Merge branch 'main' into apm-corrections

Author: kimsauce

blog-cse/2025-01-14-content.md

@@ -20,7 +20,7 @@ This content release includes:
 In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from the out-of-the-box Cloud SIEM rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion.
 :::
 
-## Log Mappers
+### Log Mappers
 - [New] Azure DevOps Auditing Catch All
 - [New] Check Point Application Control URL Filtering
 - [New] Cisco ISE Radius Diagnostics
@@ -40,15 +40,15 @@ In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted
 - [Updated] Cloudflare - Logpush
     - Adds mapping for `dns_query`, `http_hostname`, `http_response_contentLength`, `http_response_contentType`, and an alternative value for `ipProtocol`.
 - [Updated] Linux OS Syslog - Process sshd - SSH Session Closed|disconnect
-    - Adds mapping for `normalizedActio`n
+    - Adds mapping for `normalizedAction`
 - [Updated] Linux OS Syslog - Process systemd - Systemd Session Start and Systemd File Configuration
     - Added support for additional events and mapping of `file_path`
 
-## Parsers
+### Parsers
 - [New] /Parsers/System/Pfsense/Pfsense Firewall
 - [Updated] /Parsers/System/Check Point/Check Point Firewall JSON
 - [Updated] /Parsers/System/Cisco/Cisco ISE
 - [Updated] /Parsers/System/Cloudflare/Cloudflare Logpush
 - [Updated] /Parsers/System/Linux/Linux OS Syslog
 - [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers
-- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers
+- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers

blog-cse/2025-01-28-content.md

@@ -0,0 +1,26 @@
+---
+title: January 28, 2025 - Content Release
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - log mappers
+  - parsers
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-cse/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+This content release includes:
+- Fix to Azure DevOps Auditing mapper to ensure only Azure DevOps logs are mapped by it when ingested via Event Hubs C2C.
+- Adds parsing and mapping support for additional OpenVPN events.
+- Adds additional timestamp format handling to Azure JSON log parsing.
+
+### Log Mappers
+- [Updated] Azure DevOps Auditing Catch All
+- [Updated] OpenVPN Audit Event
+- [Updated] OpenVPN Network Event
+
+### Parsers
+- [Updated] /Parsers/System/Microsoft/Microsoft Azure JSON
+- [Updated] /Parsers/System/OpenVPN/OpenVPN Syslog

blog-service/2025-01-28-apps.md

@@ -0,0 +1,14 @@
+---
+title: VMware Workspace ONE (Apps)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - apps
+  - vmware-workspace-one
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+We're excited to introduce the new VMware Workspace ONE app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud VMware Workspace ONE source that collects audit logs data from the VMware Workspace ONE platform. This app helps security analysts monitor device compliance, encryption, and overall security status, offering a powerful solution for effective risk analysis, policy enforcement, and device security. [Learn more](/docs/integrations/saas-cloud/vmware-workspace-one/).

cid-redirects.json

@@ -1602,6 +1602,7 @@
   "/cid/10207": "/docs/integrations/saas-cloud/symantec-endpoint-security-service",
   "/cid/10197": "/docs/integrations/saas-cloud/symantec-web-security-service",
   "/cid/6016": "/docs/integrations/saas-cloud/trend-micro-vision-one",
+  "/cid/6024": "/docs/integrations/saas-cloud/vmware-workspace-one",
   "/cid/10112": "/docs/integrations/app-development/jfrog-xray",
   "/cid/10113": "/docs/observability/root-cause-explorer",
   "/cid/10116": "/docs/manage/fields",

docs/api/search-job.md

@@ -620,7 +620,7 @@ The metadata fields `_sourceHost`, `_sourceName`, and `_sourceCategory`, which a
 ### Page through the records found by a Search Job
 
 <details>
-<summary><span className="api get">GET</span><code>/v1/search/jobs/&#123;SEARCH_JOB_ID&#125;/records?offset=&#123;OFFSET]&limit=&#123;LIMIT&#125;</code></summary>
+<summary><span className="api get">GET</span><code>/v1/search/jobs/&#123;SEARCH_JOB_ID&#125;/records?offset=&#123;OFFSET&#125;&limit=&#123;LIMIT&#125;</code></summary>
 <p/>
 
 The search job status informs the user as to the number of produced records, if the query performs an aggregation. Those records can be requested using a paging API call (step 6 in the process flow), just as the message can be requested.

docs/integrations/product-list/product-list-m-z.md

@@ -203,7 +203,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
 | <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/vectra.png')} alt="Thumbnail icon" width="75"/> | [Vectra](https://www.vectra.ai/) | Automation integration: [Vectra](/docs/platform-services/automation-service/app-central/integrations/vectra/) <br/>Cloud SIEM integration: [Vectra](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/7a3d1a5c-ba67-4597-971f-7057e8f6c8bb.md) |
 | <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/virustotal.png')} alt="Thumbnail icon" width="75"/> | [VirusTotal](https://www.virustotal.com/) | Automation integration: [VirusTotal](/docs/platform-services/automation-service/app-central/integrations/virustotal/) |
 | <img src={useBaseUrl('img/platform-services/automation-service/app-central/logos/vmray.png')} alt="Thumbnail icon" width="75"/> | [VMRay](https://www.vmray.com/) | Automation integration: [VMRay](/docs/platform-services/automation-service/app-central/integrations/vmray/) |
-|  <img src={useBaseUrl('img/integrations/containers-orchestration/vmware.png')} alt="Thumbnail icon" width="50"/>   | [VMware](https://www.vmware.com/)  | 	Apps: <br/>- [Carbon Black Cloud](/docs/integrations/security-threat-detection/carbon-black-cloud/)  <br/>- [VMware](/docs/integrations/containers-orchestration/vmware/) <br/>- [VMware Legacy](/docs/integrations/containers-orchestration/vmware-legacy/)	<br/>- [VMware Carbon Black](/docs/integrations/security-threat-detection/vmware-carbon-black/) <br/>- [VMWare - OpenTelemetry Collector](/docs/integrations/containers-orchestration/opentelemetry/vmware-opentelemetry/) <br/>Automation integrations: <br/>- [Lastline Analyst](/docs/platform-services/automation-service/app-central/integrations/lastline-analyst/) <br/>- [VMware Carbon Black Cloud Endpoint Standard](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-endpoint-standard/) <br/>- [VMware Carbon Black Cloud Endpoint Standard V2](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-endpoint-standard-v2/) <br/>- [VMware Carbon Black Cloud Enterprise EDR](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-enterprise-edr/) <br/>- [VMware Carbon Black Cloud Platform](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-platform/) <br/>- [VMware vSphere](/docs/platform-services/automation-service/app-central/integrations/vmware-vsphere/) <br/>- [VMware Workspace ONE](/docs/platform-services/automation-service/app-central/integrations/vmware-workspace-one/) <br/>Cloud SIEM integrations: <br/>- [Carbon Black](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/c2ea2e5e-92f2-49e8-9812-64e60dba63a2.md) <br/>- [VMware](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/fbf25b91-89f1-45c4-903d-664b328bc6e0.md) <br/>Collectors: <br/>- [Carbon Black Cloud Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source/) <br/>- [Carbon Black Inventory Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source/) <br/>- [Carbon Black Cloud - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black/)<br/>- [Collect Metrics from VMware vRealize Operations Manager 8 Enterprise](/docs/send-data/collect-from-other-data-sources/collect-metrics-vrealize-operations-manager/) <br/>- [VMware AirWatch Integration for Sumo Logic](/docs/send-data/collect-from-other-data-sources/vmware-airwatch-integration/)	<br/>- [VMware vRealize Log Insight](/docs/send-data/collect-from-other-data-sources/vmware-vrealize-log-insight/)<br/>- [VMware Workspace One Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/vmware-workspace-one-source/) <br/>Partner integration: [VMware Tanzu](https://docs.vmware.com/en/Sumo-Logic-Nozzle-for-VMware-Tanzu/services/sumologic-nozzle-vmware-tanzu/index.html) |
+|  <img src={useBaseUrl('img/integrations/containers-orchestration/vmware.png')} alt="Thumbnail icon" width="50"/>   | [VMware](https://www.vmware.com/)  | 	Apps: <br/>- [Carbon Black Cloud](/docs/integrations/security-threat-detection/carbon-black-cloud/)  <br/>- [VMware](/docs/integrations/containers-orchestration/vmware/) <br/>- [VMware Legacy](/docs/integrations/containers-orchestration/vmware-legacy/)	<br/>- [VMware Carbon Black](/docs/integrations/security-threat-detection/vmware-carbon-black/) <br/>- [VMWare - OpenTelemetry Collector](/docs/integrations/containers-orchestration/opentelemetry/vmware-opentelemetry/) <br/>- [VMware Workspace ONE](/docs/integrations/saas-cloud/vmware-workspace-one/) <br/>Automation integrations: <br/>- [Lastline Analyst](/docs/platform-services/automation-service/app-central/integrations/lastline-analyst/) <br/>- [VMware Carbon Black Cloud Endpoint Standard](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-endpoint-standard/) <br/>- [VMware Carbon Black Cloud Endpoint Standard V2](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-endpoint-standard-v2/) <br/>- [VMware Carbon Black Cloud Enterprise EDR](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-enterprise-edr/) <br/>- [VMware Carbon Black Cloud Platform](/docs/platform-services/automation-service/app-central/integrations/vmware-carbon-black-cloud-platform/) <br/>- [VMware vSphere](/docs/platform-services/automation-service/app-central/integrations/vmware-vsphere/) <br/>- [VMware Workspace ONE](/docs/platform-services/automation-service/app-central/integrations/vmware-workspace-one/) <br/>Cloud SIEM integrations: <br/>- [Carbon Black](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/c2ea2e5e-92f2-49e8-9812-64e60dba63a2.md) <br/>- [VMware](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/fbf25b91-89f1-45c4-903d-664b328bc6e0.md) <br/>Collectors: <br/>- [Carbon Black Cloud Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source/) <br/>- [Carbon Black Inventory Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source/) <br/>- [Carbon Black Cloud - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/carbon-black/)<br/>- [Collect Metrics from VMware vRealize Operations Manager 8 Enterprise](/docs/send-data/collect-from-other-data-sources/collect-metrics-vrealize-operations-manager/) <br/>- [VMware AirWatch Integration for Sumo Logic](/docs/send-data/collect-from-other-data-sources/vmware-airwatch-integration/)	<br/>- [VMware vRealize Log Insight](/docs/send-data/collect-from-other-data-sources/vmware-vrealize-log-insight/)<br/>- [VMware Workspace One Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/vmware-workspace-one-source/) <br/>Partner integration: [VMware Tanzu](https://docs.vmware.com/en/Sumo-Logic-Nozzle-for-VMware-Tanzu/services/sumologic-nozzle-vmware-tanzu/index.html) |
 |  <img src={useBaseUrl('img/integrations/misc/votiro-logo.png')} alt="Thumbnail icon" width="50"/>   |  [Votiro](https://votiro.com/) | Partner integration: [Votiro](https://github.com/SumoLogic/sumologic-public-partner-apps/tree/master/Votiro#votiro)	 |
 
 ## W

docs/integrations/saas-cloud/index.md

@@ -327,6 +327,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.
   <p>Analyze alert logs to detect potential security risks.</p>
   </div>
 </div>
+<div className="box smallbox card">
+  <div className="container">
+  <a href="/docs/integrations/saas-cloud/vmware-workspace-one"><img src={useBaseUrl('img/send-data/vmware_workspace_one.png')} alt="icon" width="100"/><h4>VMware Workspace ONE</h4></a>
+  <p>Analyze device compliance, encryption, and security status to spot risks and keep devices secure.</p>
+  </div>
+</div>
 <div className="box smallbox card">
   <div className="container">
   <a href="/docs/integrations/saas-cloud/webex"><img src={useBaseUrl('img/send-data/webex-logo.png')} alt="icon" width="70"/><h4>Webex</h4></a>