logzio · Simplychee · Jul 29, 2025 · Jul 29, 2025
diff --git a/docs/_include/log-shipping/certificate.md b/docs/_include/log-shipping/certificate.md
@@ -4,5 +4,5 @@ For HTTPS shipping, download the Logz.io public certificate to your certificate
 
 
 ```shell
-sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt
+sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/AAACertificateServices.crt
 ```
diff --git a/docs/_include/log-shipping/syslog-filebeat.md b/docs/_include/log-shipping/syslog-filebeat.md
@@ -27,5 +27,5 @@
    output.logstash:
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
    ```
diff --git a/docs/_include/log-shipping/validate-yaml.md b/docs/_include/log-shipping/validate-yaml.md
@@ -2,6 +2,6 @@
 
 When you're done adding your sources, click **Make the config file** to download it.
 
-You can compare it to our [sample configuration](https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/logz-filebeat-config.yml) if you have questions.
+You can compare it to our [sample configuration](https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/logz-filebeat-config.yml) if you have questions.
 
 Validate the file using a YAML validator tool, such as ([Yamllint.com](http://www.yamllint.com/).
diff --git a/docs/shipping/Access-Management/active-directory.md b/docs/shipping/Access-Management/active-directory.md
@@ -26,7 +26,7 @@ Active Directory is a directory service developed by Microsoft for Windows domai
 
 Download the
 [Logz.io public certificate]({@include: ../../_include/log-shipping/certificate-path.md})
-to `C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt`
+to `C:\ProgramData\Winlogbeat\AAACertificateServices.crt`
 on your machine.
 
 ### Configure Windows applications as an input
@@ -93,7 +93,7 @@ Winlogbeat can have one output only, so remove any other `output` entries.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['C:\ProgramData\Winlogbeat\AAACertificateServices.crt']
 ```
 
 ### Restart Winlogbeat

diff --git a/docs/shipping/CI-CD/gitlab.md b/docs/shipping/CI-CD/gitlab.md
@@ -193,7 +193,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/CI-CD/jenkins.md b/docs/shipping/CI-CD/jenkins.md
@@ -106,7 +106,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 #### Start Filebeat

diff --git a/docs/shipping/CI-CD/puppet.md b/docs/shipping/CI-CD/puppet.md
@@ -167,7 +167,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ##### Start Filebeat

diff --git a/docs/shipping/Compute/apache-http-server.md b/docs/shipping/Compute/apache-http-server.md
@@ -143,7 +143,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/...pping/Containers/oracle-cloud-infrastructure-container-engine-for-kubernetes.md b/...pping/Containers/oracle-cloud-infrastructure-container-engine-for-kubernetes.md
@@ -62,25 +62,25 @@ Run the relevant command for your type of deployment.
 ##### Deploy the standard configuration
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/k8s-filebeat-oke.yaml -f https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/filebeat-standard-configuration.yaml
+kubectl apply -f https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/shipping-config-samples/k8s-filebeat-oke.yaml -f https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/filebeat-standard-configuration.yaml
 ```
 
 ##### Deploy the standard configuration with Filebeat autodiscover enabled
 
 Autodiscover allows you to adapt settings as changes happen. By defining configuration templates, the autodiscover subsystem can monitor services as they start running.  See Elastic documentation to [learn more about Filebeat Autodiscover](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html). 
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/k8s-filebeat-oke.yaml -f https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/filebeat-autodiscovery-configuration.yaml
+kubectl apply -f https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/k8s-filebeat-oke.yaml -f https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/filebeat-autodiscovery-configuration.yaml
 ```
 
 ##### Deploy a custom configuration
 
-If you want to apply your own custom configuration, download the standard `configmap.yaml` file from the [Logz.io GitHub repo](https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/filebeat-standard-configuration.yaml) and apply your changes. Make sure to keep the file structure unchanged.
+If you want to apply your own custom configuration, download the standard `configmap.yaml` file from the [Logz.io GitHub repo](https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/filebeat-standard-configuration.yaml) and apply your changes. Make sure to keep the file structure unchanged.
 
 Run the following command to download the file:
 
 ```shell
-wget https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/filebeat-standard-configuration.yaml
+wget https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/filebeat-standard-configuration.yaml
 ```
 
 Apply your custom configuration to the parameters under `filebeat.yml` and only there. The filebeat.yml field contains a basic Filebeat configuration. You should not change the 'output' field (indicated in the example below). See Elastic documentation to [learn more about Filebeat configuration options](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html).
@@ -121,13 +121,13 @@ filebeat.yml: |-
     logstash:
       hosts: ["${LOGZIO_LOGS_LISTENER_HOST}:5015"]
       ssl:
-        certificate_authorities: ['/etc/pki/tls/certs/SectigoRSADomainValidationSecureServerCA.crt']
+        certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 Run the following to deploy your custom Filebeat configuration:
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/logzio/logz-docs/master/shipping-config-samples/k8s-filebeat-oke.yaml -f <<Your-custom-configuration-file.yaml>>
+kubectl apply -f https://raw.githubusercontent.com/logzio/documentation/refs/heads/master/docs/_include/general-shipping/shipping-config-samples/k8s-filebeat-oke.yaml -f <<Your-custom-configuration-file.yaml>>
 ```
 
 #### Check Logz.io for your logs

diff --git a/docs/shipping/Database/mysql.md b/docs/shipping/Database/mysql.md
@@ -194,7 +194,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 #### Start Filebeat

diff --git a/docs/shipping/Distributed-Messaging/apache-storm.md b/docs/shipping/Distributed-Messaging/apache-storm.md
@@ -109,7 +109,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/GCP/gcp-stackdriver.md b/docs/shipping/GCP/gcp-stackdriver.md
@@ -371,7 +371,7 @@ output.logstash:
 
 
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 For a full list of available Filebeat configuration options for the Google Workspace module, please see Filebeat's [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html).

diff --git a/docs/shipping/Load-Balancer/nginx.md b/docs/shipping/Load-Balancer/nginx.md
@@ -129,7 +129,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 #### Start Filebeat

diff --git a/docs/shipping/Network/juniper-srx.md b/docs/shipping/Network/juniper-srx.md
@@ -93,7 +93,7 @@ Copy and paste the following code block directly below. It sets Logz.io as the o
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 

diff --git a/docs/shipping/Network/network-device.md b/docs/shipping/Network/network-device.md
@@ -72,7 +72,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/Network/openvpn.md b/docs/shipping/Network/openvpn.md
@@ -73,7 +73,7 @@ Paste the following into the inputs section of the Filebeat configuration file:
    output.logstash:
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
    ```
 
 If you're running Filebeat 7 to 8.1, paste the code block below instead:
@@ -112,7 +112,7 @@ If you're running Filebeat 7 to 8.1, paste the code block below instead:
    output.logstash:
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt'] 
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt'] 
    ```
 
 

diff --git a/docs/shipping/Other/axonius.md b/docs/shipping/Other/axonius.md
@@ -80,7 +80,7 @@ By default, syslog will be forwarded over port 514. Feel free to adjust this, ba
    output.logstash:
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
    ```
 
    * Replace `<<ADDRESS-OF-YOUR-FILEBEAT-SERVER>>` with the address of your server running Filebeat.

diff --git a/docs/shipping/Other/beats.md b/docs/shipping/Other/beats.md
@@ -60,7 +60,7 @@ This document describes the way to get logs from your system to Logz.io using an
      logstash:
        hosts: ["<<LISTENER-HOST>>:5015"]  
        ssl:
-         certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+         certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
    ```
 7. {@include: ../../_include/log-shipping/listener-var.html}
 8. Save the changes.

diff --git a/docs/shipping/Other/bunny-net.md b/docs/shipping/Other/bunny-net.md
@@ -103,7 +103,7 @@ sudo openssl req -newkey rsa:2048 -nodes \
    output.logstash:
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt'] 
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt'] 
    ```
 
    * Replace `<<ADDRESS-OF-YOUR-FILEBEAT-SERVER>>` with the address of your server running Filebeat.

diff --git a/docs/shipping/Other/microsoft-365.md b/docs/shipping/Other/microsoft-365.md
@@ -69,7 +69,7 @@ For HTTPS shipping, download the Logz.io public certificate to your certificate
 
 
 ```shell
-curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o C:\ProgramData\filebeat\COMODORSADomainValidationSecureServerCA.crt
+curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o C:\ProgramData\filebeat\AAACertificateServices.crt
 ```
 
 ### Configure Filebeat
@@ -108,7 +108,7 @@ curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACert
        #  - "Audit.General"
        #  - "DLP.All"
        # Use the following settings to enable certificate-based authentication:
-       #var.certificate: "C:\ProgramData\filebeat1\COMODORSADomainValidationSecureServerCA.crt"
+       #var.certificate: "C:\ProgramData\filebeat1\AAACertificateServices.crt"
        # var.key: "/path/to/private_key.pem"
        # var.key_passphrase: "myPrivateKeyPassword"
        # Client-secret based authentication:
@@ -158,7 +158,7 @@ curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACert
      logstash:
        hosts: ["<<LISTENER-HOST>>:5015"]
        ssl:
-         certificate_authorities: ['C:\ProgramData\filebeat\COMODORSADomainValidationSecureServerCA.crt']
+         certificate_authorities: ['C:\ProgramData\filebeat\AAACertificateServices.crt']
    ```
 
    * {@include: ../../_include/log-shipping/log-shipping-token.md}

diff --git a/docs/shipping/Other/rsyslog.md b/docs/shipping/Other/rsyslog.md
@@ -80,7 +80,7 @@ $InputFileSeverity info
 $InputFilePersistStateInterval 20000
 $InputRunFileMonitor
 
-$DefaultNetstreamDriverCAFile /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt
+$DefaultNetstreamDriverCAFile /etc/pki/tls/certs/AAACertificateServices.crt
 $ActionSendStreamDriver gtls
 $ActionSendStreamDriverMode 1
 $ActionSendStreamDriverAuthMode x509/name

diff --git a/docs/shipping/Other/sysmon.md b/docs/shipping/Other/sysmon.md
@@ -30,7 +30,7 @@ Sysmon (System Monitor) is a Windows system service that monitors and logs syste
 
 Download the
 [Logz.io public certificate]({@include: ../../_include/log-shipping/certificate-path.md})
-to `C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt`
+to `C:\ProgramData\Winlogbeat\AAACertificateServices.crt`
 on your machine.
 
 ### Configure Windows applications as an input
@@ -69,7 +69,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"] 
   ssl:
-    certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['C:\ProgramData\Winlogbeat\AAACertificateServices.crt']
 ```
 
 

diff --git a/docs/shipping/Security/auditbeat.md b/docs/shipping/Security/auditbeat.md
@@ -152,7 +152,7 @@ auditbeat.modules:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"] 
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 

diff --git a/docs/shipping/Security/check-point.md b/docs/shipping/Security/check-point.md
@@ -136,7 +136,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/Security/cisco-asa.md b/docs/shipping/Security/cisco-asa.md
@@ -103,7 +103,7 @@ If Logz.io is not an output, add it now.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/Security/cisco-meraki.md b/docs/shipping/Security/cisco-meraki.md
@@ -84,7 +84,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ``` 
 
 {@include: ../../_include/general-shipping/replace-placeholders.html}

diff --git a/docs/shipping/Security/cynet.md b/docs/shipping/Security/cynet.md
@@ -84,7 +84,7 @@ These instructions are based on UDP. If you want to use TCP, make sure your sysl
    output.logstash: 
      hosts: ["<<LISTENER-HOST>>:5015"]
      ssl:
-       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+       certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
    ```
 
    * 9000 is the port we suggest. If you use a different port, replace the default values with your parameters.

diff --git a/docs/shipping/Security/eset.md b/docs/shipping/Security/eset.md
@@ -87,7 +87,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ``` 
 
 

diff --git a/docs/shipping/Security/fail2ban.md b/docs/shipping/Security/fail2ban.md
@@ -91,7 +91,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/Security/falco.md b/docs/shipping/Security/falco.md
@@ -219,7 +219,7 @@ filebeat.registry.path: /var/lib/filebeat
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 If you're running Filebeat 7 to 8.1, paste the code block below instead:
@@ -257,7 +257,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ``` 
 
 

diff --git a/docs/shipping/Security/fortigate.md b/docs/shipping/Security/fortigate.md
@@ -116,7 +116,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat

diff --git a/docs/shipping/Security/hashicorp-vault.md b/docs/shipping/Security/hashicorp-vault.md
@@ -102,7 +102,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 If you're running Filebeat 7 to 8.1, paste the code block below instead:
@@ -151,7 +151,7 @@ processors:
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 

diff --git a/docs/shipping/Security/mcafee-epolicy-orchestrator.md b/docs/shipping/Security/mcafee-epolicy-orchestrator.md
@@ -117,7 +117,7 @@ Remove all other outputs.
 output.logstash:
   hosts: ["<<LISTENER-HOST>>:5015"]
   ssl:
-    certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+    certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
 ```
 
 ### Start Filebeat
-Original file line number
+Diff line change
@@ Expand Up / @@ -371,7 +371,7 @@ output.logstash: @@
       ssl:
-        certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
+        certificate_authorities: ['/etc/pki/tls/certs/AAACertificateServices.crt']
     ```
     For a full list of available Filebeat configuration options for the Google Workspace module, please see Filebeat's [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html).
@@ Expand Down @@