Skip to content

Commit 4669cf3

Browse files
authored
CONN-3282: remove SIEM forward from doc (#4189)
1 parent 4084f1a commit 4669cf3

File tree

3 files changed

+1
-8
lines changed

3 files changed

+1
-8
lines changed

docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-source.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ To configure a CrowdStrike FDR Source:
4848
1. Search for and select **CrowdStrike FDR**.
4949
1. Enter a **Name** for the Source. The description is optional.
5050
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
51-
1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM. When configured with the **Forward to SIEM** option no fields are set.
5251
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
5352
* ![green check circle.png](/img/reuse/green-check-circle.png) A green circle with a check mark is shown when the field exists in the Fields table schema.
5453
* ![orange exclamation point.png](/img/reuse/orange-exclamation-point.png) An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
@@ -84,7 +83,7 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma
8483
| name | String | Yes | `null` | Type a desired name of the source. The name must be unique per Collector. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_source`. | `"mySource"` |
8584
| description | String | No | `null` | Type a description of the source. | `"Testing source"`
8685
| category | String | No | `null` | Type a category of the source. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_sourceCategory`. See [best practices](/docs/send-data/best-practices) for details. | `"mySource/test"`
87-
| fields | JSON Object | No | `null` | JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field `_siemForward` to enable forwarding to SIEM.|`{"_siemForward": false, "fieldA": "valueA"}` |
86+
| fields | JSON Object | No | `null` | JSON map of key-value fields (metadata) to apply to the Collector or Source. |`{"fieldA": "valueA"}` |
8887
| secretAccessKey` | String | Yes | | The AWS Secret Access Key you got from CrowdStrike. | |
8988
| SqsQueueURL | String | Yes | `null` | The SQS Queue URL you got from CrowdStrike. | |
9089
| accessKeyId | String | Yes | `null` | The AWS Access Key ID you got from CrowdStrike. | |

static/files/c2c/crowdstrike-fdr/example.json

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@
1313
"SqsQueueURL":"https://sqs.us-west-1.amazonaws.com/***/***",
1414
"multilineEnabled":false,
1515
"accessKeyId":"********",
16-
"fields":{
17-
"_siemForward":false
18-
},
1916
"category":"Sumo/FDR",
2017
"timestampFormatAutoDetection":false,
2118
"s3Region":"us-west-1",

static/files/c2c/crowdstrike-fdr/example.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ resource "sumologic_cloud_to_cloud_source" "crowdstrike_FDR_source" {
1212
"SqsQueueURL":"https://sqs.us-west-1.amazonaws.com/***/***",
1313
"multilineEnabled":false,
1414
"accessKeyId":"********",
15-
"fields":{
16-
"_siemForward":false
17-
},
1815
"category":"Sumo/FDR",
1916
"timestampFormatAutoDetection":false,
2017
"s3Region":"us-west-1",

0 commit comments

Comments
 (0)