Skip to content

Commit d9a9d8a

Browse files
jpipkin1jpipkin1
authored
Merge branch 'main' into docs-235-historical-baselines
2 parents 21b036e + 846eacf commit d9a9d8a

File tree

655 files changed

+6321
-2308
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

655 files changed

+6321
-2308
lines changed

‎.clabot‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,8 @@
181181
"ankitgoelcmu",
182182
"Deklin",
183183
"justrelax19",
184-
"dlindelof-sumologic"
184+
"dlindelof-sumologic",
185+
"snyk-bot"
185186
],
186187
"message": "Thank you for your contribution! As this is an open source project, we require contributors to sign our Contributor License Agreement and do not have yours on file. To proceed with your PR, please [sign your name here](https://forms.gle/YgLddrckeJaCdZYA6) and we will add you to our approved list of contributors.",
187188
"label": "cla-signed",

‎blog-cse/2025-03-24-content.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
title: March 24, 2025 - Content Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- rules
6+
hide_table_of_contents: true
7+
---
8+
9+
import useBaseUrl from '@docusaurus/useBaseUrl';
10+
11+
This content release includes Threat Intelligence match rules that use the new [`hasThreatMatch`](/docs/cse/rules/cse-rules-syntax/#hasthreatmatch) operator to support both global and custom threat intelligence feeds.
12+
13+
To reduce initial signal volume, basic inbound and outbound IP address threat match rules with a low or medium confidence level are disabled by default (see below). We highly recommend tuning these rules before enabling them to reduce signal volume, and therefore entity risk assignment, to manageable levels.
14+
15+
### Rules
16+
* MATCH-S00999 Threat Intel - IMPHASH Match
17+
* MATCH-S01000 Threat Intel - MD5 Match
18+
* MATCH-S01001 Threat Intel - PEHASH Match
19+
* MATCH-S01002 Threat Intel - SSDEEP Match
20+
* MATCH-S01003 Threat Intel - SHA1 Match
21+
* MATCH-S01004 Threat Intel - SHA256 Match
22+
* MATCH-S01005 Threat Intel - Source Hostname
23+
* MATCH-S01006 Threat Intel - Device Hostname
24+
* MATCH-S01007 Threat Intel - Destination Device Hostname
25+
* MATCH-S01008 Threat Intel - HTTP Hostname
26+
* MATCH-S01009 Threat Intel - HTTP Referrer Hostname
27+
* MATCH-S01010 Threat Intel - DNS Query Domain
28+
* MATCH-S01011 Threat Intel - DNS Reply Domain
29+
* MATCH-S01012 Threat Intel - HTTP Referrer Domain
30+
* MATCH-S01013 Threat Intel - HTTP URL Root Domain
31+
* MATCH-S01014 Threat Intel - HTTP URL FQDN
32+
* MATCH-S01015 Threat Intel - HTTP URL
33+
* MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence) - Disabled By Default
34+
* MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence) - Disabled By Default
35+
* MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence) - Disabled By Default
36+
* MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence) - Disabled By Default
37+
* MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence)
38+
* MATCH-S01024 Threat Intel - Destination IP Address (High Confidence)
39+
* MATCH-S01018 Threat Intel - Successful Authentication from Threat Feed IP

‎blog-cse/2025-04-03-content.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
title: April 3, 2025 - Content Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- log mappers
6+
- parsers
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
This content release includes new and updated log mappers and parsers for Bitwarden, CommScope, Mimecast, and Sysdig Secure. Updates to Mimecast mappers are to support additional fields and events with new log parser.
13+
14+
## Log Mappers
15+
- [New] Bitwarden Authentication
16+
- [New] Bitwarden Catch All
17+
- [New] CommScope Authentication Event
18+
- [New] CommScope STP and DHCPC Event
19+
- [New] CommScope System|Security
20+
- [New] Sysdig Secure Packages
21+
- [New] Sysdig Secure Vulnerability
22+
- [Updated] Mimecast AV Event
23+
- [Updated] Mimecast Audit Authentication Logs
24+
- [Updated] Mimecast Audit Hold Messages
25+
- [Updated] Mimecast Audit Logs
26+
- [Updated] Mimecast DLP Logs
27+
- [Updated] Mimecast Email logs
28+
- [Updated] Mimecast Impersonation Event
29+
- [Updated] Mimecast Spam Event
30+
- [Updated] Mimecast Targeted Threat Protection Logs
31+
32+
## Parsers
33+
- [New] /Parsers/System/Bitwarden/Bitwarden
34+
- [New] /Parsers/System/CommScope/CommScope
35+
- [New] /Parsers/System/Mimecast/Mimecast
36+
- [New] /Parsers/System/Sysdig/Sysdig Secure

‎blog-cse/2025-04-08-application.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: April 8, 2025 - Application Update
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- threat intel
6+
- security
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
### New Threat Intelligence Source
13+
14+
We’re excited to announce a new default source for Sumo Logic Threat Intelligence incorporating Indicators of Compromise (IoC) from Intel 471.
15+
16+
For more information, [see our release note](/release-notes-service/2025/04/08/security/) in the *Service* release notes section.

‎blog-cse/2025-04-14-content.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
title: April 14, 2025 - Content Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- log mappers
6+
- parsers
7+
- rules
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
This content release includes:
14+
- Additional data requirements for GitHub rules added to rule descriptions.
15+
- Spelling corrections for AWS Lambda rules.
16+
- New Slack Anomaly Event log mapper and supporting parsing changes:
17+
- Enables passthrough detection of Slack Anomaly Events using Normalized Security Signal (MATCH-S00402).
18+
- Requires parser be defined for passthrough detection.
19+
- Updates to Sysdig parsing and mapping to support additional events.
20+
- Support for Microsoft Windows Sysmon-29 event.
21+
- Additional normalized field mappings for Microsoft Windows Sysmon events.
22+
- New `user_phoneNumber` and `targetUser_phoneNumber` schema fields.
23+
24+
25+
### Rules
26+
- [Updated] MATCH-S00874 AWS Lambda Function Recon
27+
- [Updated] MATCH-S00952 GitHub - Administrator Added or Invited
28+
- [Updated] MATCH-S00953 GitHub - Audit Logging Modification
29+
- [Updated] MATCH-S00954 GitHub - Copilot Seat Cancelled by GitHub
30+
- [Updated] FIRST-S00091 GitHub - First Seen Activity From Country for User
31+
- [Updated] FIRST-S00090 GitHub - First Seen Application Interacting with API
32+
- [Updated] MATCH-S00950 GitHub - Member Invitation or Addition
33+
- [Updated] MATCH-S00955 GitHub - Member Permissions Modification
34+
- [Updated] MATCH-S00956 GitHub - OAuth Application Activity
35+
- [Updated] MATCH-S00957 GitHub - Organization Transfer
36+
- [Updated] OUTLIER-S00026 GitHub - Outlier in Distinct User Agent Strings by User
37+
- [Updated] OUTLIER-S00027 GitHub - Outlier in Repository Cloning or Downloads
38+
- [Updated] MATCH-S00958 GitHub - PR Review Requirement Removed
39+
- [Updated] MATCH-S00959 GitHub - Repository Public Key Deletion
40+
- [Updated] MATCH-S00960 GitHub - Repository Transfer
41+
- [Updated] MATCH-S00961 GitHub - Repository Visibility Changed to Public
42+
- [Updated] MATCH-S00962 GitHub - Repository Visibility Permissions Changed
43+
- [Updated] MATCH-S00963 GitHub - SSH Key Created for Private Repo
44+
- [Updated] MATCH-S00964 GitHub - SSO Recovery Codes Access Activity
45+
- [Updated] MATCH-S00951 GitHub - Secret Scanning Alert
46+
- [Updated] MATCH-S00965 GitHub - Secret Scanning Potentially Disabled
47+
- [Updated] MATCH-S00966 GitHub - Two-Factor Authentication Disabled for Organization
48+
49+
### Log Mappers
50+
- [New] Slack Anomaly Event
51+
- [New] Windows - Microsoft-Windows-Sysmon/Operational - 16
52+
- [New] Windows - Microsoft-Windows-Sysmon/Operational - 19|20
53+
- [New] Windows - Microsoft-Windows-Sysmon/Operational-29
54+
- [Updated] Sysdig Secure Packages
55+
- [Updated] Sysdig Secure Vulnerability
56+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 1
57+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 2
58+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 3
59+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 4
60+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 5
61+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 6
62+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 7
63+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 8
64+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 9
65+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 10
66+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 11
67+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 15
68+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 17
69+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 18
70+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 23
71+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 24
72+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 26
73+
- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 27
74+
75+
### Parsers
76+
- [New] /Parsers/System/Slack/Slack Enterprise Audit
77+
- [Updated] /Parsers/System/Sysdig/Sysdig Secure
78+
79+
### Schema
80+
- [New] `targetUser_phoneNumber`
81+
- [New] `user_phoneNumber`

‎blog-developer/2025-04-09-api.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: April 9, 2025 - Deprecation of Sumo Logic India Data Center
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
hide_table_of_contents: true
5+
---
6+
7+
As previously communicated to impacted customers, effective as of April 30, 2025, customers will no longer be able to ingest data into the Sumo Logic Mumbai data center (`https://api.in.sumologic.com/`). Customers will retain access to historical data and basic search functionality until April 30, 2026, at which point all access will be terminated.
8+
9+
Historical data will not be migrated to other deployments.
10+
11+
**Reminder**: If you're still referencing the India endpoint, please update your integrations. For supported alternatives, see the [endpoint guide](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security).
12+
13+
For help, contact [Support](https://support.sumologic.com/).

‎blog-service/2025-03-20-apps.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Azure Security - Advisor (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- azure-security-advisor
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
13+
We're excited to introduce the new Azure Security - Advisor app for Sumo Logic. By leveraging this app, security analysts can quickly assess Azure Advisor’s recommendations, track remediation progress over time, and take action to enhance the security and efficiency of their Azure infrastructure. [Learn more](/docs/integrations/microsoft-azure/azure-security-advisor/).

‎blog-service/2025-03-25-manage.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Open Navigation Menu Items in New Browser Tabs by Default
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- manage
6+
- preferences
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
A new preference setting allows you to open links from the left navigation menu in a new browser tab by default. This feature is available only in the New UI. [Learn more](/docs/get-started/account-settings-preferences/#navigation).
13+
14+
<img src={useBaseUrl('img/get-started/open-in-new-tab-button.png')} alt="Open in New Tab button" style={{border: '1px solid gray'}} width="125" />

‎blog-service/2025-03-28-apps.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: CyberArk Audit (Apps)
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- cyberark-audit
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
13+
We're excited to introduce the new CyberArk Audit app for Sumo Logic. By leveraging this app, security analysts can monitor, analyze, and visualize audit trails of user activities, security events, and anomalies to enhance security. [Learn more](/docs/integrations/saas-cloud/cyberark-audit).

‎blog-service/2025-03-31-apps.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
title: Apps, Solutions, and Collection Integrations - March Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- apps
6+
- march-release
7+
hide_table_of_contents: true
8+
---
9+
10+
import useBaseUrl from '@docusaurus/useBaseUrl';
11+
12+
### New release
13+
14+
We’re excited to announce the release of the new Azure Key Vault and AWS Auto scaling apps for Sumo Logic.
15+
16+
- **Azure Key Vault**. Azure Key Vault is a cloud service that helps you securely store and manage secrets, keys, and certificates. You can use it to protect data for cloud apps and services. This integration helps in comprehensive monitoring of your Key Vault operations, requests, failures, and latency. [Learn more](/docs/integrations/microsoft-azure/azure-key-vault/).
17+
- **AWS Auto scaling**. Amazon EC2 Auto Scaling helps you maintain application availability and lets you automatically add or remove EC2 instances using scaling policies that you define. Dynamic or predictive scaling policies let you add or remove EC2 instance capacity to service established or real-time demand patterns. [Learn more](/docs/integrations/amazon-aws/amazon-ec2-auto-scaling/).
18+
19+
### Enhancements
20+
21+
- **Added metrics collection capability for OpenTelemetry collectors**. [RabbitMQ](/docs/send-data/opentelemetry-collector/remote-management/source-templates/rabbitmq/#for-metrics-collection) and [Redis](/docs/send-data/opentelemetry-collector/remote-management/source-templates/redis/#for-metrics-collection).
22+
- **Added use cases to monitor EBS volume and snapshots in AWS EC2 apps**. [AWS EC2](/docs/integrations/amazon-aws/ec2-cloudwatch-metrics/#events).
23+
- **Updated the metric collection and dashboard for Google apps**. [Google BigQuery](/docs/integrations/google/bigquery/) and [Google Cloud Load Balancing](/docs/integrations/google/cloud-load-balancing/).
24+
- Added new dashboards to the [Sumo Logic Kickstart Data (Beta)](/docs/integrations/sumo-apps/kickstart-data/) app.
25+
- **Updated the queries to accommodate the new threat intel feed**. [Apache - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/apache-opentelemetry/), [Apache Tomcat - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/apache-tomcat-opentelemetry/), [HAProxy - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/haproxy-opentelemetry/), [IIS 10 - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/iis-10-opentelemetry/), [Ngin - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/nginx-opentelemetry/), [PostgreSQL - OpenTelemetry](/docs/integrations/databases/opentelemetry/postgresql-opentelemetry/), [Varnish - OpenTelemetry](/docs/integrations/web-servers/opentelemetry/varnish-opentelemetry/), [Acquia](/docs/integrations/saas-cloud/acquia/), [Azure Web Apps](/docs/integrations/microsoft-azure/web-apps/), [JFrog Xray](/docs/integrations/app-development/jfrog-xray/), and [MongoDB Atlas 6](/docs/integrations/databases/mongodb-atlas/).
26+
- Updated Azure integration from` Node.js v18` to `Node.js v20`. [Learn more](https://github.com/SumoLogic/sumologic-azure-function/releases/tag/v4.1.6).
27+
28+
### Bug Fixes
29+
30+
Bugs for the following apps have been fixed:
31+
- Filtering the security groups dashboard in [AWS VPC Flow Logs](/docs/integrations/amazon-aws/vpc-flow-logs/#security-groups).
32+
- [AWS ECS](/docs/integrations/amazon-aws/elastic-container-service/).
33+
- [JFrog Artifactory 7 app](/docs/integrations/app-development/jfrog-artifactory/).

0 commit comments

Comments
 (0)