Merge branch 'main' into 404s

Author: kimsauce

.clabot

@@ -172,7 +172,8 @@
     "chetanchoudhary-sumo",
     "JamoCA",
     "darshan-sumo",
-    "mahendrak-sumo"
+    "mahendrak-sumo",
+    "chvik"
   ],
   "message": "Thank you for your contribution! As this is an open source project, we require contributors to sign our Contributor License Agreement and do not have yours on file. To proceed with your PR, please [sign your name here](https://forms.gle/YgLddrckeJaCdZYA6) and we will add you to our approved list of contributors.",
   "label": "cla-signed",

blog-cse/2024/12-31.md

@@ -16,6 +16,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 This is an archive of 2024 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive).
 
+<!--truncate-->
+
 ---
 ### December 20, 2024 - Content Release
 
@@ -852,7 +854,7 @@ Other changes are enumerated below.
 
 This release reverts a change to our AWS CloudTrail default (catch all) mapper for how `user_username` is mapped. This is being reverted due to reports of breaking rule tuning and missing user context for some `AssumedRole` events.
 
-AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](/release-notes-cse/#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.
+AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.
 
 AWS best practices suggest defining `sourceIdentity` to allow for the originating user for a role assumption to be identifiable. This is the best path to avoid false positive generation, as our mapper will favor `sourceIdentity` if it is present in CloudTrail logs. If it is not present, then `userIdentity.arn` will be used and the `resource-id` will be mapped to `user_username`, creating potential for false positives from dynamic session identifiers. See [Viewing source identity in CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-ct) in the AWS documentation for more information.
 

blog-cse/2025-01-14-content.md

@@ -0,0 +1,54 @@
+---
+title: January 14, 2025 - Content Release
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - rules
+  - log mappers
+  - parsers
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-cse/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+This content release includes:
+- Parsing and mapping support for Azure DevOps Auditing via EventHubs, and Pfsense Firewall.
+- Parsing and mapping additions and updates for Cisco ISE, Cloudflare, Check Point Firewall, and Linux OS Syslog.
+
+:::note
+In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from the out-of-the-box Cloud SIEM rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion.
+:::
+
+## Log Mappers
+- [New] Azure DevOps Auditing Catch All
+- [New] Check Point Application Control URL Filtering
+- [New] Cisco ISE Radius Diagnostics
+- [New] Linux OS Syslog - KRB5 Child - Authentication Failure
+- [New] Linux OS Syslog - Process systemd - Systemd Session
+- [New] Linux OS Syslog - Process systemd - Systemd Session Scope
+- [New] Linux OS Syslog - Process systemd - session logout
+- [New] Pfsense Firewall filterlog
+- [New] Pfsense Firewall nginx
+- [New] Pfsense Firewall openvpn Authentication
+- [New] Pfsense Firewall openvpn_peer_info|openvpn_error|php_log|sshguard|sshd_log
+- [New] Pfsense Firewall openvpn_server_connected|openvpn_server_disconnected|cron_log
+- [Updated] Cisco ISE Authentication Failure
+    - Adds `normalizedSeverity` mapping
+- [Updated] Cisco ISE Authentication Success
+    - Adds `normalizedSeverity` mapping
+- [Updated] Cloudflare - Logpush
+    - Adds mapping for `dns_query`, `http_hostname`, `http_response_contentLength`, `http_response_contentType`, and an alternative value for `ipProtocol`.
+- [Updated] Linux OS Syslog - Process sshd - SSH Session Closed|disconnect
+    - Adds mapping for `normalizedActio`n
+- [Updated] Linux OS Syslog - Process systemd - Systemd Session Start and Systemd File Configuration
+    - Added support for additional events and mapping of `file_path`
+
+## Parsers
+- [New] /Parsers/System/Pfsense/Pfsense Firewall
+- [Updated] /Parsers/System/Check Point/Check Point Firewall JSON
+- [Updated] /Parsers/System/Cisco/Cisco ISE
+- [Updated] /Parsers/System/Cloudflare/Cloudflare Logpush
+- [Updated] /Parsers/System/Linux/Linux OS Syslog
+- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers
+- [Updated] /Parsers/System/Linux/Shared/Linux Shared Syslog Headers

blog-csoar/2024/12-31.md

@@ -14,6 +14,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 This is an archive of 2024 Cloud SOAR release notes. To view the full archive, [click here](/release-notes-csoar/archive).
 
+<!--truncate-->
+
 ---
 ### December 31, 2024 - Application Update
 
@@ -312,7 +314,7 @@ This release introduces three new integrations, as well as several updates.
 ---
 ### March 12, 2024 - Content Release
 
-Our Cloud SOAR [application update](/release-notes-csoar/#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.
+Our Cloud SOAR [application update](#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.
 
 The Python upgrade impacts a total of 38 integrations. These integrations will require updates to ensure compatibility with the new Python version.
 
@@ -369,7 +371,7 @@ We strongly encourage all users to review the provided documentation and prepare
 ### March 12, 2024 - Application Update
 
 #### Changes and Enhancements
-* Python version updated. If you experience any issues, refer to our [content release note](/release-notes-csoar/#march-12-2024---content-release).
+* Python version updated. If you experience any issues, refer to our [content release note](#march-12-2024---content-release).
 
 ##### Cloud SOAR
 * Playbooks: Test feature now permits you to use internal Incident ID.

blog-service/2025-01-08-otel-remote-management.md

@@ -0,0 +1,23 @@
+---
+title: Remote Management for OpenTelemetry Collector (Collection)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - collection
+  - opentelemetry
+  - otel
+  - remote-management
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+The Sumo Logic Distribution for OpenTelemetry Collector now supports remote management, enabling you to configure and manage data collection directly from the Sumo Logic UI. With this feature, you can:  
+
+* **Simplify configuration**. Set up and manage data collection for multiple collectors without server access.  
+* **Streamline workflows**. Use tags to group collectors and apply centralized data source templates, reducing redundancy and manual effort.  
+* **Enhance automation**. Automatically monitor new servers by tagging them during setup.  
+* **Accelerate time to value**. Start collecting data in minutes with an intuitive UI and no need to manage configuration files.  
+
+This release provides a faster, more efficient way to manage large-scale data collection, supporting scalable and automated operations. [Learn more](/docs/send-data/opentelemetry-collector/remote-management).  

blog-service/2025-01-10-apps.md

@@ -0,0 +1,18 @@
+---
+title: New SaaS and Cloud Apps Release (Apps)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+  - apps
+  - symantec-endpoint-security-service
+  - jamf
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<a href="https://help.sumologic.com/release-notes-service/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>
+
+- **Symantec Endpoint Security Service**. We're excited to introduce the new Symantec Endpoint Security Service app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Symantec Endpoint Security source that collects incident and event logs data from the Symantec Endpoint Security platform. This app provides real-time insights into the log data that allows you to monitor and manage endpoint security in real time, enhancing quick responses to threats. [Learn more](/docs/integrations/saas-cloud/symantec-endpoint-security-service/).
+
+- **Jamf**. We're excited to introduce the new Jamf app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud Jamf source that collects inventory data from the Jamf platform. This app helps security analysts with critical insights into their organization's Jamf environment. [Learn more](/docs/integrations/saas-cloud/jamf/).
+

cid-redirects.json

@@ -1578,6 +1578,7 @@
   "/cid/10111": "/docs/integrations/app-development/jfrog-xray",
   "/cid/10188": "/docs/integrations/saas-cloud/miro",
   "/cid/10187": "/docs/integrations/saas-cloud/digital-guardian-arc",
+  "/cid/10114": "/docs/integrations/saas-cloud/jamf",
   "/cid/10208": "/docs/integrations/saas-cloud/cisco-meraki-c2c",
   "/cid/10209": "/docs/integrations/security-threat-detection/cisco-meraki",
   "/cid/10210": "/docs/integrations/saas-cloud/proofpoint-tap",
@@ -1595,6 +1596,7 @@
   "/cid/10198": "/docs/integrations/saas-cloud/microsoft-graph-azure-ad-reporting",
   "/cid/10193": "/docs/integrations/saas-cloud/asana",
   "/cid/10181": "/docs/integrations/saas-cloud/atlassian",
+  "/cid/10207": "/docs/integrations/saas-cloud/symantec-endpoint-security-service",
   "/cid/10197": "/docs/integrations/saas-cloud/symantec-web-security-service",
   "/cid/6016": "/docs/integrations/saas-cloud/trend-micro-vision-one",
   "/cid/10112": "/docs/integrations/app-development/jfrog-xray",
@@ -1885,6 +1887,7 @@
   "/cid/2008": "/docs/send-data/installed-collectors/linux",
   "/cid/2009": "/docs/search/behavior-insights/logcompare",
   "/cid/2010": "/docs/search/search-query-language/search-operators/if",
+  "/cid/2110": "/docs/search/search-query-language/search-operators/macro",
   "/cid/2011": "/docs/get-started/help",
   "/cid/2012": "/docs/manage/security/enable-support-account",
   "/cid/2013": "/docs/send-data/installed-collectors/sources/windows-active-directory-inventory-source",
@@ -2674,7 +2677,7 @@
   "/cid/9008": "/docs/alerts/webhook-connections/new-relic",
   "/cid/10333": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules",
   "/cid/10334": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules/include-and-exclude-rules",
-  "/cid/10335": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules/metrics-include-and-exclude-rules",
+  "/cid/10335": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules/include-and-exclude-rules",
   "/cid/10336": "/docs/send-data/opentelemetry-collector/remote-management/processing-rules/mask-rules",
   "/cid/9010": "/docs/send-data/opentelemetry-collector",
   "/cid/9011": "/docs/send-data/opentelemetry-collector/install-collector/linux",
@@ -3474,6 +3477,7 @@
   "/release-notes-service/welcome": "/release-notes-service",
   "/release-notes-service/2023/11/27/cis-for-aws": "/release-notes-service/2023/12/31/#november-27-2023-apps",
   "/release-notes-service/2042/06/10/manage": "/release-notes-service/2024/12/31",
+  "/release-notes-service/2024/03/20/flex/": "/release-notes-service/2024/12/31/#march-20-2024-manage",
   "/Send-Data/Applications-and-Other-Data-Sources/Azure-Audit/02Collect-Logs-for-Azure-Audit-from-Event-Hub": "/docs/integrations/microsoft-azure/audit",
   "/Send-Data/Collect-from-Other-Data-Sources/Azure_Monitoring/Collect_Logs_from_Azure_Monitor": "/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source/",
   "/Send-Data/Collect-from-Other-Data-Sources/Azure_Monitoring/Collect_Metrics_from_Azure_Monitor": "/docs/send-data/collect-from-other-data-sources/azure-monitoring/collect-metrics-azure-monitor",

docs/api/search-job.md

@@ -343,6 +343,7 @@ This is the formatted result document:
 
 ```json
 {
+   "warning":"",
    "state":"DONE GATHERING RESULTS",
    "messageCount":90,
    "histogramBuckets":[
@@ -356,7 +357,6 @@ This is the formatted result document:
          "count":1,
          "startTimestamp":1359405480000
       },
-      ...
       {
          "length":60000,
          "count":1,
@@ -367,7 +367,10 @@ This is the formatted result document:
    ],
    "pendingWarnings":[
    ],
-   "recordCount":1
+   "recordCount":1,
+   "usageDetails":{
+      "dataScannedInBytes":0
+      }
 }
 ```
 
@@ -385,12 +388,16 @@ Notice that the state of the sample search job is DONE GATHERING RESULTS. The fo
 
 #### More about results
 
+The **warnings** value contains the detailed information about the warning while obtaining the current status of a search job.
+
 The **messageCount** and **recordCount** values indicate the number of messages and records found or produced so far. Messages are raw log messages and records are aggregated data.
 
 For queries that do not contain an aggregation operator, only messages are returned. If the query contains an aggregation, for example, **count by _sourceCategory**, then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return).
 
 The **pendingErrors** and **pendingWarnings** values contain any pending error or warning strings that have accumulated since the last time the status was requested.
 
+The **usageDetails** value contains the amount of data scanned in bytes details.
+
 Errors and warnings are not cumulative. If you need to retain the errors and warnings, store them locally.
 
 The **histogramBuckets** value returns a list of histogram buckets. A histogram bucket is defined by its timestamp, which is the start timestamp (in milliseconds) of the bucket, and a length, also in milliseconds, that expressed the width of the bucket. The **timestampplus** length is the end timestamp of the bucket, so the count is the number of messages in the bucket.
@@ -468,6 +475,7 @@ curl -b cookies.txt -c cookies.txt -H 'Accept: application/json'
 
 ```json
 {
+   "warning": "",
    "fields":[
       {
          "name":"_messageid",
@@ -595,6 +603,7 @@ curl -b cookies.txt -c cookies.txt -H 'Accept: application/json'
 
 The result contains two lists, **fields** and **messages**.
 
+* ***warnings** contains the detailed information about the warning while paging through the messages found by a search job.
 * **fields** contains a list of all the fields defined for each of the messages returned. For each field, the field name and field type are returned.
 * **messages** contains a list of maps, one map per message. Each **map** maps from the fields described in the fields list to the actual value for the message.
 
@@ -666,6 +675,7 @@ This is the formatted result document:
 
 ```json
 {
+   "warning": "",
    "fields":[
       {
          "name":"_sourceCategory",
@@ -691,6 +701,8 @@ This is the formatted result document:
 
 The returned document is similar to the one returned for the message paging API. The schema of the records returned is described by the list of fields as part of the fields element. The records themselves are a list of maps.
 
+The ***warnings** contains the detailed information about the warning while paging through the records found by a Search Job.
+
 </details>
 
 ## POST Methods
@@ -828,10 +840,12 @@ Example error response:
 
 ```json
 {
-  "status" : 400,
-  "id" : "IUUQI-DGH5I-TJ045",
-  "code" : "searchjob.invalid.timestamp.from",
-  "message" : "The 'from' field contains an invalid time."
+  "warning": "A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request",
+  "id": "IUUQI-DGH5I-TJ045",
+  "link": {
+    "rel": "self",
+    "href": "https://api.sumologic.com/api/v1/search/jobs/IUUQI-DGH5I-TJ045"
+  }
 }
 ```
 

docs/integrations/amazon-aws/cis-aws-foundations-benchmark.md

@@ -34,9 +34,9 @@ The CIS AWS Foundation Benchmark App ingests [AWS CloudTrail](/docs/integrations
 
 Now that you have configured CIS AWS Foundation Benchmark, install the Sumo Logic App for CIS AWS Foundation Benchmark to take advantage of the preconfigured searches and dashboards to analyze your data.
 
-import AppInstall from '../../reuse/apps/app-install.md';
+import AppInstall2 from '../../reuse/apps/app-install-v2.md';
 
-<AppInstall/>
+<AppInstall2/>
 
 For context regarding the CIS AWS Foundation Benchmark App, check out this [blog](https://www.sumologic.com/blog/cis-aws-foundations-benchmark-monitoring/) where we describe the monitoring controls.