diff --git a/docs/alerts/monitors/create-monitor.md b/docs/alerts/monitors/create-monitor.md index eae53f24bc..f4ece04179 100644 --- a/docs/alerts/monitors/create-monitor.md +++ b/docs/alerts/monitors/create-monitor.md @@ -13,6 +13,14 @@ Our alerts use machine learning to analyze historical data, establish baselines, Integrated playbooks automate incident response by gathering diagnostics, notifying teams, triggering recovery actions, and streamlining workflows to improve response times. You can link playbooks to monitors to automate tasks such as restarting services or scaling infrastructure, ensuring swift and efficient anomaly resolution. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage monitors with the [`sumologic_monitor`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/monitor) and [`sumologic_monitor_folder`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/monitor_folder) resources. + + +::: + ## Open the New Monitor window There are several ways to create a new monitor, depending on where you are in Sumo Logic. diff --git a/docs/alerts/monitors/muting-schedules.md b/docs/alerts/monitors/muting-schedules.md index 7eb5498616..e837cab72d 100644 --- a/docs/alerts/monitors/muting-schedules.md +++ b/docs/alerts/monitors/muting-schedules.md @@ -11,6 +11,14 @@ Setting a **Muting Schedule** allows you to pause alert notifications from monit * **Planned System Maintenance**. During system maintenance, notifications can get triggered because your application and infrastructure are being brought up or turned off. Such notifications are known false alarms and should be ignored. * **Off-Business Hours**. If your monitors reflect performance thresholds that are only applicable during business hours, such monitors might generate false alarms during off-business hours. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage muting schedules with the [`sumologic_muting_schedule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/muting_schedule) resource. + + +::: + ## Prerequisites Make sure you've enabled the [**View Muting Schedules**](/docs/manage/users-roles/roles/role-capabilities/#alerting) and [**Manage Muting Schedules**](/docs/manage/users-roles/roles/role-capabilities/#alerting) user permissions, which allow you to define and edit a muting schedule. diff --git a/docs/alerts/scheduled-searches/schedule-search.md b/docs/alerts/scheduled-searches/schedule-search.md index 0b020f3415..89f9b50136 100644 --- a/docs/alerts/scheduled-searches/schedule-search.md +++ b/docs/alerts/scheduled-searches/schedule-search.md @@ -10,6 +10,14 @@ This article outlines the process of creating a Scheduled Search, which is essen To run a Scheduled Search using receipt time, save the search with receipt time enabled. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage content such as scheduled searches with the [`sumologic_content`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/content) resource. + + +::: + ## Create a Scheduled Search This section describes how to create a Scheduled Search at the time you save a search. You can also edit a saved search later to add a schedule. diff --git a/docs/alerts/webhook-connections/set-up-webhook-connections.md b/docs/alerts/webhook-connections/set-up-webhook-connections.md index c72f36e482..fd5a43755a 100644 --- a/docs/alerts/webhook-connections/set-up-webhook-connections.md +++ b/docs/alerts/webhook-connections/set-up-webhook-connections.md @@ -23,6 +23,14 @@ Most services with a REST API should allow you to create a connection using the If a scheduled search fails or times out, no data will be sent via webhook. In this case, you won’t see any notifications in the app you’ve configured to receive data. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage webhook connections with the [`sumologic_connection`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/connection) resource. + + +::: + ## Set up a webhook connection The first step in integrating webhooks with Sumo Logic is to configure one or more connections, which are HTTP endpoints that tell Sumo Logic where to send data. You can set up any number of connections, depending on your organization's needs. diff --git a/docs/api/about-apis/terraform-with-sumo-logic.md b/docs/api/about-apis/terraform-with-sumo-logic.md index 89bd092447..68d1688657 100644 --- a/docs/api/about-apis/terraform-with-sumo-logic.md +++ b/docs/api/about-apis/terraform-with-sumo-logic.md @@ -11,15 +11,132 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; ## What is Terraform? -[Terraform](https://developer.hashicorp.com/terraform) is an "infrastructure as code" tool developed by Hashicorp. Terraform scripts are used to define both cloud and on-prem resources in human-readable configuration files. Using Terraform scripts makes it easier for system administrators to provision and manage infrastructure and system resources consistently and reliably. The Terraform community, including Sumo Logic, supports Terraform through providers and APIs allowing applications to install and manage different types of resources and services from different vendors in one workflow. See the [Terraform Sumo Logic provider](https://registry.terraform.io/namespaces/SumoLogic). - -## Sumo Logic use cases - -You can use Terraform to manage all sorts of Sumo Logic resources. Here are some use cases: -* [Manage monitors](https://www.sumologic.com/blog/terraform-sumo-logic) -* [Manage collectors, users, and roles](https://www.sumologic.com/blog/terraform-provider-hosted) -* [Deploy solutions (like AWS Observability)](/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform/) -* [Manage Cloud SIEM rules](https://www.sumologic.com/guides/detections-as-code-setup) +[Terraform](https://developer.hashicorp.com/terraform) is an "infrastructure as code" tool developed by Hashicorp. Terraform scripts are used to define both cloud and on-prem resources in human-readable configuration files. Using Terraform scripts makes it easier for system administrators to provision and manage infrastructure and system resources consistently and reliably. The Terraform community, including Sumo Logic, supports Terraform through providers and APIs allowing applications to install and manage different types of resources and services from different vendors in one workflow. See the [Terraform Sumo Logic provider](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). + +## Sumo Logic Terraform resources + +You can use Terraform resources to manage all sorts of Sumo Logic components. Following are some examples. +
+ +Resources + +* Accounts + * [Subdomains](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/subdomain) +* [Apps](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/app) +* Automation service + * [Playbooks](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/csoar_playbook) +* Cloud SIEM + * [Automation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_automation) + * [Context actions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_context_action) + * Entities + * [Custom entity types](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_entity_type) + * [Entity criticality](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_criticality_config) + * [Entity groups](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_entity_group_configuration) + * [Entity normalization](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_normalization_configuration) + * [Inventory entity groups](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_inventory_entity_group_configuration) + * Insights + * [Configuration](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_configuration) + * [Custom insights](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_insight) + * [Resolution](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_resolution) + * [Status](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_status) + * [Log mapping](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_log_mapping) + * [Match lists](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_match_list) + * [Custom match list columns](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_match_list_column) + * [Network blocks](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_network_block) + * Rules + * [Aggregation rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_aggregation_rule) + * [Chain rule](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_chain_rule) + * [First seen rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_first_seen_rule) + * [Match rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_match_rule) + * [Outlier rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_outlier_rule) + * [Rule tuning expressions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_rule_tuning_expression) + * [Threshold rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_threshold_rule) + * [Tag schemas](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_tag_schema) +* [Collectors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/collector) + * [Installed collectors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/installed_collector) + * [OpenTelemetry collectors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/ot_collector) +* [Connections](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/connection) +* [Content](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/content) + * [Content sharing](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/content_permission) +* [Dashboards](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/dashboard) +* Data forwarding + * [Data forwarding destinations](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/data_forwarding_destination) + * [Data forwarding rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/data_forwarding_rule) +* [Fields](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/field) + * [Field extraction rules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/field_extraction_rule) +* [Folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/folder) +* [Hierarchies](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/hierarchy) +* [Ingest budgets](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/ingest_budget_v2) +* [Log searches](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/log_search) +* [Lookup table](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/lookup_table) +* Metrics + * [Metrics search](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/metrics_search) + * [Metrics search V2](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/metrics_search_v2) +* [Monitors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/monitor) + * [Monitors folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/monitor_folder) +* [Muting schedules](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/muting_schedule) +* [Partitions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/partition) +* [Password policies](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/password_policy) +* [Policies](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/policies) +* [Roles](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/role) + * [Roles v2](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/role_v2) +* [SAML configuration](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/saml_configuration) +* [Scan budget](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/scan_budget) +* [Scheduled views](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/scheduled_view) +* [SLOs](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/slo) + * [SLO folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/slo_folder) +* Sources + * [AWS S3 source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/s3_source) + * [AWS S3 Archive source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/s3_archive_source) + * [AWS S3 Audit source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/s3_audit_source) + * [AWS inventory source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/aws_inventory_source) + * [AWS XRay source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/aws_xray_source) + * [Azure Event Hub log source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/azure_event_hub_log_source) + * [Azure metrics source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/azure_metrics_source) + * [Cloud-to-Cloud source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloud_to_cloud_source) + * [CloudFront source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudfront_source) + * [Cloud Syslog source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudsyslog_source) + * [CloudTrail source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudtrail_source) + * [CloudWatch source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudwatch_source) + * [ELB source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/elb_source) + * [GCP Metrics source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/gcp_metrics_source) + * [GCP source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/gcp_source) + * [HTTP source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/http_source) + * [Kinesis Log source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/kinesis_log_source) + * [Kinesis Metrics source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/kinesis_metrics_source) + * [Local file source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/local_file_source) + * [Local Windows Event Log source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/local_windows_event_source) + * [Metadata source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/metadata_source) + * [Rum Source](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/rum_source) +* [Source templates](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/source_template) +* [Tokens](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/token) +* [Users](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/user) + +
+ +## Sumo Logic Terraform data sources + +You can use Terraform data sources to retrieve Sumo Logic data from your Terraform configuration. Following are some examples. + +
+ +Data sources + +* [Admin recommended folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/admin_recommended_folder) +* [Apps](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/apps) +* [Caller identity](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/caller_identity) +* [Collectors](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/collector) +* [Cloud SIEM log mapping](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/cse_log_mapping_vendor_product) +* [Folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/folder) +* [HTTP sources](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/http_source) +* [Partitions](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/partitions) + * [Partition details](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/partition) +* [Personal folders](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/personal_folder) +* [Roles](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/role) + * [Roles v2](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/role_v2) +* [Users](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/data-sources/user) + +
## Prerequisites @@ -93,7 +210,9 @@ Let's look at some examples: ### Terraform providers -A *provider* is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. Sumo Logic has an established Terraform provider plugin, as does AWS and other major cloud vendors. The Terraform script section defining the provider for resources defined by other parts of the script might look like this: +A *provider* is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). + +Sumo Logic has an established Terraform provider plugin, as does AWS and other major cloud vendors. The Terraform script section defining the provider for resources defined by other parts of the script might look like this: ``` provider "aws" { @@ -119,7 +238,9 @@ terraform { ### Terraform resources -A *resource* is an infrastructure element that can be defined and created from the available resources produced by the provider. A resource definition will look similar in form to the provider definition: +A *resource* is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). + +A resource definition will look similar in form to the provider definition: ``` resource "aws_s3_bucket" "training" { diff --git a/docs/apm/real-user-monitoring/configure-data-collection.md b/docs/apm/real-user-monitoring/configure-data-collection.md index 784850ae5d..edd739b6b5 100644 --- a/docs/apm/real-user-monitoring/configure-data-collection.md +++ b/docs/apm/real-user-monitoring/configure-data-collection.md @@ -33,6 +33,14 @@ To utilize XHR and navigation/route changes, and errors collection, you must use For full end-to-end visibility, we recommended supplementing your RUM browser auto-instrumentation with the appropriate [back-end tracing instrumentation](/docs/apm/traces/get-started-transaction-tracing). +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a RUM source with the [`sumologic_rum_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/rum_source) resource. + + +::: + ## Step 1: Create a RUM HTTP Traces Source To configure a RUM HTTP Traces source: diff --git a/docs/cse/administration/create-a-custom-tag-schema.md b/docs/cse/administration/create-a-custom-tag-schema.md index 12a0f5ebc3..747c2983c6 100644 --- a/docs/cse/administration/create-a-custom-tag-schema.md +++ b/docs/cse/administration/create-a-custom-tag-schema.md @@ -19,6 +19,14 @@ Schema tags can enforce specific tag values and prevent confusion from variatio For more information about tags in Cloud SIEM, see [Using Tags with Insights, Signals, Entities, and Rules](/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules). +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage custom tag schemas with the [`sumologic_cse_tag_schema`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_tag_schema) resource. + + +::: + ## Define a custom tag schema 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM**, and then under **Cloud SIEM Workflow** select **Tag Schemas**. You can also click the **Go To...** menu at the top of the screen and select **Tag Schemas**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top Cloud SIEM menu select **Configuration**, and then under **Workflow** select **Tag Schemas**. diff --git a/docs/cse/administration/create-cse-context-actions.md b/docs/cse/administration/create-cse-context-actions.md index ce53dc46f6..8b3d978358 100644 --- a/docs/cse/administration/create-cse-context-actions.md +++ b/docs/cse/administration/create-cse-context-actions.md @@ -26,6 +26,14 @@ An authorized user can configure context actions and assign them to particular e The context actions menu will be available for any of these types, wherever they appear in the Cloud SIEM UI. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage context actions with the [`sumologic_cse_context_action`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_context_action) resource. + + +::: + ## How a user accesses context actions A user runs a context action by clicking the context action icon Context action icon next to an entity, record field, or IOC and choosing an action from the list that appears. The icon appears when you hover over the value of the item. diff --git a/docs/cse/administration/create-use-network-blocks.md b/docs/cse/administration/create-use-network-blocks.md index 8b97c31a8d..aa412fc5e8 100644 --- a/docs/cse/administration/create-use-network-blocks.md +++ b/docs/cse/administration/create-use-network-blocks.md @@ -27,6 +27,14 @@ When you configure a network block, there is an option to suppress signals on th IP addresses in a network block for which signals are suppressed will not appear on the **Suppressed Entities** page in the Cloud SIEM UI. (You can’t manually unsuppress signals for an IP address that are suppressed due to its network block configuration.) ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage network blocks with the [`sumologic_cse_network_block`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_network_block) resource. + + +::: + ## Best practices for network blocks As you configure network blocks, keep in mind the following considerations. diff --git a/docs/cse/administration/manage-custom-insight-resolutions.md b/docs/cse/administration/manage-custom-insight-resolutions.md index 6ab4c23c30..41530ad950 100644 --- a/docs/cse/administration/manage-custom-insight-resolutions.md +++ b/docs/cse/administration/manage-custom-insight-resolutions.md @@ -20,6 +20,14 @@ When you close an insight, Cloud SIEM prompts you to select a resolution that in You can define custom *sub-resolutions* for any of the built-in resolutions. This enables you to create more granular resolutions that indicate more clearly why an insight was closed. For example, you might want to create a “Remediated” sub-resolution under “Resolved”. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage custom insight resolutions with the [`sumologic_cse_insights_resolution`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_resolution) resource. + + +::: + ## Create a custom sub-resolution 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM**, and then under **Cloud SIEM Workflow** select **Insight Resolutions**. You can also click the **Go To...** menu at the top of the screen and select **Insight Resolutions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top Cloud SIEM menu select **Configuration**, and then under **Workflow** select **Resolutions**. diff --git a/docs/cse/administration/manage-custom-insight-statuses.md b/docs/cse/administration/manage-custom-insight-statuses.md index b5bde9f5fa..2932e921e3 100644 --- a/docs/cse/administration/manage-custom-insight-statuses.md +++ b/docs/cse/administration/manage-custom-insight-statuses.md @@ -9,6 +9,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This page has information about creating and managing custom insight statuses. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage custom insight statuses with the [`sumologic_cse_insights_status`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_status) resource. + + +::: + ## View insight statuses To view insight statuses: diff --git a/docs/cse/automation/about-automation-service-and-cloud-siem.md b/docs/cse/automation/about-automation-service-and-cloud-siem.md index 9550c86377..5bc38be367 100644 --- a/docs/cse/automation/about-automation-service-and-cloud-siem.md +++ b/docs/cse/automation/about-automation-service-and-cloud-siem.md @@ -19,6 +19,13 @@ Before you can create automations in Cloud SIEM, you must first [configure role The Automation Service is a subset of automation capabilities adapted from Cloud SOAR that is available to the entire Sumo Logic log analytics platform. For more information, see [Cloud SOAR Compared to the Automation Service](/docs/cloud-soar/compared-to-automation-service/). +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage Cloud SIEM automation with the [`sumologic_cse_automation`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_automation) resource. + +::: + ## Benefits * The Automation Service supports enrichment, notification, containment, user choice, and custom actions in Cloud SIEM. diff --git a/docs/cse/match-lists-suppressed-lists/create-match-list.md b/docs/cse/match-lists-suppressed-lists/create-match-list.md index 84d3422b6f..8c4a6cbb13 100644 --- a/docs/cse/match-lists-suppressed-lists/create-match-list.md +++ b/docs/cse/match-lists-suppressed-lists/create-match-list.md @@ -20,6 +20,14 @@ Here are some match lists in Cloud SIEM. Note that each match list has a **Target Column**, which you define when you create the list. The Target Column indicates what type of record fields should be compared to the match list, for example, hostnames, URLs, domains, IP addresses, usernames, and so on. For more information, see [How are match lists Used?](#how-are-match-lists-used) +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage match lists with the [`match_list`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_match_list) and [`custom_match_list_column`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_match_list_column) resources. + + +::: + ## Built-in rules refer to standard match list names Many of Cloud SIEM’s built-in rules assume the existence of one or more standard match lists. A standard match list is a list that you need to create and populate so that Cloud SIEM can leverage it. Cloud SIEM rules take advantage of about 20 standard match lists. One example of a standard Match list is the “vuln_scanners” list mentioned in the previous section. There are analogous match lists for other entity types, such as “business_ips”, “verified_domains”, and so on. diff --git a/docs/cse/records-signals-entities-insights/configure-custom-insight.md b/docs/cse/records-signals-entities-insights/configure-custom-insight.md index 1852ff5691..24ab25fd5a 100644 --- a/docs/cse/records-signals-entities-insights/configure-custom-insight.md +++ b/docs/cse/records-signals-entities-insights/configure-custom-insight.md @@ -14,6 +14,14 @@ As described in the [Insight Generation Process](/docs/cse/get-started-with-clou This topic has instructions for defining a custom insight, which is a configuration you set up that causes Cloud SIEM to generate insights based purely on one or more signals being fired. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage insights with the [`sumologic_cse_insights_configuration`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_insights_configuration) and [`sumologic_cse_custom_insight`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_insight) resources. + + +::: + ## Ways to define a custom insight When you create a custom insight, the following field appears on the creation dialog: diff --git a/docs/cse/records-signals-entities-insights/create-an-entity-group.md b/docs/cse/records-signals-entities-insights/create-an-entity-group.md index da3307f3ef..1891c05a06 100644 --- a/docs/cse/records-signals-entities-insights/create-an-entity-group.md +++ b/docs/cse/records-signals-entities-insights/create-an-entity-group.md @@ -25,6 +25,14 @@ Each laptop in the “laptops” group will automatically inherit the criticalit Note that when an insight is created, any tags that are assigned to the primary entity in the insight are automatically inherited by the insight. So, tags that an entity inherits from an entity group will also be inherited by insights that fire on the entity. (Such inheritance is not retro-active: insights that fired on an entity prior to the entity being tagged won’t be tagged.) +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage entity groups with the [`cse_entity_entity_group_configuration`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_entity_group_configuration) and [`cse_inventory_entity_group_configuration`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_inventory_entity_group_configuration) resources. + + +::: + ## Entity group limits The number of entity groups you can configure per org varies by the type of the group: diff --git a/docs/cse/records-signals-entities-insights/create-custom-entity-type.md b/docs/cse/records-signals-entities-insights/create-custom-entity-type.md index 4a7df32f7d..23f49c9e87 100644 --- a/docs/cse/records-signals-entities-insights/create-custom-entity-type.md +++ b/docs/cse/records-signals-entities-insights/create-custom-entity-type.md @@ -31,3 +31,11 @@ To create a custom entity type: ::: 5. **Fields**. Use the dropdown list to select the schema attribute or attributes you want to associate with the custom entity type. 6. Click **Save**. + +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage custom entity types with the [`sumologic_cse_custom_entity_type`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_custom_entity_type) resource. + + +::: \ No newline at end of file diff --git a/docs/cse/records-signals-entities-insights/entity-criticality.md b/docs/cse/records-signals-entities-insights/entity-criticality.md index 1dc4a1da39..9230b07aab 100644 --- a/docs/cse/records-signals-entities-insights/entity-criticality.md +++ b/docs/cse/records-signals-entities-insights/entity-criticality.md @@ -17,6 +17,14 @@ Just as you can use criticality to increase severity, you can use it to decrease If the formula you specify results in a number that isn’t whole, the value is rounded down to the nearest integer. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage entity criticality with the [`sumologic_cse_entity_criticality_config`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_criticality_config) resource. + + +::: + ## About criticality and insight generation The maximum severity that can be assigned to a Cloud SIEM rule is 10, so normally, signal severity is also limited to 10. Note however that Cloud SIEM doesn’t impose a maximum value on the severity that results from a criticality, although the minimum value will always be 0.  diff --git a/docs/cse/rules/rule-tuning-expressions.md b/docs/cse/rules/rule-tuning-expressions.md index 92fd3111c7..9b20ecd5a0 100644 --- a/docs/cse/rules/rule-tuning-expressions.md +++ b/docs/cse/rules/rule-tuning-expressions.md @@ -38,6 +38,16 @@ Here’s what the example tuning expression looks like in the Cloud SIEM UI. Example expression +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage rule tuning expressions with the [`rule_tuning_expression`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_rule_tuning_expression) resource. + + +::: + + + ## Writing a tuning expression Writing a tuning expression is just like writing a rule expression. A tuning expression can use metadata, record fields, and Cloud SIEM [rules language](/docs/cse/rules/cse-rules-syntax) functions. For more information, see [About rule expressions](/docs/cse/rules/about-cse-rules#about-rule-expressions). diff --git a/docs/cse/rules/write-aggregation-rule.md b/docs/cse/rules/write-aggregation-rule.md index 1a88fd60ea..e7cdd6e12b 100644 --- a/docs/cse/rules/write-aggregation-rule.md +++ b/docs/cse/rules/write-aggregation-rule.md @@ -12,10 +12,19 @@ import Iframe from 'react-iframe'; This topic has information about Cloud SIEM aggregation rules and how to write them. -:::tip +:::info If you are new to writing your own Cloud SIEM rules, see [Before You Write a Custom Rule](/docs/cse/rules/before-writing-custom-rule) for tips and techniques that are useful for getting started. ::: + +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage aggregation rules with the [`sumologic_cse_aggregation_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_aggregation_rule) resource. + + +::: + ## About aggregation rules This section describes the purpose of aggregation rules, and gives an example of how you would use one. If you’re ready to jump in and configure a rule, see [Create an aggregation rule](#create-an-aggregation-rule) below. diff --git a/docs/cse/rules/write-chain-rule.md b/docs/cse/rules/write-chain-rule.md index 97fb4bffda..a51f7f786b 100644 --- a/docs/cse/rules/write-chain-rule.md +++ b/docs/cse/rules/write-chain-rule.md @@ -16,6 +16,14 @@ This topic has information about chain rules and how to create them in the Clo If you are new to writing rules, see [About Cloud SIEM Rules](/docs/cse/rules/about-cse-rules) for information about rule expressions and other rule options. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage chain rules with the [`sumologic_cse_chain_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_chain_rule) resource. + + +::: + ## About chain rules A chain rule is similar to a threshold rule. A threshold rule fires when one rule expression is matched at least a certain number times during a specified length of time. In a chain rule you configure two more rule expressions, and for each expression, the number of matches that are required for the rule to fire a signal. The interval you define within which the matches must occur applies to all of the rule expressions in the rule. @@ -38,6 +46,7 @@ Watch this micro lesson to learn how to create a chain rule. ::: + ## Create a chain rule 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Cloud SIEM > Rules**. You can also click the **Go To...** menu at the top of the screen and select **Rules**. diff --git a/docs/cse/rules/write-first-seen-rule.md b/docs/cse/rules/write-first-seen-rule.md index 24eeaef9a9..683ed43c4e 100644 --- a/docs/cse/rules/write-first-seen-rule.md +++ b/docs/cse/rules/write-first-seen-rule.md @@ -15,10 +15,18 @@ import CseRule from '../../reuse/cse-rule-description-links.md'; import Iframe from 'react-iframe'; This topic has information about first seen rules and how to create them in the Cloud SIEM UI. -:::tip +:::info If you are new to writing rules, see [About Cloud SIEM Rules](/docs/cse/rules/about-cse-rules) for information about rule expressions and other rule options. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage first seen rules with the [`sumologic_cse_first_seen_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_first_seen_rule) resource. + + +::: + ## About first seen rules First seen rules allow you to generate a signal when behavior by an entity (such as a user) is encountered that hasn't been seen before. For example, a first seen rule might look for the events like the following: diff --git a/docs/cse/rules/write-match-rule.md b/docs/cse/rules/write-match-rule.md index 602c8a0ada..6eea919e48 100644 --- a/docs/cse/rules/write-match-rule.md +++ b/docs/cse/rules/write-match-rule.md @@ -12,10 +12,18 @@ import Iframe from 'react-iframe';  This topic has information about match rules and how to create them in the Cloud SIEM UI. -:::tip +:::info If you are new to writing rules, see [About Cloud SIEM Rules](/docs/cse/rules/about-cse-rules) for information about rule expressions and other rule options. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage match rules with the [`sumologic_cse_match_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_match_rule) resource. + + +::: + ## About match rules A match rule is the simplest type of Cloud SIEM rule. Each time a single record matches the rule expression, a signal is fired.  diff --git a/docs/cse/rules/write-outlier-rule.md b/docs/cse/rules/write-outlier-rule.md index b7ebcee55c..6ff6fe6a6a 100644 --- a/docs/cse/rules/write-outlier-rule.md +++ b/docs/cse/rules/write-outlier-rule.md @@ -16,10 +16,18 @@ import Iframe from 'react-iframe'; This topic has information about outlier rules and how to create them in the Cloud SIEM UI. -:::tip +:::info If you are new to writing rules, see [About Cloud SIEM Rules](/docs/cse/rules/about-cse-rules) for information about rule expressions and other rule options. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage outlier rules with the [`sumologic_cse_outlier_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_outlier_rule) resource. + + +::: + ## About outlier rules Outlier rules allow you to generate a signal when behavior by an entity (such as a user) is encountered that deviates from its baseline activity. diff --git a/docs/cse/rules/write-threshold-rule.md b/docs/cse/rules/write-threshold-rule.md index 39c311d177..e2c4b7ed38 100644 --- a/docs/cse/rules/write-threshold-rule.md +++ b/docs/cse/rules/write-threshold-rule.md @@ -13,6 +13,14 @@ This topic has information about the threshold rules and how to create them in t If you are new to writing rules, see [About Cloud SIEM Rules](/docs/cse/rules/about-cse-rules) for information about rule expressions and other rule options. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage threshold rules with the [`sumologic_cse_threshold_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_threshold_rule) resource. + + +::: + ## About threshold rules A threshold rule fires when its rule expression is matched at least a certain number of times during a specified length of time. For example, if there are five or more failed login attempts for the same IP address within one hour.  diff --git a/docs/cse/schema/create-structured-log-mapping.md b/docs/cse/schema/create-structured-log-mapping.md index a8e422f5e9..0a103182f5 100644 --- a/docs/cse/schema/create-structured-log-mapping.md +++ b/docs/cse/schema/create-structured-log-mapping.md @@ -11,6 +11,14 @@ This topic has instructions for creating a log mapping for structured messages u For more information about log mapping, and how it fits into the record creation process, see the [Record Processing Pipeline](/docs/cse/schema/record-processing-pipeline) topic. For a complete list of the standard log mappings, see [Mappings](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/mappings/README.md) in the [Cloud SIEM Content Catalog](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/README.md). +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage log mapping with the [`log_mapping`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_log_mapping) resource. + + +::: + ## About the log mapping process When you set up a log mapping, you supply the following information:   diff --git a/docs/cse/schema/username-and-hostname-normalization.md b/docs/cse/schema/username-and-hostname-normalization.md index fb65bddb9c..012870e4ca 100644 --- a/docs/cse/schema/username-and-hostname-normalization.md +++ b/docs/cse/schema/username-and-hostname-normalization.md @@ -73,6 +73,13 @@ Following is an example configuration: If no name normalization is configured, the system will continue to operate as it does today.  If normalization is then enabled, any signals already created in the system will use the non-normalized form of the name.  Any new signals will use the normalized name.  This means there is potential for insights to be uncorrelated between the two different name forms for one insight window.  This is especially true as all usernames will now be lowercase. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage entity normalization with the [`sumologic_cse_entity_normalization_configuration`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cse_entity_normalization_configuration) resource. + + +::: ## Domain normalization diff --git a/docs/dashboards/create-dashboard-new.md b/docs/dashboards/create-dashboard-new.md index 47e8851a3b..3a12678ace 100644 --- a/docs/dashboards/create-dashboard-new.md +++ b/docs/dashboards/create-dashboard-new.md @@ -38,7 +38,15 @@ When you rename or add a panel to a dashboard it is automatically saved in your There are two ways to create a **Dashboard**, either by using the following method, or by creating it directly from the [Log Search page](#log-search-page) or [Metrics page](#metrics-page). Panels and customized charts will be added in later steps. 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to the **Home** screen and select **Dashboard**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Dashboards > New Dashboard**. You can also click the **Go To...** menu at the top of the screen and select **New Dashboard**. -1. Select the Dashboard text field at the top of the window and enter a unique name for your new dashboard.
+1. Select the Dashboard text field at the top of the window and enter a unique name for your new dashboard. + +import TerraformLink from '../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a dashboard with the [`sumologic_dashboard`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/dashboard) resource. + + +::: ## Add a panel   diff --git a/docs/get-started/library.md b/docs/get-started/library.md index 24994a7d6e..6db53015d1 100644 --- a/docs/get-started/library.md +++ b/docs/get-started/library.md @@ -54,6 +54,13 @@ Do any of the following from the information panel in the library: * Click **Share** or **Unshare** to change the sharing settings for the item. * Click **Move** to move the item to another folder in the library. Select the new location, and click **Move**. +import TerraformLink from '../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage content such as intems in your personal folder with the [`sumologic_content`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/content) resource. + + +::: ## Personal Folder @@ -83,6 +90,12 @@ To add a folder to the library: 1. In the **Add Folder** dialog, enter a name for the new folder, and click **Add**. 
Add Folder dialog 1. The new folder is added to the folder list in alphabetical order. +:::tip +You can use Terraform to manage folders with the [`sumologic_folder`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/folder) resource. + + +::: + ### Add Subfolders 1. Create a subfolder by clicking **Add New > New Folder** in your Personal folder. diff --git a/docs/integrations/index.md b/docs/integrations/index.md index 3ff6161b68..ca5de899b4 100644 --- a/docs/integrations/index.md +++ b/docs/integrations/index.md @@ -28,6 +28,14 @@ To check if an app is supported by your pricing plan, see [Apps and Sumo Logic A Learn the difference between our [Next-Gen Apps and Classic Apps](/docs/get-started/apps-integrations/#next-gen-apps). ::: +import TerraformLink from '../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide apps with the [`sumologic_app`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/app) resource. + + +::: + :::sumo Micro Lesson Watch this tutorial to learn how to use our **App Catalog**. diff --git a/docs/manage/content-sharing/index.md b/docs/manage/content-sharing/index.md index 5f8d52a496..a4457bf42f 100644 --- a/docs/manage/content-sharing/index.md +++ b/docs/manage/content-sharing/index.md @@ -12,6 +12,14 @@ You can share apps, log searches, metric searches, dashboards, and folders with Share dialog +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage content sharing permissions with the [`sumologic_content_permission`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/content_permission) resource. + + +::: + ## Share from any location You can share content from the following locations: diff --git a/docs/manage/data-forwarding/manage.md b/docs/manage/data-forwarding/manage.md index 06d8f26369..096a5bcce1 100644 --- a/docs/manage/data-forwarding/manage.md +++ b/docs/manage/data-forwarding/manage.md @@ -8,6 +8,14 @@ description: View, edit, delete, activate, and deactivate data forwarding destin Data forwarding is not currently supported for data assigned to the Infrequent Tier.  ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage data forwarding with the [`sumologic_data_forwarding_destination`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/data_forwarding_destination) and [`sumologic_data_forwarding_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/data_forwarding_rule) resources. + + +::: + ## View, edit, or delete a data forwarding destination The following actions are available on the **Data Forwarding** page. Hover over a destination in the table and select any of the following: diff --git a/docs/manage/field-extractions/create-field-extraction-rule.md b/docs/manage/field-extractions/create-field-extraction-rule.md index 3a1d8c983e..2c483e25ea 100644 --- a/docs/manage/field-extractions/create-field-extraction-rule.md +++ b/docs/manage/field-extractions/create-field-extraction-rule.md @@ -15,6 +15,14 @@ You need the **Manage field extraction rules** [role capability](../users-roles Fields specified in field extraction rules are automatically added and enabled in your [Fields](/docs/manage/fields) table schema. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a field extraction rule with the [`sumologic_field_extraction_rule`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/field_extraction_rule) resource. + + +::: + :::sumo Micro Lesson Learn how to create a FER through our video, "Creating a Field Extraction Rule". diff --git a/docs/manage/fields.md b/docs/manage/fields.md index b8ae91891d..04fa887d6b 100644 --- a/docs/manage/fields.md +++ b/docs/manage/fields.md @@ -28,6 +28,14 @@ Fields specified in field extraction rules are automatically added and enabled i Field management is important to ensure search performance is maintained and you continue to have meaningful fields assigned to your data. You can manage fields defined through any of these methods at any time, to include deleting unneeded fields, see [manage fields](#manage-fields) for details. +import TerraformLink from '../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a field with the [`sumologic_field`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/field) resource. + + +::: + ## About metrics sources, fields, and metadata Sumo Logic metrics sources also support tagging with fields defined in your Fields schema or other metadata that hasn’t been added to your schema. Here’s how it works: diff --git a/docs/manage/ingestion-volume/ingest-budgets/daily-volume.md b/docs/manage/ingestion-volume/ingest-budgets/daily-volume.md index c76a5801ec..c8d6c927e6 100644 --- a/docs/manage/ingestion-volume/ingest-budgets/daily-volume.md +++ b/docs/manage/ingestion-volume/ingest-budgets/daily-volume.md @@ -10,6 +10,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; If you want to use APIs to manage ingest budgeting, you must use [Ingest Budget Management V2 APIs](/docs/api/ingest-budget-v2/). Ingest Budget Management V1 APIs have been removed and are no longer supported. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage ingest budgets with the [`sumologic_ingest_budget_v2`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/ingest_budget_v2) resource. + + +::: + Ingest budgets control the daily volume of log data sent to Sumo Logic. Log data can be assigned to an ingest budget that defines a daily log capacity limit. The capacity is tracked based on the combined volume from all sources of log data. When an ingest budget's capacity is reached you can have Sumo Logic stop collecting the log data assigned to it to control costs. Ingest budgets automatically reset their capacity utilization tracking every 24 hours based on the time and time zone you specify. For example, you can schedule an ingest budget to refresh every day at 02:00 in the America/Los_Angeles time zone. You can manually [reset an ingest budget](#reset-ingest-budget) at any time. diff --git a/docs/manage/manage-subscription/create-and-manage-orgs/manage-org-settings.md b/docs/manage/manage-subscription/create-and-manage-orgs/manage-org-settings.md index cd28d0daa3..ff61986f2d 100644 --- a/docs/manage/manage-subscription/create-and-manage-orgs/manage-org-settings.md +++ b/docs/manage/manage-subscription/create-and-manage-orgs/manage-org-settings.md @@ -10,7 +10,6 @@ keywords: import useBaseUrl from '@docusaurus/useBaseUrl'; - ## Availability | Account Type | Account Level | @@ -84,6 +83,14 @@ When you use custom subdomains in combination with SAML integrations [configured * Custom subdomains are not currently available for Sumo Logic accounts created through third-party integrations that require authentication using those integrations, such as Heroku and Jfrog. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage subdomains with the [`sumologic_subdomain`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/subdomain) resource. + + +::: + ### Key considerations Before changing your account subdomain, consider the following:   diff --git a/docs/manage/manage-subscription/scan-budgets.md b/docs/manage/manage-subscription/scan-budgets.md index 3560fd28d7..1ee5c1c8e2 100644 --- a/docs/manage/manage-subscription/scan-budgets.md +++ b/docs/manage/manage-subscription/scan-budgets.md @@ -8,6 +8,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; Scan budget allows you to configure limits for individual users and helps admins assign roles for easier group selection. This method provides flexibility in your actions when the budget limit is reached. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a scan budget with the [`sumologic_scan_budget`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/scan_budget) resource. + + +::: + ## Availability | Account Type | Account Level | diff --git a/docs/manage/partitions/index.md b/docs/manage/partitions/index.md index 155ea632e4..00089fe8cc 100644 --- a/docs/manage/partitions/index.md +++ b/docs/manage/partitions/index.md @@ -19,6 +19,14 @@ A partition stores your data in an index separate from the rest of your account' Data stored in a partition is not stored anywhere else.  ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a partition with the [`sumologic_partition`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/partition) resource. + + +::: + ## About Partitions Partitions route your data to an index becoming a separate subset of data in your account. Creating smaller and separate subsets of data is central to search optimization. When you run a search against an index, results are returned more quickly and efficiently because the search runs against a smaller data set. diff --git a/docs/manage/scheduled-views/add-scheduled-view.md b/docs/manage/scheduled-views/add-scheduled-view.md index ec310c4b2a..08ad9139a3 100644 --- a/docs/manage/scheduled-views/add-scheduled-view.md +++ b/docs/manage/scheduled-views/add-scheduled-view.md @@ -9,6 +9,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; To create a Scheduled View you must be an admin or have the Manage Scheduled Views [role capability](../users-roles/users/multi-account-access.md). ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a scheduled view with the [`sumologic_scheduled_view`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/scheduled_view) resource. + + +::: + For Scheduled View query requirements, see [Scheduled Views Best Practices and Examples](scheduled-views-best-practices.md).  1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Scheduled Views**. You can also click the **Go To...** menu at the top of the screen and select **Scheduled Views**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Scheduled Views**.
scheduled-view-page diff --git a/docs/manage/security/installation-tokens.md b/docs/manage/security/installation-tokens.md index 35780a4610..423e65959f 100644 --- a/docs/manage/security/installation-tokens.md +++ b/docs/manage/security/installation-tokens.md @@ -16,6 +16,14 @@ Opposed to [Access Keys](access-keys.md), you can embed your Installation Tokens Multiple collectors can use the installation token. Additionally, installation tokens are only used to initially register the collectors to the account, and are not used by the collector after that point. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a token with the [`sumologic_token`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/token) resource. + + +::: + ## Limitations * Your account can have up to 100 Installation Tokens, active and inactive. diff --git a/docs/manage/security/saml/set-up-saml.md b/docs/manage/security/saml/set-up-saml.md index c74c75d2af..90371c2472 100644 --- a/docs/manage/security/saml/set-up-saml.md +++ b/docs/manage/security/saml/set-up-saml.md @@ -17,6 +17,14 @@ This page has information about provisioning Security Assertion Markup Language In addition to basic SAML configuration, you can choose optional on-demand user creation (using SAML 2.0 assertions), and designate custom login and/or logout portals. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a SAML configuration with the [`sumologic_saml_configuration`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/saml_configuration) resource. + + +::: + ## SAML provisioning process The provisioning process works as follows: diff --git a/docs/manage/security/set-password-policy.md b/docs/manage/security/set-password-policy.md index 950594e86a..0751fa7aa8 100644 --- a/docs/manage/security/set-password-policy.md +++ b/docs/manage/security/set-password-policy.md @@ -10,6 +10,14 @@ Account admins with the Manage Password Policy capability can set the account's For details on password policies and Multi-account Access, see [Multi-Account Access](../users-roles/users/multi-account-access.md).  +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to set the password policy with the [`sumologic_password_policy`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/password_policy) resource. + + +::: + ## Changing the password policy Admins with Manage Password Policy capability can make changes at any time for users in their organization. The updated settings are applied to each user's account the next time he or she changes their password. diff --git a/docs/manage/users-roles/roles/create-manage-roles.md b/docs/manage/users-roles/roles/create-manage-roles.md index 90f71e69fa..d07fa8e308 100644 --- a/docs/manage/users-roles/roles/create-manage-roles.md +++ b/docs/manage/users-roles/roles/create-manage-roles.md @@ -7,7 +7,15 @@ description: You can create custom roles for your users. import useBaseUrl from '@docusaurus/useBaseUrl'; import RoleStacking from '../../../reuse/role-stacking-tip.md'; -This section has instructions for creating and managing Sumo Logic roles. The roles you assign to a user control what Sumo Logic capabilities are available to the user and what log data the user can access. This functionality is referred to as role-based access control.   +This section has instructions for creating and managing Sumo Logic roles. The roles you assign to a user control what Sumo Logic capabilities are available to the user and what log data the user can access. This functionality is referred to as role-based access control. + +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage roles with the [`sumologic_role_v2`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/role_v2) resource. + + +::: ## Built-in Administrator and Analyst roles diff --git a/docs/manage/users-roles/roles/index.md b/docs/manage/users-roles/roles/index.md index 1207aa8dae..ae2ae4a84b 100644 --- a/docs/manage/users-roles/roles/index.md +++ b/docs/manage/users-roles/roles/index.md @@ -18,6 +18,14 @@ To manage users and roles, you must have the administrator role or your role mus [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the Roles page, in the main Sumo Logic menu select **Administration > Users and Roles > Roles**. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage roles with the [`sumologic_role_v2`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/role_v2) resource. + + +::: + In this section, we'll introduce the following concepts:
diff --git a/docs/manage/users-roles/users/create-edit-users.md b/docs/manage/users-roles/users/create-edit-users.md index f2854909a0..7608e99e41 100644 --- a/docs/manage/users-roles/users/create-edit-users.md +++ b/docs/manage/users-roles/users/create-edit-users.md @@ -8,6 +8,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This section has instructions for creating and editing users in Sumo Logic. For information about deleting a user, see [Delete a User](delete-user.md). +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a user with the [`sumologic_user`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/user) resource. + + +::: + ## Create a user To create a user: diff --git a/docs/metrics/metrics-queries/metrics-explorer.md b/docs/metrics/metrics-queries/metrics-explorer.md index 00e53511bc..676c45e770 100644 --- a/docs/metrics/metrics-queries/metrics-explorer.md +++ b/docs/metrics/metrics-queries/metrics-explorer.md @@ -9,6 +9,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This page describes the Metrics Search UI and how to use it. +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a metrics search with the [`sumologic_metrics_search_v2`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/metrics_search_v2) resource. + + +::: + ## About the UI The Metrics Search appears when you open a new metrics tab. The page diff --git a/docs/observability/aws/other-configurations-tools/add-new-aws-service.md b/docs/observability/aws/other-configurations-tools/add-new-aws-service.md index 8131a4ab61..d220f64ea6 100644 --- a/docs/observability/aws/other-configurations-tools/add-new-aws-service.md +++ b/docs/observability/aws/other-configurations-tools/add-new-aws-service.md @@ -11,6 +11,14 @@ The [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) p By default, the AWS Observability view supports the following services: AWS EC2, AWS API Gateway, AWS Lambda, AWS RDS, Amazon DynamoDB, and AWS Application ELB. The purpose of this document is to guide you towards adding any dashboards you may have built for additional services to the AWS Observability hierarchy. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a hierarchy with the [`sumologic_hierarchy`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/hierarchy) resource. + + +::: + ## Prerequisites Before you can add dashboards for a new service to the AWS Observability diff --git a/docs/observability/reliability-management-slo/create-slo.md b/docs/observability/reliability-management-slo/create-slo.md index 860f0e0a5b..0159545174 100644 --- a/docs/observability/reliability-management-slo/create-slo.md +++ b/docs/observability/reliability-management-slo/create-slo.md @@ -28,6 +28,14 @@ The following table lists the available options for an SLO: | **Metrics-based SLO** | Ratio and Threshold | Ratio Only | | **Logs-based SLO** | Ratio and Threshold | Ratio and Threshold | +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage SLOs with the [`sumologic_slo`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/slo) and [`sumologic_slo_folder`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/slo_folder) resources. + + +::: + ## Create an SLO (General) 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Monitoring > SLOs**. You can also click the **Go To...** menu at the top of the screen and select **SLOs**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Monitoring > SLOs**. diff --git a/docs/platform-services/automation-service/playbooks/index.md b/docs/platform-services/automation-service/playbooks/index.md index 6627b8112b..2219bdf7f0 100644 --- a/docs/platform-services/automation-service/playbooks/index.md +++ b/docs/platform-services/automation-service/playbooks/index.md @@ -16,6 +16,14 @@ To run a playbook, add it to an automation. You can run playbooks in [monitors]( ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to manage playbooks with the [`sumologic_csoar_playbook`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/csoar_playbook) resource. + + +::: +
diff --git a/docs/reuse/terraform-link.md b/docs/reuse/terraform-link.md new file mode 100644 index 0000000000..122af97d57 --- /dev/null +++ b/docs/reuse/terraform-link.md @@ -0,0 +1 @@ +For more information about using Terraform to manage Sumo Logic components, see [Use Terraform with Sumo Logic](/docs/api/about-apis/terraform-with-sumo-logic/). \ No newline at end of file diff --git a/docs/search/index.md b/docs/search/index.md index 39216ad7dd..1b194a5636 100644 --- a/docs/search/index.md +++ b/docs/search/index.md @@ -12,6 +12,14 @@ import Iframe from 'react-iframe'; Log Search allows you to query and analyze log data sent to Sumo Logic. There are many features to help you use our robust Search Query Language, such as LogCompare, LogReduce, LogExplain, Lookup Tables, Subqueries, and Time Compare. See [Get Started with Search](/docs/search/get-started-with-search) to begin exploring your data in Sumo Logic. +import TerraformLink from '../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a search with the [`sumologic_log_search`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/log_search) resource. + + +::: + ## Guides In this section, we'll introduce the following concepts: diff --git a/docs/search/lookup-tables/create-lookup-table.md b/docs/search/lookup-tables/create-lookup-table.md index 1de6afc3d2..dde9430abd 100644 --- a/docs/search/lookup-tables/create-lookup-table.md +++ b/docs/search/lookup-tables/create-lookup-table.md @@ -21,6 +21,14 @@ New Lookup Tables are available in all deployments except Sumo Logic's Montreal You can also use the [Lookups API](https://api.sumologic.com/docs/#tag/lookupManagement) to create and manage Lookup Tables.  ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a lookup table with the [`sumologic_lookup_table`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/lookup_table) resource. + + +::: + ## Introduction to Lookup Tables A Lookup Table is a table of data hosted on Sumo Logic that you can use to enrich the log data received by Sumo Logic. For example, in a Sumo Logic log search, you'd refer to a Lookup Table of user account data to map the user ID in an incoming log to a row in the Lookup Table, and return other attributes of that user, for instance, email address or phone number. The fields you look up appear as part of your search results.  diff --git a/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md b/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md index 057209634f..acccb0d5e5 100644 --- a/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md +++ b/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md @@ -10,6 +10,14 @@ import ForwardToSiem from '/docs/reuse/forward-to-siem.md'; The Azure Event Hubs Source provides a secure endpoint to receive data from Azure Event Hubs. It securely stores the required authentication, scheduling, and state tracking information. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an Azure Event Hubs source with the [`sumologic_azure_event_hub_log_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/azure_event_hub_log_source) resource. + + +::: + ## Data collected The Azure platform can be configured to export logs to one or more Event Hub destinations. Platform logs include: diff --git a/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudfront-source.md b/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudfront-source.md index b142c12e81..99f6ad804b 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudfront-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudfront-source.md @@ -19,6 +19,14 @@ To configure an Amazon CloudFront Source: 1. Add the [AWS Source](amazon-cloudfront-source.md) for CloudFront. See below for detailed steps.  1. **Optional:** Install the Sumo Logic App for Amazon CloudFront. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an Amazon CloudFront source with the [`sumologic_cloudfront_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudfront_source) resource. + + +::: + ## AWS Source See [AWS Source](aws-sources.md) for full details on the AWS source, configuration and more. diff --git a/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics.md b/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics.md index 25a24d070f..ea07b3dd0c 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics.md +++ b/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics.md @@ -15,6 +15,14 @@ A Sumo Logic CloudWatch Source allows you to gather metrics data from an Amazon We recommend using the newer AWS Kinesis Firehose for Metrics Source to collect CloudWatch metrics. For more information, see [Which to use: Kinesis Firehose source or CloudWatch source?](aws-kinesis-firehose-metrics-source.md) ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an Amazon CloudWatch source with the [`sumologic_cloudwatch_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudwatch_source) resource. + + +::: + ## Supported AWS metrics A Sumo CloudWatch Source only supports CloudWatch metrics that are emitted at a regular interval. It cannot ingest metrics that are emitted with significant latency, such as Amazon S3 Daily Storage Metrics or AWS Billing metrics, or at sporadic intervals, such as Amazon DynamoDB throttled events. diff --git a/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source.md b/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source.md index c2d4e0f08a..cbe50b42ab 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source.md @@ -20,3 +20,11 @@ To configure an Amazon S3 Audit Source: 1. **Optional:** Install the Sumo Logic App for S3 Audit. See [AWS Sources](aws-sources.md) for full details on setting up and configuring. + +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an S3 audit source with the [`sumologic_s3_audit_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/s3_audit_source) resource. + + +::: diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source.md index b0ded158a1..ed7ea5fffb 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source.md @@ -32,6 +32,13 @@ You need to know where your CloudTrail log files are stored so you can provide ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS CloudTrail source with the [`sumologic_cloudtrail_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudtrail_source) resource. + + +::: ### Configure an AWS CloudTrail Source diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-elastic-load-balancing-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-elastic-load-balancing-source.md index 3cd3b5b0c8..27b10eee3f 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-elastic-load-balancing-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-elastic-load-balancing-source.md @@ -19,6 +19,14 @@ To configure an AWS ELB Source: 1. Add the [AWS Source](aws-sources.md) for ELB. 1. **Optional:** Install the Sumo Logic App for AWS Elastic Load Balancing. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS Elastic Load Balancing source with the [`sumologic_elb_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/elb_source) resource. + + +::: + ## Enable ELB logging in AWS By default, ELB logging is not enabled in your organization's AWS account. You can find additional assistance for enabling logging in [AWS Documentation](http://aws.amazon.com/documentation/elastic-load-balancing/). diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source.md index 21d0f4776e..f84485c96f 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source.md @@ -21,6 +21,14 @@ The following diagram shows the flow of data with an AWS Kinesis Firehose for Lo For failed logs messages, AWS will send them into the backup S3 bucket. Sumo Logic will ingest those failed logs through S3, and not the firehose. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS Kinesis Firehose for Logs source with the [`sumologic_kinesis_log_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/kinesis_log_source) resource. + + +::: + ## Create an AWS Kinesis Firehose for Logs Source When you create an AWS Kinesis Firehose for Logs Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector). diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source.md index 15f7122766..5da4022170 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source.md @@ -13,6 +13,14 @@ This page has information about Sumo Logic’s AWS Kinesis Firehose for Metrics You can use the AWS Kinesis Firehose for Metrics source to ingest CloudWatch metrics from the [Amazon Kinesis Data Firehose](https://aws.amazon.com/kinesis/data-firehose/?kinesis-blogs.sort-by=item.additionalFields.createdDate&kinesis-blogs.sort-order=desc). AWS CloudWatch Metrics can be streamed using AWS Metric Streams, a managed service that exports CloudWatch metrics data with low latency, and without management overhead or custom integration. With Metric Streams, you can create dedicated, continuous streams of metric data that can be delivered to Sumo Logic by Kinesis Data Firehose. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS Kinesis Metrics source with the [`sumologic_kinesis_metrics_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/kinesis_metrics_source) resource. + + +::: + ## How it works The diagram below illustrates the metrics collection pipeline. diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md index 0e1bc3ad1f..3106046e94 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md @@ -15,6 +15,14 @@ A Sumo Logic AWS Metadata Source allows you to collect tags from EC2 instances r Collecting AWS Metadata requires [Collector](/docs/send-data/installed-collectors/sources) version 19.162+. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS Metadata Source with the [`sumologic_metadata_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/metadata_source) resource. + + +::: + ## Metrics Tags are automatically applied to: diff --git a/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source.md b/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source.md index 5628db830e..3d98e9dfea 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source.md +++ b/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source.md @@ -16,6 +16,14 @@ One Amazon S3 Source can collect data from a single S3 bucket. However, you c For information on S3 performance optimization, see [Request Rate and Performance Considerations](http://docs.aws.amazon.com/AmazonS3/latest/dev/request-rate-perf-considerations.html).  +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an S3 source with the [`sumologic_s3_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/s3_source) resource. + + +::: + ## Compressed data An S3 Source can collect either plain text or gzip-compressed text. Zip files are not supported. diff --git a/docs/send-data/hosted-collectors/cloud-syslog-source/index.md b/docs/send-data/hosted-collectors/cloud-syslog-source/index.md index e6e95b8a9a..9ed6d700c1 100644 --- a/docs/send-data/hosted-collectors/cloud-syslog-source/index.md +++ b/docs/send-data/hosted-collectors/cloud-syslog-source/index.md @@ -29,8 +29,15 @@ In the procedure below, you configure a Cloud Syslog Source. This will generate Then you set up TLS by downloading a cert to your server (see procedures for [rsyslog](/docs/send-data/hosted-collectors/cloud-syslog-source/rsyslog/#setup-tls) and [syslog-ng](/docs/send-data/hosted-collectors/cloud-syslog-source/syslog-ng/#setup-tls)). Download the AWS Certificate Manager (ACM) certificate from the following location: https://www.amazontrust.com/repository/AmazonRootCA1.cer. -Sumo Logic supports syslog clients, including syslog-ng and rsyslog. Follow the instructions in the appropriate section below to configure your server to send syslog data. If syslog data does not appear in Sumo Logic, refer to -[Troubleshooting](#troubleshooting) below. +Sumo Logic supports syslog clients, including syslog-ng and rsyslog. Follow the instructions in the appropriate section below to configure your server to send syslog data. If syslog data does not appear in Sumo Logic, refer to [Troubleshooting](#troubleshooting) below. + +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a Cloud Syslog source with the [`sumologic_cloudsyslog_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloudsyslog_source) resource. + + +::: ## Configure a Cloud Syslog Source diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md index 3e364c769f..58d11bd469 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md @@ -17,6 +17,14 @@ The Cloud SIEM AWS EC2 Inventory Source provides a secure endpoint to receive ev For information on how inventory data is used in Cloud SIEM, see [Inventory Sources and Data](/docs/cse/administration/inventory-sources-and-data.md). +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an AWS inventory source with the [`sumologic_aws_inventory_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/aws_inventory_source) resource. + + +::: + ## Data collected | Polling Interval | Data | diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md index 89835bba27..c2c2ececd3 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/index.md @@ -7,7 +7,6 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; The Cloud-to-Cloud Integration Framework is a fully-managed collection system that collects logs and events directly from SaaS and Cloud platforms. This data often includes custom events and user data critical for operations monitoring, security, and compliance use cases. As a fully managed collection system, integrations running within the Cloud-to-Cloud Integration Framework provide a secure endpoint to receive event data in your account. Integration authentication, scheduling, and state tracking are all managed by the framework. - ## Limitations * Each account is limited to 50 Cloud-to-Cloud Sources. @@ -45,6 +44,14 @@ For the Federal environments, a different set of Static IPs is available for eac The topics below are the available integrations. In Sumo Logic these are called Sources. Check out the Sources we have available in beta. +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a cloud-to-cloud source with the [`sumologic_cloud_to_cloud_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/cloud_to_cloud_source) resource. + + +::: + ## Versions Sources in the Cloud-to-Cloud Integration Framework need updates over time to maintain data collection. Updates can vary in severity and may not require any input from you. See [Cloud-to-Cloud Source Versions](cloud-to-cloud-source-versions.md) for details on how to upgrade and how versions are structured. diff --git a/docs/send-data/hosted-collectors/configure-hosted-collector.md b/docs/send-data/hosted-collectors/configure-hosted-collector.md index edaf62187d..5787caf797 100644 --- a/docs/send-data/hosted-collectors/configure-hosted-collector.md +++ b/docs/send-data/hosted-collectors/configure-hosted-collector.md @@ -13,6 +13,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; The maximum number of Collectors allowed per organization is 10,000. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to add a hosted collector with the [`sumologic_collector`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/collector) resource. + + +::: + ## Step 1: Configure Hosted Collector Steps to configure a Hosted Collector: diff --git a/docs/send-data/hosted-collectors/google-source/gcp-metrics-source.md b/docs/send-data/hosted-collectors/google-source/gcp-metrics-source.md index bfc47a0222..da458a975e 100644 --- a/docs/send-data/hosted-collectors/google-source/gcp-metrics-source.md +++ b/docs/send-data/hosted-collectors/google-source/gcp-metrics-source.md @@ -15,6 +15,14 @@ The Sumo Logic GCP Metrics Source gives you complete visibility into all Google For information on API calls and collected metrics, see the [Collected metrics](#collected-metrics) section. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a GCP Metrics Source with the [`sumologic_gcp_metrics_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/gcp_metrics_source) resource. + + +::: + ## Google Service account Sumo Logic uses a Google Service Account to connect and make API calls on your behalf to collect metrics. diff --git a/docs/send-data/hosted-collectors/google-source/google-cloud-platform-source.md b/docs/send-data/hosted-collectors/google-source/google-cloud-platform-source.md index 547556df71..c7d27a4db4 100644 --- a/docs/send-data/hosted-collectors/google-source/google-cloud-platform-source.md +++ b/docs/send-data/hosted-collectors/google-source/google-cloud-platform-source.md @@ -15,6 +15,14 @@ Log data for Google Cloud Platform (GCP) services is collected and exposed thro Google no longer requires a pub/sub domain to be [verified](https://cloud.google.com/pubsub/docs/push). You no longer have to set up domain verification with your GCP Source endpoint. ::: +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide a Google Cloud Platform source with the [`sumologic_gcp_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/gcp_source) resource. + + +::: + ## Configure a Google Cloud Platform Source The Google Cloud Platform (GCP) Source receives log data from Google Pub/Sub. diff --git a/docs/send-data/hosted-collectors/http-source/logs-metrics/index.md b/docs/send-data/hosted-collectors/http-source/logs-metrics/index.md index 113e910481..a11f20f7dc 100644 --- a/docs/send-data/hosted-collectors/http-source/logs-metrics/index.md +++ b/docs/send-data/hosted-collectors/http-source/logs-metrics/index.md @@ -15,6 +15,14 @@ With an HTTP Logs and Metrics Source you can upload logs and metrics from data s When you set up an HTTP Logs and Metrics Source, a unique URL is assigned to that source. The generated URL is a long string of letters and numbers. You can generate a new URL at any time. For more information, see [Generating a new URL](../generate-new-url.md). +import TerraformLink from '../../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an HTTP source with the [`sumologic_http_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/http_source) resource. + + +::: + ## Data payload considerations We recommend that the data payload of a POST request have a size, before compression, of 100KB to 1MB. diff --git a/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md b/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md index aabf34b6ef..601231bb16 100644 --- a/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md +++ b/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md @@ -9,6 +9,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; Azure Metrics Source is used to collect all available metrics from Azure Monitor into Sumo Logic. To obtain a complete list of metrics that are collected using this source, refer to the [Azure Documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/metrics-index#supported-metrics-and-log-categories-by-resource-type). +import TerraformLink from '../../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an Azure Metrics source with the [`sumologic_azure_metrics_source`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/azure_metrics_source) resource. + + +::: + ## Setup ### Vendor configuration diff --git a/docs/send-data/installed-collectors/configuration.md b/docs/send-data/installed-collectors/configuration.md index fdaea3d210..2df5c262aa 100644 --- a/docs/send-data/installed-collectors/configuration.md +++ b/docs/send-data/installed-collectors/configuration.md @@ -18,6 +18,14 @@ See [Choosing a Sumo Logic Collector and Source](/docs/send-data/choose-collecto The maximum number of Collectors allowed per organization is 10,000. ::: +import TerraformLink from '../../reuse/terraform-link.md'; + +:::tip +You can use Terraform to provide an install collector with the [`sumologic_collector`](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs/resources/installed_collector) resource. + + +::: + :::sumo Micro Lesson