Skip to content
Merged
Show file tree
Hide file tree
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 39 additions & 9 deletions docs/integrations/saas-cloud/1password.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ description: The Sumo Logic App for 1Password helps you monitor your 1Password a

import useBaseUrl from '@docusaurus/useBaseUrl';

<img src={useBaseUrl('img/integrations/1password/1password.png')} alt="Thumbnail icon" width="75"/>
<img src={useBaseUrl('img/integrations/1password/1password.png')} alt="Thumbnail icon" width="55"/>

1Password is a secure and convenient password manager for documents, credit card information, and addresses. The Sumo Logic app for 1Password enables you to monitor sign-in and item usage events within your 1Password account. It offers insights into failed and successful authentications, breaking down events by client applications, type, category, users, and geo-location, while also identifying outliers and analyzing threats related to sign-ins. Furthermore, the app provides in-depth tracking of critical security activities such as account activations, deletions, email changes, and group creations. It visualizes audit events by geographic location, highlights risky areas, and offers detailed logs of recent access activities and role changes. This app helps secure your 1Password vault by delivering comprehensive insights into user actions and threat intelligence on clients accessing shared vaults.

Expand All @@ -25,7 +25,10 @@ The 1Password app uses the following logs:

### Sample log messages

```json title="Sign-in attempt Event"
<details>
<summary>Sign-in attempt Event</summary>

```json
{
"uuid": "56YE2TYN2VFYRLNSHKPW5NVT5E",
"session_uuid": "A5K6COGVRVEJXJW3XQZGS7VAMM",
Expand All @@ -52,8 +55,12 @@ The 1Password app uses the following logs:
}
}
```
</details>

<details>
<summary>Item Usage Event</summary>

```json title="Item Usage Event"
```json
{
"uuid": "56YE2TYN2VFYRLNSHKPW5NVT5E",
"timestamp": "2020-06-11T16:32:50-03:00",
Expand All @@ -77,8 +84,12 @@ The 1Password app uses the following logs:
"action": "secure-copy"
}
```
</details>

<details>
<summary>Audit Events Log</summary>

```json title="Audit Events Log"
```json
{
"uuid": "56YE2TYN2VFYRLNSHKPW5NVT5E",
"timestamp": "2023-03-15T16:33:50-03:00",
Expand Down Expand Up @@ -114,6 +125,7 @@ The 1Password app uses the following logs:
}
}
```
</details>

### Sample queries

Expand Down Expand Up @@ -155,15 +167,33 @@ _sourceCategory="app/"
| fields -_messageTime
```

## Collecting logs for 1Password
## Collection configuration and app installation

import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';

<CollectionConfiguration/>

:::important
Use the [Cloud-to-Cloud Integration for 1Password](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your 1Password app is properly integrated and configured to collect and analyze your 1Password data.
:::

### Create a new collector and install the app

import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';

<AppCollectionOPtion1/>

### Use an existing collector and install the app

import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';

Follow the instructions for setting up [Cloud-to-Cloud Integration for 1Password App](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source) to create the source and use the same source category while installing the app.
<AppCollectionOPtion2/>

## Installing the 1Password app
### Use an existing source and install the app

import AppInstall from '../../reuse/apps/app-install-v2.md';
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';

<AppInstall/>
<AppCollectionOPtion3/>

## Viewing 1Password dashboards

Expand Down
39 changes: 31 additions & 8 deletions docs/integrations/saas-cloud/abnormal-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,10 @@ This app uses the Abnormal Security Source to collect [threat logs](https://app.

### Sample log messages

```json title="Threat Logs"
<details>
<summary>Threat Logs</summary>

```json
{
"abxMessageId": -569518315069455395,
"abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/-569518315069455395",
Expand Down Expand Up @@ -64,8 +67,12 @@ This app uses the Abnormal Security Source to collect [threat logs](https://app.
]
}
```
</details>

<details>
<summary>Case Logs</summary>

```json title="Case Logs"
```json
{
"cases": [
{
Expand All @@ -79,6 +86,7 @@ This app uses the Abnormal Security Source to collect [threat logs](https://app.
"total": 1
}
```
</details>

### Sample queries

Expand Down Expand Up @@ -112,17 +120,32 @@ _sourceCategory="Labs/AbnormalSecurity" sourcetype case_log

```

## Set up collection
## Collection configuration and app installation

import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';

<CollectionConfiguration/>
:::important
Use the [Cloud-to-Cloud Integration for Abnormal Security](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/abnormal-security-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Abnormal Security app is properly integrated and configured to collect and analyze your Abnormal Security data.
:::

### Create a new collector and install the app

import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';

<AppCollectionOPtion1/>

### Use an existing collector and install the app

To set up the Cloud-to-Cloud Integration Abnormal Security Source for the Abnormal Security app, follow the instructions provided [here](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/abnormal-security-source/). These instructions will guide you through the process of creating a source using the Abnormal Security Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Abnormal Security app is properly integrated and configured to collect and analyze your Abnormal Security data.
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';

## Installing the Abnormal Security app
<AppCollectionOPtion2/>

This section has instructions for installing the Abnormal Security App for Sumo Logic and descriptions of each of the dashboards.
### Use an existing source and install the app

import AppInstall2 from '../../reuse/apps/app-install-v2.md';
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';

<AppInstall2/>
<AppCollectionOPtion3/>

## Viewing Abnormal Security dashboards​

Expand Down
44 changes: 34 additions & 10 deletions docs/integrations/saas-cloud/airtable.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,24 @@
id: airtable
title: Airtable
sidebar_label: Airtable
description: The Sumo Logic App for the Airtable App offers functionality for monitoring and analyzing your organization's Airtable audit logs.
description: The Sumo Logic app for the Airtable app offers functionality for monitoring and analyzing your organization's Airtable audit logs.
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<img src={useBaseUrl('img/send-data/airtable-icon.png')} alt="airtable-icon.png" width="50" />

The Airtable App for Sumo Logic monitors and analyzes your organization's Airtable audit logs, providing insights into user activity, data trends, and security events. This app is based on the Airtable Audit Logs, which provide detailed information on all actions performed in your Airtable account.
The Airtable app for Sumo Logic monitors and analyzes your organization's Airtable audit logs, providing insights into user activity, data trends, and security events. This app is based on the Airtable Audit Logs, which provide detailed information on all actions performed in your Airtable account.

The Airtable App makes it simple to import data from your Airtable audit logs into Sumo Logic, where you can perform real-time analysis and build dashboards to visualize key metrics. You can monitor security events and gain insights into user activity across your organization.
The Airtable app makes it simple to import data from your Airtable audit logs into Sumo Logic, where you can perform real-time analysis and build dashboards to visualize key metrics. You can monitor security events and gain insights into user activity across your organization.

The Airtable App allows you to:
The Airtable app allows you to:
* Keep track of user activity within your Airtable account in real-time.
* Analyze user actions, identify failed executions, and track trends over time.
* View a summary of audit logs in table format, enabling you to identify anomalous behavior and potential security threats.
* Create customized dashboards to visualize important metrics and track key performance indicators.

The Airtable App also offers a pre-built dashboard that enables you to start monitoring your Airtable audit logs right away. The Airtable App for Sumo Logic is especially useful for organizations that must comply with regulatory requirements or maintain a high level of security. With the ability to monitor user activity and track changes in real time, you can quickly identify potential issues and respond to security incidents as they occur.
The Airtable app also offers a pre-built dashboard that enables you to start monitoring your Airtable audit logs right away. The Airtable App for Sumo Logic is especially useful for organizations that must comply with regulatory requirements or maintain a high level of security. With the ability to monitor user activity and track changes in real time, you can quickly identify potential issues and respond to security incidents as they occur.

## Log type

Expand All @@ -29,6 +29,9 @@ To understand how to access detailed records of changes made to the Airtable Ent

### Sample log messages

<details>
<summary>Click to view the sample log message</summary>

```json
{
"enterpriseaccountid": "entdfgc0BXGp",
Expand Down Expand Up @@ -58,6 +61,7 @@ To understand how to access detailed records of changes made to the Airtable Ent
}
}
```
</details>

### Sample queries

Expand All @@ -70,13 +74,33 @@ _sourceCategory="Labs/airtable"
| count_distinct (action_id)
```

## Installing the Airtable app
## Collection configuration and app installation

import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';

<CollectionConfiguration/>

:::important
Use the [Cloud-to-Cloud Integration for Airtable](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Airtable app is properly integrated and configured to collect and analyze your Airtable data.
:::

### Create a new collector and install the app

import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';

<AppCollectionOPtion1/>

### Use an existing collector and install the app

import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';

<AppCollectionOPtion2/>

Before you begin, collect logs from Airtable API and ingest them into Sumo Logic. Refer to the [Airtable API Cloud-to-Cloud Integration](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source/) to create the source and use the same source category while installing the app.
### Use an existing source and install the app

import AppInstall2 from '../../reuse/apps/app-install-v2.md';
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';

<AppInstall2/>
<AppCollectionOPtion3/>

## Viewing Airtable dashboards​

Expand All @@ -86,7 +110,7 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md';

### Overview

**Airtable - Overview** dashboard provides a high-level view of key metrics related to Airtable platform user activity, audits, and execution. It contains widgets that display data such as total audit logs and failed executions, action distribution, and top-performing actions and users. The dashboard also provides information on activity trends over time and user locations. The Audit Log Summary widget provides a quick overview of all platform activity. Overall, the dashboard helps users quickly understand how the platform is used and identify areas for improvement.<br/><img src={useBaseUrl('img/integrations/saas-cloud/airtable-overview.png')} alt="airtable-overview.png" width="600"/>
The **Airtable - Overview** dashboard provides a high-level view of key metrics related to Airtable platform user activity, audits, and execution. It contains widgets that display data such as total audit logs and failed executions, action distribution, and top-performing actions and users. The dashboard also provides information on activity trends over time and user locations. The Audit Log Summary widget provides a quick overview of all platform activity. Overall, the dashboard helps users quickly understand how the platform is used and identify areas for improvement.<br/><img src={useBaseUrl('img/integrations/saas-cloud/airtable-overview.png')} alt="airtable-overview.png" width="600"/>

## Upgrade/Downgrade the Airtable app (Optional)

Expand Down
36 changes: 30 additions & 6 deletions docs/integrations/saas-cloud/atlassian.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@ This app uses Sumo Logic’s Atlassian Source to collect [Event Logs](https://de

### Sample log message

<details>
<summary>Event Log</summary>

```json title="Event Log"
{
"type": "events",
Expand Down Expand Up @@ -70,6 +73,7 @@ This app uses Sumo Logic’s Atlassian Source to collect [Event Logs](https://de
}
}
```
</details>

### Sample queries

Expand All @@ -86,17 +90,37 @@ _sourceCategory="Labs/Atlassian"
| sort by frequency
```

## Set up collection
## Collection configuration and app installation

Depending on the set up collection method, you can configure and install the app in three ways:

- **[Create a new collector and install the app](#create-a-new-collector-and-install-the-app)**. Create a new Sumo Logic Cloud-to-Cloud (C2C) source under a new Sumo Logic Collector and later install the app; Or
- **[Use an existing collector and install the app](#use-an-existing-collector-and-install-the-app)**. Create a new Sumo Logic Cloud-to-Cloud (C2C) source under an existing Sumo Logic Collector and later install the app; Or
- **[Use existing source and install the app](#use-an-existing-source-and-install-the-app)**. Use your existing configured Sumo Logic Cloud-to-Cloud (C2C) source and install the app.

:::important
Use the [Cloud-to-Cloud Integration for Atlassian](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/atlassian-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Atlassian app is properly integrated and configured to collect and analyze your Atlassian data.
:::

### Create a new collector and install the app

import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';

<AppCollectionOPtion1/>

### Use an existing collector and install the app

import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';

To set up [Cloud-to-Cloud Integration Atlassian Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/atlassian-source) for the Atlassian app, follow the instructions provided. These instructions will guide you through the process of creating a source using the Atlassian Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Atlassian app is properly integrated and configured to collect and analyze your Atlassian data.
<AppCollectionOPtion2/>

## Installing the Atlassian app
### Use an existing source and install the app

import AppInstall2 from '../../reuse/apps/app-install-v2.md';
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';

<AppInstall2/>
<AppCollectionOPtion3/>

## Viewing Atlassian dashboards
## Viewing the Atlassian dashboards

import ViewDashboards from '../../reuse/apps/view-dashboards.md';

Expand Down
Loading
Loading