You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: blog-service/2024-05-13-apps.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,15 +16,15 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
16
16
We're excited to announce increased visibility into your AWS Cloud environment with the following new features:
17
17
***Out-of-the-box security policy checks**. Sumo Logic Cloud Infrastructure Security is now configured by default to use the out-of-the box policy checks. You can now choose to leverage the out-of-the-box policy checks instead of, or in conjunction with, the policy checks provided by AWS Security Hub.
18
18
***Additional investigation capabilities**. The update includes the addition of three new dashboards:
19
-
*[**Infrastructure Overview**](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#infrastructure-overview). Get deep visibility into your cloud infrastructure to understand how many cloud resources are running and their configurations.
20
-
*[**Security Control Failures Overview**](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#security-control-failures-overview). See misconfigurations in your environment that may leave you vulnerable to attackers.
21
-
*[**Security Control Failures Investigation**](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#security-control-failures-investigation). Navigate and prioritize the most important misconfigurations in your environment.
19
+
***Infrastructure Overview**. Get deep visibility into your cloud infrastructure to understand how many cloud resources are running and their configurations.
20
+
***Security Control Failures Overview**. See misconfigurations in your environment that may leave you vulnerable to attackers.
21
+
***Security Control Failures Investigation**. Navigate and prioritize the most important misconfigurations in your environment.
22
22
***AI-powered remediation plans**. You can now use automated remediation playbooks built specifically for Cloud Infrastructure Security for AWS.
23
23
24
24
This functionality is in preview. To participate, reach out to your Sumo Logic account executive.
As part of the preview, you can use CloudQuery logs with Cloud Infrastructure Security for AWS. To use the logs, configure the CloudQuery source when you [deploy the solution](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#step-3-deploy-aws).
29
+
As part of the preview, you can use CloudQuery logs with Cloud Infrastructure Security for AWS. To use the logs, configure the CloudQuery source when you deploy the solution.
We're excited to introduce the new Atlassian app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Atlassian source to collect events logs through the Events API, helping you to to monitor critical events such as user activities, policy changes, group and API token creations, and product access.
15
+
16
+
Explore our technical documentation [here](/docs/integrations/saas-cloud/atlassian/) to learn how to set up and use the Atlassian app for Sumo Logic.
We're happy to announce enhancements to Cloud Infrastructure for AWS. These capabilities were [previously only available in a preview form](/release-notes-service/2024/05/13/apps/). They are now available for general use.
17
+
18
+
You can now more easily configure sources on a simplified screen, allowing you to use existing sources or create new sources.
Copy file name to clipboardExpand all lines: docs/alerts/webhook-connections/cloud-soar.md
+38-8Lines changed: 38 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,14 +16,44 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
16
16
* You'll need the **Manage connections**[role capability](/docs/manage/users-roles/roles/role-capabilities) to create webhook connections.
17
17
:::
18
18
19
-
To create a webhook connection from Sumo Logic to Cloud SOAR:
19
+
You can configure a webhook connection to allow you to send an alert from a scheduled search to Sumo Logic Cloud SOAR using an incident template.
20
20
21
21
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Connections**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Monitoring** select **Connections**. You can also click the **Go To...** menu at the top of the screen and select **Connections**.
22
-
1. Click **+ Add** and choose **Cloud SOAR** as the connection type.<br/> <img src={useBaseUrl('img/connection-and-integration/SOAR-webhook-icon.png')} alt="SOAR webhook icon.png" width="200"/>
23
-
1. Enter a **Name** and give an optional **Description** to the connection.
24
-
1. The **URL** and **Authorization Header** are automatically defined by Sumo Logic. You should not edit these.
25
-
1. The **Templates** dropdown shows a list of all incident templates, by name, configured in your Cloud SOAR environment.
26
-
1. The default **Payload** synchronizes with the selected template and the associated `template_id` field is automatically defined in the default payload. A `template_id` is required in the payload in order to configure the connection. For details on variables you can use as parameters within your JSON object, see [Webhook Payload Variables](set-up-webhook-connections.md).
27
-
1. Click **Save**.
22
+
1. Click **+** and choose **Cloud SOAR** as the connection type. The **Create Cloud SOAR Connection** dialog is displayed.<br/><img src={useBaseUrl('img/cloud-soar/CSOAR-connection1.png')} alt="New connection" style={{border: '1px solid gray'}} width="600"/>
23
+
1. Enter a **Name** and give an optional **Description** to the connection.
24
+
1. The **URL** field shows your [Sumo Logic API endpoint](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security) followed by `/csoar/v3/incidents/`. For example, `https://api.us2.sumologic.com/api/csoar/v3/incidents/`
25
+
1. In **Authorization Header**, enter your basic authentication access information for the header. For example, `Basic <base64 encode <accessId>:<accessKey>>`. For more information, see [Basic Access (Base64 encoded)](/docs/api/getting-started#basic-access-base64-encoded).
26
+
1. Click **Save**. After save, the **Templates** dropdown shows a list of all incident templates by name configured in your Cloud SOAR environment.
27
+
1. Select a **Template**.
28
+
1. The default payload synchronizes with the selected template, and the **Alert Payload** field shows the associated `template_id` field automatically defined in the default payload. A `template_id` is required in the payload in order to configure the connection:
29
+
30
+
```
31
+
{
32
+
"template_id": <Template ID>,
33
+
"fields": {
34
+
"incidentid": "Incident Id"
35
+
}
36
+
}
37
+
```
28
38
29
-
For more detailed instructions, see [Configure a webhook for Cloud SOAR](/docs/cloud-soar/automation/#configure-a-webhook-for-cloud-soar).
39
+
You can add additional variables. For example:
40
+
41
+
```
42
+
{
43
+
"fields": {
44
+
"description": "string",
45
+
"additional_info": "string",
46
+
"starttime": "ISO-8601 datetime string",
47
+
"incident_kind": <ID incident kind>,
48
+
"incident_category": <ID incident category>,
49
+
"status": <ID incident status>,
50
+
"restriction": <ID incident restriction>
51
+
}
52
+
}
53
+
```
54
+
:::note
55
+
* For details on variables you can use as parameters within your JSON object, see [Configure Webhook Payload Variables](/docs/alerts/webhook-connections/set-up-webhook-connections/#configure-webhook-payload-variables).
56
+
* For information on additional fields, please refer to the [Cloud SOAR APIs](/docs/api/cloud-soar/) documentation.
57
+
* The preceding example shows an `ISO-8601 datetime string`. For information about how to configure it, see [parser documentation](https://dateutil.readthedocs.io/en/stable/parser.html#dateutil.parser.isoparse).
0 commit comments