Skip to content

Commit ff3a03e

Browse files
amee-sumoamee-sumo
authored
Merge branch 'main' into May-Release-Note-(apps)
2 parents f24cd7d + 691a0ba commit ff3a03e

File tree

108 files changed

+3133
-2960
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+3133
-2960
lines changed

‎.github/workflows/build_and_deploy.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Build and Deploy
22

3+
permissions:
4+
contents: read
5+
36
on:
47
workflow_call:
58
inputs:
@@ -13,7 +16,7 @@ on:
1316
default: "/"
1417
type: string
1518
environment:
16-
description: GHA environment name
19+
description: GitHub Actions environment name (used for scoping secrets and deployment)
1720
required: true
1821
type: string
1922
secrets:
@@ -35,6 +38,7 @@ jobs:
3538
env:
3639
CI: true
3740
NODE_ENV: production
41+
NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
3842
AWS_PAGER: ""
3943
HOSTNAME: ${{ inputs.hostname }}
4044
BASE_URL: ${{ inputs.base_url }}
@@ -53,16 +57,14 @@ jobs:
5357
uses: actions/cache@v3
5458
with:
5559
path: node_modules/.cache
56-
key: ${{ runner.os }}-webpack-cache
60+
key: ${{ runner.os }}-webpack-cache-${{ hashFiles('yarn.lock') }}
5761
- name: Install awscli
5862
uses: unfor19/install-aws-cli-action@v1
5963
- name: Install jq
6064
run: sudo apt-get install -y jq
6165
- name: Install dependencies
6266
run: yarn install --frozen-lockfile
6367
- name: Build the Docusaurus site
64-
env:
65-
NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
6668
run: yarn build
6769
- name: Deploy the Docusaurus site
6870
env:

‎.github/workflows/delete-review.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: delete-review
22

3+
permissions:
4+
contents: read
5+
36
on: delete
47

58
jobs:
@@ -9,6 +12,7 @@ jobs:
912
name: review/${{ github.ref_name }}
1013
env:
1114
CI: true
15+
NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
1216
AWS_PAGER: ""
1317
BASE_URL: /${{ github.ref_name }}/
1418
AWS_DEFAULT_REGION: us-east-1
@@ -23,6 +27,7 @@ jobs:
2327
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
2428
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
2529
run: |
30+
echo "Removing files at s3://${S3_BUCKET_NAME}${BASE_URL}"
2631
aws s3 rm --recursive s3://${S3_BUCKET_NAME}${BASE_URL}
2732
export INVALIDATION_ID=$(
2833
aws cloudfront create-invalidation \

‎.github/workflows/pr.yml‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,44 @@
11
name: Pull Request Checks
22

3+
permissions:
4+
contents: read
5+
pull-requests: read
6+
37
on:
4-
pull_request:
5-
branches:
6-
- main
7-
merge_group:
8-
types:
9-
- checks_requested
8+
pull_request:
9+
branches:
10+
- main
11+
merge_group:
12+
types:
13+
- checks_requested
14+
15+
env:
16+
CI: true
17+
NODE_ENV: production
18+
NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
1019

1120
jobs:
12-
build-and-deploy:
13-
runs-on: ubuntu-latest
14-
env:
15-
CI: true
16-
NODE_ENV: production
17-
steps:
18-
- uses: actions/checkout@v4
19-
- name: Set up Node.js
20-
uses: actions/setup-node@v3
21-
with:
22-
node-version: '20.x'
23-
cache: 'yarn'
24-
- name: Docusaurus Webpack cache
25-
uses: actions/cache@v3
26-
with:
27-
path: node_modules/.cache
28-
key: ${{ runner.os }}-webpack-cache
29-
- name: Install dependencies
30-
run: yarn install --frozen-lockfile
31-
- name: Build the Docusaurus site
32-
env:
33-
NODE_OPTIONS: "--max-old-space-size=8192 --max-http-header-size=8192"
34-
run: yarn build
35-
spellcheck:
36-
runs-on: ubuntu-latest
37-
steps:
21+
build-and-deploy:
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
- name: Set up Node.js
26+
uses: actions/setup-node@v3
27+
with:
28+
node-version: '20.x'
29+
cache: 'yarn'
30+
- name: Docusaurus Webpack cache
31+
uses: actions/cache@v3
32+
with:
33+
path: node_modules/.cache
34+
key: ${{ runner.os }}-webpack-cache-${{ hashFiles('yarn.lock') }}
35+
- name: Install dependencies
36+
run: yarn install --frozen-lockfile
37+
- name: Build the Docusaurus site
38+
run: yarn build
39+
spellcheck:
40+
runs-on: ubuntu-latest
41+
steps:
3842
- uses: actions/checkout@v4
3943
- uses: codespell-project/actions-codespell@master
4044
name: Check spelling

‎.github/workflows/production.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: deploy-to-production
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches:

‎blog-cse/2025-05-30-content.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: May 30, 2025 - Content Release
3+
image: https://help.sumologic.com/img/sumo-square.png
4+
keywords:
5+
- log mappers
6+
- parsers
7+
- rules
8+
hide_table_of_contents: true
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl';
12+
13+
This content release includes:
14+
- Rule updates.
15+
- New log parsers and mappers to support Akamai CPC and Contrast Security ADR.
16+
- New and updated log mappers for Azure Event Hub - Windows Defender logs, Cisco ISE, Microsoft Office 365, and Snowflake.
17+
- Modifications to existing parsers for Microsoft Azure JSON, Nginx Syslog, and Snowflake to support additional formats and events.
18+
19+
Changes are enumerated below.
20+
21+
### Rules
22+
- [Updated] MATCH-S00068 O365 - Users Password Changed
23+
- Updated entity selectors to include both `user_username` and `targetUser_username`
24+
- [Updated] MATCH-S00069 O365 - Users Password Reset
25+
- Updated entity selectors to include both `user_username` and `targetUser_username`
26+
27+
### Log Mappers
28+
- [New] Akamai CPC
29+
- [New] Azure Event Hub - Windows Defender Audit events
30+
- [New] Azure Event Hub - Windows Defender Audit file events
31+
- [New] Azure Event Hub - Windows Defender Authentication events
32+
- [New] Azure Event Hub - Windows Defender Email events
33+
- [New] Azure Event Hub - Windows Defender Endpoint Process events
34+
- [New] Azure Event Hub - Windows Defender Network events
35+
- [New] Contrast Security ADR Default Mapping
36+
- [New] Snowflake Query History
37+
- [New] Snowflake Session
38+
- [Updated] Azure Event Hub - Windows Defender Logs - DeviceAlertEvents
39+
- [Updated] Azure Event Hub - Windows Defender Logs and Azure Alert
40+
- [Updated] Cisco ISE Catch All
41+
- [Updated] Microsoft Office 365 Active Directory Authentication Events
42+
- [Updated] Snowflake Catch All
43+
- [Updated] Snowflake Login
44+
45+
### Parsers
46+
- [New] /Parsers/System/Akamai/Akamai CPC
47+
- [New] /Parsers/System/Contrast Security/Contrast ADR
48+
- [Updated] /Parsers/System/Cisco/Cisco ISE
49+
- [Updated] /Parsers/System/Microsoft/Microsoft Azure JSON
50+
- [Updated] /Parsers/System/Nginx/Nginx Syslog
51+
- [Updated] /Parsers/System/Microsoft/Office 365
52+
- [Updated] /Parsers/System/Snowflake/Snowflake
53+
- [Updated] /Parsers/System/Microsoft/Windows PowerShell-JSON
54+
- [Updated] /Parsers/System/Microsoft/Windows-JSON-Open Telemetry

‎cid-redirects.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,6 @@
440440
"/05Search/Get-Started-with-Search/Visualizations/Group-By-Operator": "/docs/search/search-query-language/search-operators",
441441
"/05Search/Live-Tail": "/docs/search/live-tail",
442442
"/05Search/Live-Tail/About-Live-Tail": "/docs/search/live-tail/about-live-tail",
443-
"/Search": "/docs/search",
444443
"/Search/Anomaly_Detection": "/docs/alerts/monitors/create-monitor",
445444
"/Search/Live-Tail": "/docs/search/live-tail/about-live-tail",
446445
"/Search/Live-Tail/About-Live-Tail": "/docs/search/live-tail/about-live-tail",

‎docs/api/getting-started.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ Sumo Logic has several deployments that are assigned depending on the geographic
8787

8888
Sumo Logic redirects your browser to the correct login URL and also redirects Collectors to the correct endpoint. However, if you're using an API you'll need to manually direct your API client to the correct Sumo Logic API URL.
8989

90-
<table><small>
90+
<table>
9191
<tr>
9292
<td>Deployment</td>
9393
<td>Service Endpoint (login URL)</td>
@@ -183,7 +183,6 @@ https://endpoint9.collection.us2.sumologic.com/</td>
183183
<td>syslog.collection.us2.sumologic.com</td>
184184
<td>https://open-collectors.us2.sumologic.com</td>
185185
</tr>
186-
</small>
187186
</table>
188187

189188
### Which endpoint should I should use?

‎docs/integrations/amazon-aws/aws-privatelink.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ With the NLB-created and ALB-registered as a target, requests over AWS PrivateL
3737

3838
Sumo Logic exposes AWS PrivateLink endpoints to different [regions that depend on your Sumo Logic deployment](/docs/api/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security). If you're using the VPC in a different region where the Sumo Logic PrivateLink endpoint service is set up, you need to set up VPC peering. Either way, you need to create an endpoint.
3939

40-
<table><small>
40+
<table>
4141
<tr>
4242
<td><strong>Deployment</strong></td>
4343
<td><strong>Collection Endpoint</strong></td>
@@ -107,7 +107,7 @@ https://endpoint9.collection.us2.sumologic.com</td>
107107
<td>https://open-collectors.us2.sumologic.com</td>
108108
<td>us-west-2</td>
109109
</tr>
110-
</small></table>
110+
</table>
111111

112112

113113
### Create an endpoint to connect with the Sumo Logic endpoint service

‎docs/integrations/amazon-aws/global-intelligence-cloudtrail-secops.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ This application relies on 45 Scheduled Searches that Save to two different Inde
5151
<details>
5252
<summary>View the list of Scheduled Searches (<strong>click to expand</strong>)</summary>
5353

54-
<table><small>
54+
<table>
5555
<tr>
5656
<td><strong>Folder</strong></td>
5757
<td><strong>Scheduled Search Name (prefixed with gis_benchmarks)</strong></td>
@@ -282,7 +282,7 @@ This application relies on 45 Scheduled Searches that Save to two different Inde
282282
<td>S3_ListBuckets</td>
283283
<td>Counts S3 events related to listing buckets.</td>
284284
</tr>
285-
</small></table>
285+
</table>
286286

287287
* To reduce false positives, the benchmarks and application filter out AWS CloudTrail events from legitimate cloud services including AWS itself and CloudHealth by VMware.
288288
* Security posture requirements may vary between AWS accounts for a given customer. For example, development accounts might have less strict controls than production accounts. The app supports filtering findings by AWS account ID to facilitate AWS account level posture assessment.

‎docs/integrations/app-development/jfrog-artifactory.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ In this step, you configure four local file sources, one for each log source lis
114114
115115
The following suffixes are required. For example, you could use `_sourceCategory=<Foo>/artifactory/console`, but the suffix **artifactory/console** must be used.
116116
117-
<table><small>
117+
<table>
118118
<tr>
119119
<td><strong>Log source</strong></td>
120120
<td><strong>File Path</strong></td>
@@ -139,7 +139,7 @@ The following suffixes are required. For example, you could use `_sourceCategory
139139
<td>Traffic</td>
140140
<td>$JFROG_HOME/&#60;product&#62;/var/log/artifactory-traffic.*.log</td>
141141
<td>artifactory/traffic</td>
142-
</tr></small>
142+
</tr>
143143
</table>
144144
145145
:::note

0 commit comments

Comments
 (0)