Add Auth0

Author: jpipkin1

docs/cse/ingestion/cse-ingestion-best-practices.md

@@ -7,10 +7,10 @@ description: Learn how to send log messages collected by a Sumo Logic Source or
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This topic has information about sending log messages collected by a Sumo Logic Source or Cloud-to-Cloud Connector on to Cloud SIEM to be transformed into records. 
+This article has information about sending log messages collected by a Sumo Logic Source or Cloud-to-Cloud Connector on to Cloud SIEM to be transformed into records. 
 
 :::note
-Cloud SIEM must be enabled in your Sumo Logic account in order to send data from Sumo Logic to Cloud SIEM. If it isn’t, contact your Sumo Logic Technical Account Engineer or Sales Engineer.
+[Cloud SIEM must be enabled in your Sumo Logic account](/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse/) in order to send data from Sumo Logic to Cloud SIEM. If it isn’t, contact your Sumo Logic Technical Account Engineer or Sales Engineer.
 :::
 
 The process consists of configuring a source or collector to forward messages to Cloud SIEM, and ensuring that the forwarded messages are correctly tagged with the information Cloud SIEM needs in order to map messages fields to record attributes. These are referred to as *mapping hints*, and include: Format, Vendor, Product, and an Event ID template.
@@ -23,19 +23,19 @@ You can only send log data that resides in the [Continuous data tier](/docs/mana
 
 <img src={useBaseUrl('img/cse/cip-to-cse.png')} alt="Data flow diagram" width="800"/>
 
-### Cloud SIEM ingestion best practices
+### Recommended methods to ingest data into Cloud SIEM
 
-We recommend the following ingestion processes, starting with the most preferred:
+We recommend the following ingestion methods, starting with the most preferred:
 
-1. **Follow an ingestion guide**. The [Ingestion Guides](/docs/cse/ingestion) section of this help site provides specific collection and ingestion recommendations for many common products and services. An ingestion guide describes the easiest way to get data from a particular product into Cloud SIEM. When you’re ready to start using Cloud SIEM to monitor a new product, if there’s a Cloud SIEM ingestion guide for it, we recommend using it.
-1. **Use a Cloud-to-Cloud (C2C) connector**. If you don’t see an Ingestion Guide for your data source, check to see if there is a C2C connector. It’s an easy method, because if you configure your C2C source to send logs to Cloud SIEM, it automatically tags messages it sends to Cloud SIEM with fields that contain the mapping hints that Cloud SIEM requires.  <br/><br/>Most C2C connectors have a **Forward to SIEM** option in the configuration UI. If a C2C connector lacks that option, you can achieve the same effect by assigning a field named `_siemforward`, set to *true*, to the connector.  <br/><br/>For information about what C2C sources are available, see Cloud-to-Cloud Integration Framework.  
+1. **Use a Cloud-to-Cloud (C2C) connector**. It’s an easy method, because if you configure your C2C source to send logs to Cloud SIEM, it automatically tags messages it sends to Cloud SIEM with fields that contain the mapping hints that Cloud SIEM requires.  <br/><br/>Most C2C connectors have a [**Forward to SIEM** option](/docs/c2c/info/#metadata-fields) in the configuration UI. If a C2C connector lacks that option, you can achieve the same effect by assigning a field named `_siemforward`, set to *true*, to the connector.  <br/><br/>For information about what C2C sources are available, see [Cloud-to-Cloud Integration Framework Sources](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/).  
 1. **Use a Sumo Logic Source and parser**. If there isn’t a C2C connector for your data source, your next best option is to use a Sumo Logic Source (running on an Installed Collector or a Hosted Collector, depending on the data source)—and a Sumo Logic parser, if we have one for the data source.   
 
-    Check if there’s a parser for your data source. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Parsers**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Parsers**. You can also click the **Go To...** menu at the top of the screen and select **Parsers**.  If there is a parser for your data source, but you find it doesn’t completely meet your needs–for instance if the parser doesn’t support the particular log format you use–consider customizing the parser with a [local configuration](/docs/cse/schema/parser-editor#create-a-local-configuration-for-a-system-parser). If that’s not practical, you can submit a request for a new parser by filing a ticket at [https://support.sumologic.com](https://support.sumologic.com/).  
+    Check if there’s a parser for your data source. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Parsers**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Logs** select **Parsers**. You can also click the **Go To...** menu at the top of the screen and select **Parsers**.  
+    
+    If there is a parser for your data source, but you find it doesn’t completely meet your needs–for instance if the parser doesn’t support the particular log format you use–consider customizing the parser with a [local configuration](/docs/cse/schema/parser-editor#create-a-local-configuration-for-a-system-parser). If that’s not practical, you can submit a request for a new parser by filing a ticket at [https://support.sumologic.com](https://support.sumologic.com/).  
 
-    When you forward logs to Cloud SIEM for parser processing, there are two bits of important configuration:  
-     
-    1. Configure the source to forward logs. To configure an HTTP source to send log messages to Cloud SIEM, click the **SIEM Processing** checkbox. You can configure other source types to send data to Cloud SIEM by assigning a field named `_siemforward`, set to *true*, to the source. For example:  
+    When you forward logs to Cloud SIEM for parser processing, there are two bits of important configuration: 
+    1. Configure the source to forward logs. To configure an HTTP source to send log messages to Cloud SIEM, click the [**SIEM Processing** checkbox](/docs/send-data/hosted-collectors/http-source/logs-metrics/#configure-an-httplogs-and-metrics-source). You can configure other source types to send data to Cloud SIEM by assigning a field named `_siemforward`, set to *true*, to the source. For example:  
 
         ```
         _siemforward=true
@@ -53,3 +53,6 @@ We recommend the following ingestion processes, starting with the most preferred
          You can get the path to a parser on the **Parsers** page in Sumo Logic. Click the three-dot kebab menu in the row for a parser, and select **Copy Path**.
 
 1. **Use a Sumo Logic Source and Cloud SIEM Ingest mapping**. This is the least recommended method, as you have to manually configure the mapping hints in an ingestion mapping. For more information, see [Configure a Sumo Logic Ingest Mapping](/docs/cse/ingestion/sumo-logic-ingest-mapping/).
+
+:::tip
+See the [Example Ingestion Sources for Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/) for specific collection and ingestion recommendations for many common products and services.

docs/cse/ingestion/example-ingestion-sources-for-cloud-siem.md

@@ -0,0 +1,25 @@
+---
+id: example-ingestion-sources-for-cloud-siem
+title: Example Ingestion Sources for Cloud SIEM
+sidebar_label: Example Ingestion Sources
+description: See examples of sources that Cloud SIEM supports for log ingestion.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+This article lists examples of sources you can use to ingest data into Cloud SIEM. There are many sources you can use to ingest data into Cloud SIEM. The ones described in this article are just a few.
+
+The most common method to ingest data into Cloud SIEM is to install a [Cloud-to-Cloud Integration Framework source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/) and select the [**Forward to SIEM** option](/docs/c2c/info/#metadata-fields) in the configuration UI. For all available methods to ingest data into Cloud SIEM, see [Recommended methods to ingest data into Cloud SIEM](/docs/cse/ingestion/cse-ingestion-best-practices/#recommended-methods-to-ingest-data-into-cloud-siem).
+
+## Auth0
+
+To ingest data into Cloud SIEM, select the [**Forward to SIEM** option](/docs/c2c/info/#metadata-fields) in the source configuration UI, and click the **+Add Field** link to add a field whose name is `_parser` with value */Parsers/System/Auth0/Auth0*. For complete directions, see [Collecting logs for Auth0](/docs/integrations/saml/auth0/#collecting-logs-for-auth0).
+
+To verify that your logs are successfully making it into Cloud SIEM:
+1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**.  
+1. On the **Log Mappings** tab search for Auth0 and check the **Records** columns.<br/><img src={useBaseUrl('img/cse/auth0-reocrd-volume.png')} alt="Record volume" style={{border: '1px solid gray'}} style={{border: '1px solid gray'}} width="800" />
+1. For a more granular look at the incoming records, you can also use the Sumo Logic platform to search for Auth0 security records.<br/><img src={useBaseUrl('img/cse/auth0-search.png')} alt="Auth0 search" style={{border: '1px solid gray'}} style={{border: '1px solid gray'}} width="500" />
+
+
+
+

docs/cse/ingestion/ingestion-sources-for-cloud-siem/index.md

@@ -1,12 +1,12 @@
 ---
 slug: /cse/ingestion/ingestion-sources-for-cloud-siem
-title: Ingestion Sources for Cloud SIEM
+title: Example Ingestion Sources for Cloud SIEM
 description: Learn the sources available for ingesting data to Cloud SIEM.
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This guide lists the sources available for ingesting data into Cloud SIEM. You can configure a variety of sources on [Installed Collectors](/docs/send-data/installed-collectors).
+This guide lists examples of sources you can use to ingest data into Cloud SIEM. For all available methods to ingest data into Cloud SIEM, see [Cloud SIEM ingestion best practices](/docs/cse/ingestion/cse-ingestion-best-practices).
 
 In this section, we'll introduce the following concepts:
 

docs/integrations/saml/auth0.md

@@ -11,8 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
 
 Auth0 is a cloud-based, extensible identity provider for applications. The Sumo Logic App for Auth0 makes it easy to analyze and visualize your Auth0 event logs, and provides insight into security and operational issues.
 
-For more information, see [Export Logs to Sumo Logic](https://auth0.com/docs/extensions/sumologic).
-
+For more information, see [Use Auth0 App for Sumo Logic](https://auth0.com/docs/customize/log-streams/sumo-logic-dashboard) in Auth0 documentation.
 
 ## Collecting logs for Auth0
 This procedure explains how to collect error logs from Auth0.
@@ -30,35 +29,34 @@ Sumo Logic collects the following log types:
 * Rate limiting events
 * Other operational events and errors
 
-For more information about Auth0 logs, see [https://auth0.com/docs/api/managemen.../Logs/get_logs](https://auth0.com/docs/api/management/v2#!/Logs/get_logs)
+For more information about Auth0 logs, see [Search Log Events](https://auth0.com/docs/api/management/v2#!/Logs/get_logs) in Auth0 documentation.
 
 
 ### Prerequisites
 
-Use the Auth0 Management Portal to configure the extension. For more information, see [https://auth0.com/docs/extensions/sumologic](https://auth0.com/docs/extensions/sumologic).
-
-
-### Configure a Collector
+Use the Auth0 Management Portal to configure the extension. For more information, see [Sumo Logic](https://marketplace.auth0.com/integrations/sumo-logic-log-streaming) in Auth0 documentation.
 
-Use the in-product [setup wizard](/docs/send-data/setup-wizard) in the Sumo Logic UI to configure a **Custom App**.
+### Configure a collector
 
+Configure a hosted collector. Follow the directions in [Configure a Hosted Collector and Source](/docs/send-data/hosted-collectors/configure-hosted-collector/).
 
 ### Configure a Source
 
-Source type is [HTTP](/docs/send-data/hosted-collectors/http-source/logs-metrics).
-
-* **Name**: Required
-* **Category**:
-* **Timestamp Parsing Settings**:
-  * **Enable Timestamp Parsing**: True
-  * **Timezone**: Logs are sent in UTC by default and can be automatically detected
-  * **Timestamp Format**: Select **Specify a format** and use the following, \
-Format: `yyyy-MM-dd'T'HH:mm:ss.SSS'Z' \
-`Timestamp locator: `"date":"(.*?)\","`
-* **Multi-line Parsing Settings**:
-  * **Detect Messages Spanning Multiple Lines**: True
-  * **Multi Line Boundary**: Infer Boundaries
-
+Configure a source on the collector. Follow the directions in [Configure an HTTP Logs and Metrics Source](/docs/send-data/hosted-collectors/http-source/logs-metrics/#configure-an-httplogs-and-metrics-source).
+
+Fill out the following:
+* **Name**
+* **Source Category**
+* Select **Forward to SIEM** if you have [Cloud SIEM](/docs/cse) installed and you want to forward log data to Cloud SIEM. If you select **Forward to SIEM**, also click the **+Add Field** link and add a field whose name is `_parser` with value */Parsers/System/Auth0/Auth0*.
+* **Timestamp Parsing**
+  * Select **Extract timestamp information from log file entries**.
+  * **Default Timezone**. Select the default time zone to use. Logs are sent in UTC by default and can be automatically detected.
+  * **Timestamp Format**. Select **Specify a format**. Click **Add Timestamp Format** and enter the following:
+     * **Format**: `yyyy-MM-dd'T'HH:mm:ss.SSS'Z'` 
+     * **Timestamp locator**: `"date":"(.*?)\","`
+* **Message Processing**
+   * Select **Multiline Processing**.
+   * For **Infer Message Boundaries**  select **Detect Automatically**.
 
 ### Use Field Extraction Rules
 

sidebars.ts

@@ -2828,6 +2828,7 @@ integrations: [
             'cse/ingestion/products-with-log-mappings',
             'cse/ingestion/view-mappers-for-product',
             'cse/ingestion/sumo-logic-ingest-mapping',
+            'cse/ingestion/example-ingestion-sources-for-cloud-siem',
             {
               type: 'category',
               label: 'Ingestion Sources for Cloud SIEM',