You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: blog-service/2023/12-31.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -106,7 +106,7 @@ To learn more, see [Updating Your AWS Observability Stack](/docs/observability/a
106
106
107
107
We're excited to announce that you can use roles to restrict access to specific data in search indexes. When you create a role, you can select **Index based** filters to allow access to data based on indexes, or you can select **Advanced filter** to define a dataset to allow access based on search criteria. This ensures that users only see the data they are supposed to.
We're excited to announce the release of our new cloud-to-cloud source for Automox. This source helps you to collect all events objects, audit trail events, and device inventory details from the Automox platform, and ingest them into Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/automox-source).
We're excited to announce that when you create a role, you can select **Index Access** to restrict access to data in specific indexes. In addition, when you now select **Search Filter**, you can create filtering to restrict access to log analytics, audit, and security data. These enhancements ensure that users only see the data they are supposed to.
16
+
17
+
This feature was [previously only available to participants in our beta program](/release-notes-service/2023/12/31/#october-27-2023-manage-account). It is now available for general use.
18
+
19
+
:::note
20
+
These changes are rolling out across deployments incrementally and will be available on all deployments by October 25, 2024.
Copy file name to clipboardExpand all lines: docs/manage/users-roles/roles/construct-search-filter-for-role.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,8 +6,8 @@ description: Construct a role search filter to control what log data users with
6
6
7
7
import useBaseUrl from '@docusaurus/useBaseUrl';
8
8
9
-
This page describes how to define an advanced search filter for a role. These instructions apply to the **Search filter** option in Step 6 of the [Create a role](/docs/manage/users-roles/roles/create-manage-roles/#create-a-role) procedure.
10
9
10
+
This page describes how to define search filters for a role. These instructions apply to the **Search Filter** option in Step 6 of the [Create a role](/docs/manage/users-roles/roles/create-manage-roles/#create-a-role) procedure.
11
11
12
12
## Understanding search filters
13
13
@@ -43,13 +43,13 @@ The examples above are simple: they involve a single role, and hence a single ro
43
43
44
44
Typically however, a Sumo user will have multiple roles. If a user has multiple roles, Sumo `OR`s the several role filters and prepends that expression to the user’s queries with an `AND`, as discussed in [Multiple role filters and filter precedence](#multiple-role-filters-and-filter-precedence).
45
45
46
-
###Search filter basics
46
+
## Search filter basics
47
47
48
48
The sections below list search filter limitations, and describe how you can use keywords, wildcards, metadata, and logical operators in filters.
49
49
50
50
The explanations of the behavior of each example filter assume that no other role filters apply. In practice, you will likely assign multiple roles to users. After you understand the basics of how role filters work, see [Multiple role filters and filter precedence](#multiple-role-filters-and-filter-precedence).
51
51
52
-
####Search filter limitations
52
+
### Search filter limitations
53
53
54
54
* Role filters should include only keyword expressions or built-in metadata field expressions using these fields: `_sourcecategory`, `_collector`, `_source`, `_sourcename`, `_sourcehost`.
55
55
* Using `_index` or `_view` in a role filter scope is not supported.
@@ -61,7 +61,7 @@ The explanations of the behavior of each example filter assume that no other rol
61
61
62
62
For limitations related to the use of Scheduled Views or Partitions in a search filter, refer to [Partitions](/docs/manage/partitions/#limitations) and [Scheduled Views](/docs/manage/scheduled-views).
63
63
64
-
####Using metadata in a search filter
64
+
### Using metadata in a search filter
65
65
66
66
You can use metadata fields in a role search filter. The following search filter grants access to log data from a Collector named “HR_Tools”, and no other data:
67
67
@@ -75,7 +75,7 @@ When a user with that role filter runs a query, Sumo prepends the filter to the
75
75
_collector=HR_Tools AND<user-query>
76
76
```
77
77
78
-
####Using AND and OR in a search filter
78
+
### Using AND and OR in a search filter
79
79
80
80
You can use AND and OR in a search filter. For example, this role filter uses OR to grant access to log data from two source categories:
81
81
@@ -101,7 +101,7 @@ When a user with that role filter runs a query, Sumo prepends the filter to the
101
101
(_collector=HR_Tools AND _sourceCategory=insurance) AND<user-query>
102
102
```
103
103
104
-
####Using keywords in a search filter
104
+
### Using keywords in a search filter
105
105
106
106
You can include a string you want to search for in a role search filter. This role filter grants access to logs from the collector named “HR_Tools” that contain the string “enrollment”:
107
107
@@ -115,7 +115,7 @@ When a user with that role filter runs a query, Sumo runs it like this:
115
115
(_collector=HR_Tools AND enrollment) AND<user-query>
116
116
```
117
117
118
-
####Using wildcards in a search filter
118
+
### Using wildcards in a search filter
119
119
120
120
You can use an asterisk (\*) as a wildcard in a role search filter. This role filter grants access to logs from all collectors whose name begins with “HR”:
121
121
@@ -141,7 +141,7 @@ When a user with that role filter runs a query, Sumo runs it like this:
141
141
(_collector=HR*AND violation) AND<user-query>
142
142
```
143
143
144
-
####Using ! as a NOT in a search filter
144
+
### Using ! as a NOT in a search filter
145
145
146
146
You can use an exclamation point character (!) in a role search filter to restrict, rather than allow, access. For example, this filter:
147
147
@@ -161,13 +161,13 @@ When a user with that role filter runs a query, Sumo runs it like this:
When a user is assigned to multiple Sumo roles, Sumo combines the role filters from each of the roles using a logical OR to come up with the combined role filter.
167
167
168
168
When multiple roles filters are applied to a query, the least restrictive filter takes precedence. That this rule doesn’t apply if any of the role filters applied to a query is simply blank, which effectively grants access to all data, and would be the least restrictive filter. If the combined search filters applied to a query includes filters that are blank, the blank search filter is ignored and the next least restrictive filter takes precedence. So, if you actually want to grant a role access to all data, set the search filter to an asterisk (`*`). A search filter that is configured in that fashion will take precedence when combined with more restrictive search filters.
169
169
170
-
####Example 1
170
+
### Example 1
171
171
172
172
Assume the following role filters.
173
173
@@ -189,7 +189,7 @@ AND <your-query>
189
189
190
190
The combined filters enable access to log data whose `_source` tag is “GCP Audit” and `_collector` tag is “GCP”, and to any log data whose `_sourceCategory` tag begins with “Vx”.
191
191
192
-
####Example 2
192
+
### Example 2
193
193
194
194
Assume the following role filters.
195
195
@@ -210,7 +210,7 @@ When a user with Roles A and B runs a query, Sumo combines the two filters with
210
210
211
211
**The least restrictive of the role filters takes precedence**. So, although Role A effectively restricts results to log data that matches `_collector=fee*`, Role B allows grants access to all collectors, except for those that match `_collector=fi*`. So, Role B takes precedence and Role A has no effect.
212
212
213
-
####Example 3
213
+
### Example 3
214
214
215
215
Assume the following role filters.
216
216
@@ -232,7 +232,7 @@ When a user with Roles A and B runs a query, Sumo combines the two filters with
232
232
233
233
**The least restrictive of the role filters takes precedence.** Role A alone grants access to a log data from a single source category, “analytics-lab”. Role B grants access to log data to any source category that starts with “analytics”. Since the least restrictive filter takes precedence, data tagged `_sourceCategory=analyticsLong` could be returned in addition to data tagged `_sourceCategory=analytics-lab`.
234
234
235
-
####Example 4
235
+
### Example 4
236
236
237
237
Assume the following role filters.
238
238
@@ -253,7 +253,7 @@ When a user with Roles A and B runs a query, Sumo combines the two filters with
253
253
254
254
Role B is the least restrictive. Users with the combined role filter will be able to view any log data whose `_sourceCategory` does not contain the string “shoguns”, regardless of the value of the `_collector` tag.
0 commit comments