Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
799ee3e
DOCS-868 - Free tier plan deprecation
kimsauce May 6, 2025
c8115aa
Update docs/alerts/webhook-connections/opsgenie.md
kimsauce May 6, 2025
37ca195
Update docs/integrations/security-threat-detection/threat-intel-quick…
kimsauce May 6, 2025
e67edfa
Update docs/integrations/security-threat-detection/threat-intel-quick…
kimsauce May 6, 2025
a34fcd0
Update docs/integrations/security-threat-detection/threat-intel-quick…
kimsauce May 6, 2025
0dc38ac
Update docs/integrations/security-threat-detection/threat-intel-quick…
kimsauce May 6, 2025
fa8cc0b
Update docs/integrations/security-threat-detection/threat-intel-quick…
kimsauce May 6, 2025
df3e37f
missing backticks
kimsauce May 6, 2025
d533710
fix error
kimsauce May 6, 2025
c737258
Merge branch 'main' into DOCS-868
kimsauce May 6, 2025
11cc815
edits per PLG team
kimsauce May 6, 2025
6b6f19f
Merge branch 'DOCS-868' of github.com:SumoLogic/sumologic-documentati…
kimsauce May 6, 2025
1ed4d1b
Merge branch 'main' into DOCS-868
kimsauce May 6, 2025
48d0daf
Merge branch 'main' into DOCS-868
kimsauce May 7, 2025
f5ea08c
Merge branch 'DOCS-868' of github.com:SumoLogic/sumologic-documentati…
kimsauce May 7, 2025
3de13c7
fix per MS
kimsauce May 7, 2025
e82fdca
Merge branch 'main' into DOCS-868
kimsauce Jun 6, 2025
ffdbc75
Merge branch 'main' into DOCS-868
kimsauce Jun 6, 2025
8bfc73f
round 1 - reverts
kimsauce Jun 6, 2025
61e9294
Update docs/alerts/webhook-connections/opsgenie-legacy.md
kimsauce Jun 6, 2025
86c9130
Update docs/alerts/monitors/overview.md
kimsauce Jun 6, 2025
cd670d6
Merge branch 'main' into DOCS-868
kimsauce Jun 6, 2025
2130fc6
Merge branch 'DOCS-868' of github.com:SumoLogic/sumologic-documentati…
kimsauce Jun 6, 2025
5613e34
Update docs/alerts/webhook-connections/opsgenie.md
kimsauce Jun 6, 2025
de6155f
Update docs/get-started/sign-up.md
kimsauce Jun 6, 2025
6850cd6
round 2- revert
kimsauce Jun 6, 2025
89fe6c5
Merge branch 'DOCS-868' of github.com:SumoLogic/sumologic-documentati…
kimsauce Jun 6, 2025
951025a
Update docs/manage/manage-subscription/cloud-flex-legacy-accounts.md
kimsauce Jun 6, 2025
b0bf6bf
Update docs/manage/ingestion-volume/log-ingestion.md
kimsauce Jun 6, 2025
23a7f62
Update docs/manage/manage-subscription/close-cancel-sumo-account.md
kimsauce Jun 6, 2025
081ff68
Update docs/manage/manage-subscription/create-and-manage-orgs/manage-…
kimsauce Jun 6, 2025
1d5bff1
Update docs/manage/manage-subscription/create-and-manage-orgs/manage-…
kimsauce Jun 6, 2025
9cc4c2e
revert round 3
kimsauce Jun 6, 2025
fd4836d
Merge branch 'DOCS-868' of github.com:SumoLogic/sumologic-documentati…
kimsauce Jun 6, 2025
91d22de
Update create-lookup-table.md
kimsauce Jun 6, 2025
cdb194c
Update set-time-range.md
kimsauce Jun 6, 2025
ea2e034
Update overview.md
kimsauce Jun 6, 2025
f936b07
Update opsgenie-legacy.md
kimsauce Jun 6, 2025
535ef53
Update opsgenie.md
kimsauce Jun 6, 2025
3e3952d
Update apps-integrations.md
kimsauce Jun 6, 2025
c7a3bb5
Update docs/manage/manage-subscription/upgrade-account/upgrade-cloud-…
kimsauce Jun 6, 2025
974c435
Update index.md
kimsauce Jun 6, 2025
227362c
Update usage-management.md
kimsauce Jun 6, 2025
9b438ab
revert
kimsauce Jun 6, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions docs/alerts/monitors/alert-response-faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ Overall, yes. Alert response is available in all the Sumo Logic packages. Howeve

| Package | Related Alerts | Monitor History | Playbooks |
|:--|:--|:--|:--|
| Free | Yes | Yes | Yes |
| Essentials | Yes | Yes | Yes |
| Enterprise Security | Yes | Yes | Yes |
| Enterprise Operations | Yes | Yes | Yes |
Expand All @@ -22,7 +21,6 @@ Overall, yes. Alert response is available in all the Sumo Logic packages. Howeve

| Package | Log Fluctuations | Dimensional Explanation | Anomaly | Benchmark |
|:--|:--|:--|:--|:--|
| Free | Yes | Yes | No | No |
| Essentials | Yes | Yes | No | No |
| Enterprise Security | Yes | Yes | No | Yes |
| Enterprise Operations | Yes | Yes | Yes | Yes |
Expand Down
2 changes: 0 additions & 2 deletions docs/alerts/monitors/overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ See [Trigger Type (Logs)](/docs/alerts/monitors/create-monitor/#trigger-type-log
* Log monitors delay execution by two minutes. This means it won't evaluate data from the current time, but evaluate data from two minutes ago. This ensures that any delays in ingestion are factored in and won't generate false positive or false negative alerts.
* Enterprise and Trial plan customers can have up to 1,000 log monitors.
* Essentials and Professional plan customers can have up to 300 log monitors.
* Free Trial customers can have up to 50 log monitors.

#### Auto-resolving notifications

Expand All @@ -49,7 +48,6 @@ Log monitors in a triggered state can auto-resolve.
* Metrics monitors delay execution by one minute.
* Enterprise and Trial plan customers can have up to 1,500 Metrics monitors.
* Essentials and Professional plan customers can have up to 500 Metrics monitors.
* Free Trial customers can have up to 50 Metrics monitors.

## Notifications

Expand Down
2 changes: 1 addition & 1 deletion docs/alerts/webhook-connections/opsgenie-legacy.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ To add a Sumo Logic integration in Opsgenie, do the following:
* Add the team who will be notified of Sumo Logic Alerts.
* Copy the Integration URL, to be used in Sumo Logic while setting up the Webhook Connection.
:::note
For **Free** and **Essentials** plans, you can only add the integration from the Team Dashboard. Use the alternative instructions. To add an integration directly to a team, navigate to the Team Dashboard and open the Integrations tab. Click **Add Integration** and search for Sumo Logic and click **add**.
For **Essentials** plans, you can only add the integration from the Team Dashboard. Use the alternative instructions. To add an integration directly to a team, navigate to the Team Dashboard and open the Integrations tab. Click **Add Integration** and search for Sumo Logic and click **add**.
:::
1. Click **Save Integration**.

Expand Down
4 changes: 2 additions & 2 deletions docs/alerts/webhook-connections/opsgenie.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ To add a Sumo Logic integration in Opsgenie, do the following:
* Add the team who will be notified of Sumo Logic Alerts.
* Copy the **Integration Url**, it is used in Sumo Logic while setting up the Webhook Connection.
:::note
For **Free** and **Essentials** plans, you can only add the integration from the Team Dashboard. Use the alternative instructions. To add an integration directly to a team, navigate to the Team Dashboard and open the Integrations tab. Click **Add Integration** and search for Sumo Logic and click **add**.
For **Essentials** plans, you can only add the integration from the Team Dashboard. Use the alternative instructions. To add an integration directly to a team, navigate to the Team Dashboard and open the Integrations tab. Click **Add Integration** and search for Sumo Logic and click **add**.
:::
1. Click **Save Integration**.

Expand All @@ -45,7 +45,7 @@ You need the **Manage connections** [role capability](/docs/manage/users-roles

This section demonstrates how to create a webhook connection from Sumo Logic to Opsgenie.

1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Connections**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Monitoring** select **Connections**. You can also click the **Go To...** menu at the top of the screen and select **Connections**.
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Connections**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Monitoring** select **Connections**. You can also click the **Go To...** menu at the top of the screen and select **Connections**.
1. Click **+ Add** and choose **Opsgenie** as the connection type.<br/> ![Opsgenie webhook button.png](/img/connection-and-integration/opsgenie-webhook-button.png)
1. Enter a **Name** and give an optional **Description** to the connection.
1. Paste the **Integration Url** from Opsgenie into the **URL** field.
Expand Down
2 changes: 1 addition & 1 deletion docs/api/troubleshooting.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ When running an API query for the Sumo Logic [Search Job API](/docs/api/search-j

#### Answer

The API- 403 error occurs when you do not have access to the Search Job API, which is only available for Enterprise-level accounts. If you're currently on a Sumo Logic Free or Professional account, you'll receive this error message if you try to access these APIs.
The API- 403 error occurs when you do not have access to the Search Job API, which is only available for Enterprise-level accounts. If you're currently on a Sumo Logic Professional account, you'll receive this error message if you try to access these APIs.

If you need access to these APIs, reach out to your Sumo Logic sales representative or [contact us](https://www.sumologic.com/contact-us/) for more information on upgrading your existing account.

Expand Down
2 changes: 1 addition & 1 deletion docs/dashboards/panels/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ Text can clarify what you are showing on dashboards or act as a note to your v

Titles are displayed in the same size and font. Text is styled using Markdown syntax, meaning that you can control the size and weight of the text. Not all Markdown syntax options are supported; see [Markdown Syntax](markdown-syntax.md).

There is no limit to the number of Text Panels you can add to Dashboards. These types of Panels do not count against the quota in Sumo Logic Free accounts.
There is no limit to the number of Text Panels you can add to Dashboards.

To add a Text Panel:

Expand Down
2 changes: 1 addition & 1 deletion docs/get-started/apps-integrations.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ These apps have gone through code and functional review with the Sumo Logic app
Certain apps have specific installation requirements. Be sure to check the instructions for your application for specific instructions.

:::important
Applications can be installed only by users with a Sumo Logic Professional or a Sumo Logic Enterprise account. Organizations with a Sumo Logic Free account currently cannot use Sumo Logic apps.
Applications can be installed only by users with a Sumo Logic Professional or a Sumo Logic Enterprise account.
:::

## Next-Gen apps
Expand Down
40 changes: 16 additions & 24 deletions docs/get-started/sign-up.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,7 @@ description: Learn how to sign up with Sumo Logic and create your account.

import useBaseUrl from '@docusaurus/useBaseUrl';

Sumo Logic provides everything you need to conduct real-time forensics and log management for all of your IT data—without the hassle of managing or scaling hardware or storage. Start your 30-day trial and explore the full capabilities of our Continuous Intelligence Platform™, including elastic scalability and powerful analytics.

After your trial, your account will automatically convert to a [Free account](#upgrade-or-continue-with-free-account), allowing you to continue with limited features. You can [upgrade to a paid plan](https://www.sumologic.com/pricing) at any time to unlock premium features. Choose to sign up via the [Sumo Logic website](#sign-up-through-sumo-logic) or the [AWS Marketplace](#sign-up-through-aws-marketplace) and start using Sumo Logic in minutes.
Sumo Logic provides everything you need to conduct real-time forensics and log management for all of your IT data without the hassle of managing or scaling hardware or storage. Start your 30-day trial and explore the full capabilities of our Continuous Intelligence Platform™, including elastic scalability and powerful analytics. Sign up through the [Sumo Logic website](#sign-up-through-sumo-logic) or the [AWS Marketplace](#sign-up-through-aws-marketplace) and start using Sumo Logic in minutes.

## Sign up through Sumo Logic

Expand Down Expand Up @@ -45,41 +43,35 @@ When the installation is complete, click **Start using Sumo**.

Your data will start flowing in a couple of minutes. Next, you'll be taken to a step-by-step onboarding guide, where you can visualize your data via dashboards, run your first log search, set up alerts, install apps, and more.

### Upgrade or continue with Free account

After your trial ends, if you've not purchased a plan, your account will automatically convert to a Free account. This account lets you continue using Sumo Logic monitoring and log analytics services with limited features. To unlock premium features and scale as your needs grow, you can upgrade to a paid plan at any time.

<details>
<summary>What's the difference between a Trial and a Free account?</summary>
### Upgrade your account

With your trial, you’ll have full access to our Enterprise plan to explore all the powerful features Sumo Logic has to offer.
During your trial, you’ll have full access to our Enterprise plan, giving you the opportunity to explore the full range of Sumo Logic's powerful features.

| | Trial account | Free account
|:------------|:---------------|:------------
| Data volume daily | 1GB | 500MB
| Users | Up to 20 | Up to 3
| Data Retention <sup>1</sup>| 30 days | 7 days
| Metrics <sup>2</sup> | &#9989; | &#10060;
| Data Forwarding <sup>3</sup> | &#9989; | &#10060;
| Real-time Alerts <sup>4</sup> | &#9989; | &#10060;
| Feature | Trial account |
|:--------------------------------|:--------------------|
| **Data volume daily** | 1GB |
| **Users** | Up to 20 |
| **Data retention** <sup>1</sup> | 30 days |
| **Metrics** <sup>2</sup> | &#9989; |
| **Data forwarding** <sup>3</sup> | &#9989; |
| **Real-time alerts** <sup>4</sup> | &#9989; |

<sup>1</sup> Data uploaded to the Sumo Logic Cloud.<br/>
<sup>2</sup> Search through and visualize your data in near real-time, with up to 1000 data points per minute.<br/>
<sup>3</sup> Forwards your logs to an S3 bucket after being collected and analyzed in Sumo Logic.<br/>
<sup>4</sup> Notifies you in real-time when errors occur on your systems.

</details>
Once your trial ends, you'll need to upgrade to a paid plan to continue using premium features. Below is an overview of the available options. For detailed pricing and plan information, see [Sumo Logic Pricing](https://www.sumologic.com/pricing) and [Manage Subscription](/docs/manage/manage-subscription).

For information on plan types and pricing, see [Sumo Logic Pricing](https://www.sumologic.com/pricing) and [Manage Subscription](/docs/manage/manage-subscription).

#### Essentials plans

Using our self-service checkout, you can sign up for a Sumo Logic Essentials plan in just minutes using a credit card—no need to interact with the sales team.
With our self-service checkout, you can upgrade to an Essentials plan in just minutes using a credit card—no need to contact Sales.

- [Learn how to upgrade your plan with Credits account](/docs/manage/manage-subscription/upgrade-account/upgrade-credits-account).
- [Learn how to upgrade your plan with Flex account](/docs/manage/manage-subscription/upgrade-account/upgrade-sumo-logic-flex-account).
- [Upgrade a Flex account](/docs/manage/manage-subscription/upgrade-account/upgrade-sumo-logic-flex-account)
- [Upgrade a Credits account](/docs/manage/manage-subscription/upgrade-account/upgrade-credits-account)

<img src={useBaseUrl('img/manage/subscriptions/essentials-landing-page.png')} alt="Essentials landing page checkout" style={{border: '1px solid gray'}} width="600" />
<img src={useBaseUrl('img/manage/subscriptions/essentials-landing-page.jpg')} alt="Essentials landing page checkout" style={{border: '1px solid gray'}} width="600" />

#### Enterprise plans

Expand Down
6 changes: 3 additions & 3 deletions docs/integrations/amazon-aws/threat-intel.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

The Threat Intel for AWS App correlates Sumo Logic [threat intelligence](/docs/security/threat-intelligence/) data with your AWS log data, allowing for real-time security analytics to help detect threats in your environment and protect against cyber-attacks. The Threat Intel for AWS App scans your AWS CloudTrail, AWS ELB and AWS VPC Flow logs for threats based on IP address.

The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professions accounts, or during a 30-day trial period. The Threat Intel lookup database is not available for Sumo Logic Free accounts.
The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period.


## Collect Logs for the Threat Intel for AWS App

The Threat Intel for AWS App utilizes AWS logs and VPC Flow Logs.

The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period. The Threat Intel lookup database is not available for Sumo Logic Free accounts.
The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period.


### Configure Collectors and Sources
Expand All @@ -33,7 +33,7 @@ VPC Flow Logs can be published to Amazon CloudWatch Logs and Amazon S3. Each met

## Installing the Threat Intel for AWS App

The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professions accounts, or during a 30-day trial period. The Threat Intel lookup database is not available for Sumo Logic Free accounts.
The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period.

Now that you have set up collection, install the Sumo Logic App for Threat Intel for AWS to use the preconfigured searches and [Dashboards](/docs/integrations/amazon-aws/threat-intel#viewing-threat-intel-dashboards) that provide insight into your data.

Expand Down
2 changes: 1 addition & 1 deletion docs/integrations/app-development/jfrog-artifactory.md
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ For complete instructions, see [Local File Source](/docs/send-data/installed-col

The JFrog Artifactory Sumo Logic integration provides the ability to access preconfigured Sumo Logic Dashboards directly from Artifactory that will allow you to analyze data from your Artifactory logs.

**If you do not have an existing Sumo Logic account**, enable the JFrog Artifactory Sumo Logic integration directly from Artifactory. When you enable the integration, a Sumo Logic Connector and Source get automatically configured, and the Sumo Logic App for Artifactory gets installed automatically. The JFrog Artifactory Sumo Logic integration provides a new Sumo Logic Free account with a daily data volume limit of 500MB per day, with 30 users and 14 days of data retention.
**If you do not have an existing Sumo Logic account**, enable the JFrog Artifactory Sumo Logic integration directly from Artifactory. When you enable the integration, a Sumo Logic Connector and Source get automatically configured, and the Sumo Logic App for Artifactory gets installed automatically.

**If you have an existing Sumo Logic account**, you can configure Artifactory Online to send data (described below) to an existing Sumo Logic [HTTP Logs and Metrics](/docs/send-data/hosted-collectors/http-source/logs-metrics) source.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ _sourceCategory=cylance "IP Address"

<!-- Per DOCS-643, replace section content with this after `sumo://threat/cs` is replaced by `threatlookup`:

The app provides baseline queries that utilize the [`threatlookup` search operator](/docs/search/search-query-language/search-operators/threatlookup/) to look for threat intelligence data. To see the queries, open a [dashboard in the app](#viewing-threat-intel-quick-analysis-dashboards), click the three-dot kebab in the upper-right corner of the dashboard panel, and select **Open in Log Search**.
The app provides baseline queries that utilize the [`threatlookup` search operator](/docs/search/search-query-language/search-operators/threatlookup/) to look for threat intelligence data. To see the queries, open a [dashboard in the app](#viewing-threat-intel-quick-analysis-dashboards), click the three-dot kebab in the upper-right corner of the dashboard panel, and select **Open in Log Search**.

You can further optimize and enhance these queries for the log and events types being scanned for threats. Use the following guidelines to customize your threat intel queries:

Expand All @@ -58,14 +58,14 @@ You can further optimize and enhance these queries for the log and events types
For example, here is the query used for the **Threat Count** panel in the [Threat Intel Quick Analysis - IP](#ip) dashboard:

```
_sourceCategory=<source-category-name>
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
_sourceCategory=<source-category-name>
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| where ip_address != "0.0.0.0" and ip_address != "127.0.0.1"
| count as ip_count by ip_address

| threatlookup singleIndicator ip_address

// normalize confidence level to a string
// normalize confidence level to a string
| if (_threatlookup.confidence >= 85, "high", if (_threatlookup.confidence >= 50, "medium", if (_threatlookup.confidence >= 15, "low", if (_threatlookup.confidence >= 0, "unverified", "unknown")))) as threat_confidence

// filter for threat confidence
Expand Down Expand Up @@ -106,7 +106,7 @@ Use [Field Extraction Rules (FER)](/docs/manage/field-extractions/create-field-e
| if (isEmpty(actor), "Unassigned", actor) as Actor
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name
| sort by threat_count
```
```
<!-- Per DOCS-643, replace the preceding step with the following after `sumo://threat/cs` is replaced by `threatlookup`:
1. Customize your query so you can use parsed fields from the Field Extraction Rule with the [`threatlookup` search operator](/docs/search/search-query-language/search-operators/threatlookup/), where `src_ip` is the parsed field from the FER. For example:
```
Expand Down Expand Up @@ -140,7 +140,7 @@ Use scheduled views with the threat lookup operator to find threats. Scheduled v
_view=cylance_threat
| count by src_ip
```

## Threat Intel FAQ

#### What is the CrowdStrike Integration for Sumo Logic?
Expand All @@ -150,7 +150,7 @@ Sumo Logic has expanded its security offerings by allowing customers to analyze
* Sumo Logic maintains an up-to-date copy of CrowdStrike’s threat database.
* Sumo customers can now use the CrowdStrike database in threat analysis queries over their logs (through a new lookup operator).

The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period. The Threat Intel lookup database is not available for Sumo Logic Free accounts.
The Sumo Logic Threat Intel lookup database is only available with Sumo Logic Enterprise and Professional accounts, or during a 30-day trial period.


#### What does the Threat Intel Quick Analysis App do?
Expand Down Expand Up @@ -506,4 +506,4 @@ import AppUpdate from '../../reuse/apps/app-update.md';

import AppUninstall from '../../reuse/apps/app-uninstall.md';

<AppUninstall/>
<AppUninstall/>
Loading