Skip to content

Commit b8e3b44

Browse files
authored
DOCS-612 - Update suppressed lists (#5008)
* DOCS-612 - Update suppressed lists * Update screenshot
1 parent 993788f commit b8e3b44

File tree

5 files changed

+10
-10
lines changed

5 files changed

+10
-10
lines changed

docs/cse/match-lists-suppressed-lists/suppressed-lists.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@ Cloud SIEM supports several types of [signal suppression](/docs/cse/records-sign
1414

1515
You can create suppressed lists from the Cloud SIEM UI or using the Cloud SIEM API. A suppressed list can contain a set of indicators—IPs, hostnames, or any other type that you can use in a match list—and then any signal that has a record containing a listed indicator will be suppressed. 
1616

17-
Here is an example of a suppressed list.
17+
Here are some sample suppressed lists:
1818

1919
<img src={useBaseUrl('img/cse/suppressed-list.png')} alt="Suppressed list" style={{border: '1px solid gray'}} width="800"/>
2020

21-
Note that the list has a **Target Column**, which you define when you create the list. The target column indicates what type of record fields should be compared to the suppressed list, for example, hostnames, URLs, domains, IP addresses, usernames, and so on. For more information, see [How are suppressed lists used](#how-are-suppressed-lists-used).
21+
Note that each suppressed list has a **Target Column**, which you define when you create the list. The target column indicates what type of record fields should be compared to the suppressed list, for example, hostnames, URLs, domains, IP addresses, usernames, and so on. For more information, see [How are suppressed lists used](#how-are-suppressed-lists-used).
2222

2323
When you create a suppressed list, you can choose one of the following as its target column.
2424

@@ -75,24 +75,24 @@ A suppressed list can contain up to 50,000 items.
7575
Perform the steps below to create a suppressed list and add an indicator to it using the Cloud SIEM UI.
7676

7777
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Content > Suppressed Lists**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Suppressed Lists**. You can also click the **Go To...** menu at the top of the screen and select **Suppressed Lists**.
78-
1. Click **Create**. <br/><img src={useBaseUrl('img/cse/suppressed-lists.png')} alt="Create a suppressed list" style={{border: '1px solid gray'}} width="800"/>
79-
1. On the **New Suppressed List** popup, enter the following:
78+
1. Click **Add Suppressed List**. <br/><img src={useBaseUrl('img/cse/suppressed-lists.png')} alt="Create a suppressed list" style={{border: '1px solid gray'}} width="800"/>
79+
1. On the **Add Suppressed List** popup, enter the following:
8080
1. **Name**. Name of the suppressed list.
8181
1. **Description**. Enter a description for the list. 
82-
1. **Time to Live (hours)**. (Optional) Enter the number of hours after which the entries on the list should expire.
8382
1. **Target Column**. The type of record field to which items on the list should be compared.
8483
:::note
8584
If you want to create a custom target column, click **Manage Custom Columns**. For more information, see [Custom Match List Columns](/docs/cse/match-lists-suppressed-lists/custom-match-list-columns).
8685
:::
87-
1. Click **Create**.
86+
1. **Time to Live (hours)**. (Optional) Enter the number of hours after which the entries on the list should expire.
87+
1. Click **Save**.
8888
1. The suppressed list now appears on the **Suppressed Lists** page.
8989
1. Click the name of the suppressed list to open it.
90-
1. On the **Suppressed List > Details** page, click **Add List Item**. <br/><img src={useBaseUrl('img/cse/add-list-item.png')} alt="Add list item" style={{border: '1px solid gray'}} width="800"/>
91-
1. On the **New Suppressed List Item** popup, enter:
90+
1. On the **Suppressed List > Details** page, click **Add Suppressed List Item**. <br/><img src={useBaseUrl('img/cse/add-list-item.png')} alt="Add list item" style={{border: '1px solid gray'}} width="800"/>
91+
1. On the **Add Suppressed List Item** popup, enter:
9292
1. **Value**. The value of the entity. Make sure the value you enter is of the same type as the type you selected as the target column for the list. For example, if the target column is Domain, enter a domain.
9393
1. **Description**. (Optional) Enter a description of the list item.
9494
1. **Expiration**. (Optional) The date and time at which the list item should be removed from the list.
95-
1. Click **Add** to add the item to the list.
95+
1. Click **Save** to add the item to the list.
9696
1. The item now appears on the list.
9797

9898
## Import a list of indicators 
@@ -127,7 +127,7 @@ specified:
127127
### Upload file 
128128

129129
1. On the **Suppressed Lists** page, click the name of the list.
130-
1. Click **Import Indicators**.
130+
1. Click **Import Items**.
131131
1. On the import popup:
132132
1. Drag your file onto the import popup, or click to navigate to the file, and then click Import.
133133
1. Optionally, you can enter an expiration for the indicators on the list. If you do, it will override any expirations that are defined in the file. Enter the expiration in any ISO date format. For example: `2022-12-31`

static/img/cse/add-list-item.png

-13.9 KB
Loading

static/img/cse/suppressed-list.png

-82.7 KB
Loading
-9.57 KB
Loading
12.1 KB
Loading

0 commit comments

Comments
 (0)