations/cloud-security-monitoring-analytics/aws-security-hub-ocsf).

‎blog-service/2025-08-07-collection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: AWS IAM Users Source (Collection)
3+
image: https://help.sumologic.com/img/reuse/rss-image.jpg
4+
keywords:
5+
- c2c
6+
- aws-iam-users-source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to announce the release of our new cloud-to-cloud source for AWS IAM Users. This source collects the IAM User Inventory logs from the AWS SDK and sends them to Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/aws-iam-users-source).

‎blog-service/2025-08-08-collection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: GitHub Copilot Source (Collection)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- c2c
6+
- github-copilot-source
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
We're excited to announce the release of our new cloud-to-cloud source for GitHub Copilot. This source aims to collect the organization and team metrics logs from the Copilot platform and send them to Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/github-copilot-source).

0 commit comments

Comments
 (0)