diff --git a/docs/reuse/forward-to-siem.md b/docs/reuse/forward-to-siem.md
new file mode 100644
index 0000000000..61755549b5
--- /dev/null
+++ b/docs/reuse/forward-to-siem.md
@@ -0,0 +1,3 @@
+:::note
+Select **Forward to SIEM** only if you have Cloud SIEM installed.
+:::
\ No newline at end of file
diff --git a/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md b/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md
index de4ee69489..5856272d09 100644
--- a/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md
+++ b/docs/send-data/collect-from-other-data-sources/azure-monitoring/ms-azure-event-hubs-source.md
@@ -5,6 +5,7 @@ description: The Azure Event Hubs Source for Logs provides a secure endpoint to
---
import useBaseUrl from '@docusaurus/useBaseUrl';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
:::note
For higher data ingestion speed and scalability, this collection method is preferred over our similar [Azure Event Hubs cloud-to-cloud source collection method](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source).
@@ -69,7 +70,7 @@ To configure an Azure Event Hubs Source:
3. Select the **Azure Event Hubs for Logs** app.
4. Enter a Name for the Source. The description is optional.
})
5. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
+6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
7. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
* A green circle with a check mark is shown when the field exists in the Fields table schema.
* An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source.md
index 9d5ffd69a8..5dcd1d6526 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/1password-source.md
@@ -13,6 +13,7 @@ import ExampleJSON from '/files/c2c/1password/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/1password/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/1password/example.tf';
import useBaseUrl from '@docusaurus/useBaseUrl';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
@@ -49,7 +50,7 @@ You'll need a 1Password API token and your customer-specif
1. Search for and select **1Password**.
1. Enter a **Name** for the Source. The **description** is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
1. (Optional) **Fields**. Click the **+Add** link to add custom log metadata [Fields](/docs/manage/fields).
* Define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source.md
index 39c2a20e20..13a90bbbba 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/airtable-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/airtable/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/airtable/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/airtable/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -52,7 +53,7 @@ To configure an Airtable Source:
1. Search for and select **Airtable**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse)
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
1. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate. Each field needs a name (key) and value.
*  A green circle with a checkmark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/akamai-siem-api-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/akamai-siem-api-source.md
index a25f471ee9..6e1e79bddf 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/akamai-siem-api-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/akamai-siem-api-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/akamai-siem-api/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/akamai-siem-api/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/akamai-siem-api/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -45,7 +46,7 @@ To configure an Akamai SIEM API Source:
1. Search for and select **Akamai SIEM API**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. **Client Token**, **Client Secret**, **Access Token**, and **Akamai API Host**. Provide the Akamai SIEM API authentication credentials you want to use to [authenticate](#prerequisite-and-authentication)) collection requests. The **Akamai API Host** is the custom hostname applied to your credentials, it looks something like this: `akzz-XXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXX.luna.akamaiapis.net`.
1. **Config IDs**. Provide at least one Security Configuration ID you got when you turned on the SIEM integration in Akamai. This was done in the [prerequisite and authentication](#prerequisite-and-authentication) section.
1. **Parsing Options**. Select if you want to **Enable post processing** or **Disable all parsing**. The post processing options are **Decode httpMessage fields** and **Duplicate Events once for each rule associated with the event**. We recommend both parsing options when **Forward to SIEM** is enabled.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md
index b218b56ac4..13de4ac884 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/azure-event-hubs/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/azure-event-hubs/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/azure-event-hubs/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
:::note
@@ -71,7 +72,7 @@ To configure an Azure Event Hubs Source:
1. Search for and select **Azure Event Hubs**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/box-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/box-source.md
index 3754392ef4..bf83774717 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/box-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/box-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/box/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/box/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/box/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -44,7 +45,7 @@ To configure a Box Source:
1. Search for and select **Box**.
1. Enter a **Name** for the Source. The **description** is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields**. Click the **+Add** link to add custom log metadata [Fields](/docs/manage/fields).
* Define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source.md
index 37451b6ba1..1c1e3d7e7e 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-cloud-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/carbon-black-cloud/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/carbon-black-cloud/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/carbon-black-cloud/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -58,7 +59,7 @@ To configure a Carbon Black Cloud Source:
1. Search for and select **Carbon Black Cloud**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata.md) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the [fields](/docs/manage/fields) you want to associate. Each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source.md
index 52b483d79d..6f6f5a087b 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/carbon-black-inventory-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/carbon-black-inventory/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/carbon-black-inventory/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/carbon-black-inventory/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -43,7 +44,7 @@ To configure a Carbon Black Inventory Source:
1. Search for and select **Carbon Black Inventory**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata.md) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source.md
index 376a8a75e3..9ea5eb921c 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-amp-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/cisco-amp/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/cisco-amp/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/cisco-amp/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -41,7 +42,7 @@ To configure a Cisco AMP Source:
1. Search for and select **Cisco AMP**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-vulnerability-management-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-vulnerability-management-source.md
index b0d37c1303..01a651dd6a 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-vulnerability-management-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cisco-vulnerability-management-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/cisco-vulnerability-management/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/cisco-vulnerability-management/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/cisco-vulnerability-management/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -50,7 +51,7 @@ Only administrators are allowed to retrieve the key. For more information, refer
1. Search for and select **Cisco Vulnerability Management**.
1. Enter a **Name** for the Source. The **description** is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields**. Click the **+Add** link to add custom log metadata [Fields](/docs/manage/fields).
* Define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a checkmark is shown when the field exists and is enabled in the Fields table schema.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md
index f85241c211..7b46adb745 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/config-based-source.md
@@ -6,6 +6,7 @@ description: Learn how to set up a Config Based C2C to collect data into the Sum
---
import CodeBlock from '@theme/CodeBlock';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -50,7 +51,7 @@ When you create an Config Based Source, you add it to a Hosted Collector. Before
1. Search for and select **Config Based**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Parser path**. If **Forward to SIEM** option is selected, provide a [parser path](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/parsers/README.md).
1. (Optional) **Fields**. Click the **+Add** button to define the fields you want to associate. Each field needs a name (key) and value.
-  A green circle with a check mark is shown when the field exists in the Fields table schema.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory.md
index 0c7448df19..ba29fdc857 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-host-inventory.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/crowdstrike-fdr-host-inventory/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/crowdstrike-fdr-host-inventory/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/crowdstrike-fdr-host-inventory/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -71,7 +72,7 @@ To configure the CrowdStrike FDR Host Inventory API:
3. Select **CrowdStrike FDR Host Inventory** icon.
4. Enter a **Name** to display for the Source in the Sumo Logic web application. The description is optional.
5. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-6. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM as inventory.
+6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/) as inventory.
7. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate. Each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo Logic that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source.md
index a01e80ebbb..48ee7e97d3 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/crowdstrike/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/crowdstrike/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/crowdstrike/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -56,7 +57,7 @@ To configure a CrowdStrike Source:
1. Search for and select **CrowdStrike**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md
index d56d8b6676..53c0bf2af0 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cse-aws-ec-inventory-source.md
@@ -14,6 +14,7 @@ import MyComponentSource1 from '!!raw-loader!/files/c2c/cse-aws-ec-inventory/exa
import TerraformExample1 from '!!raw-loader!/files/c2c/cse-aws-ec-inventory/example1.tf';
import MyComponentSource2 from '!!raw-loader!/files/c2c/cse-aws-ec-inventory/example2.json';
import TerraformExample2 from '!!raw-loader!/files/c2c/cse-aws-ec-inventory/example2.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -57,7 +58,7 @@ To configure a Cloud SIEM AWS EC2 Inventory Source:
1. Select **AWS EC2 Inventory**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cyberark-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cyberark-source.md
index 6ed95e0432..144c585b4a 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cyberark-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cyberark-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/cyberark/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/cyberark/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/cyberark/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -49,7 +50,7 @@ To configure a CyberArk EPM Source, follow the steps below:
1. **Name**. Enter a name to display for the Source in the Sumo Logic web application.
1. **Description**. (Optional)
1. **Source Category**. Enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. Fields. (Optional) Click **+Add** to ad additional fields; each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist, or is disabled, in the Fields table schema. In this case, an option to automatically add or enable the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema or is disabled it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cybereason-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cybereason-source.md
index f3fd93d38d..26578e1d55 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cybereason-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cybereason-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/cybereason/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/cybereason/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/cybereason/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -45,7 +46,7 @@ To configure a Cybereason Source:
1. Search for and select **Cybereason**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source.md
index 03cd9fec20..57600cac20 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dropbox-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/dropbox/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/dropbox/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/dropbox/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -50,7 +51,7 @@ To configure a Dropbox source:
1. Select **Dropbox**.
1. Enter a **Name** for the Source. The **description** is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md
index bc3383c778..e9cc85f5ee 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/duo/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/duo/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/duo/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -41,7 +42,7 @@ To configure a Duo Source:
1. Search for and select **Duo**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-alertcenter.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-alertcenter.md
index 829b488008..0e81bb406f 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-alertcenter.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-alertcenter.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/google-workspace-alertcenter/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/google-workspace-alertcenter/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/google-workspace-alertcenter/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -61,7 +62,7 @@ Follow the below steps to create Google Workspace AlertCenter service account cr
1. **Name.** Enter a name for the Source.
1. **Description.** (Optional). Enter the description of the Source.
1. **Source Category.** Enter a string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM.** Click if you want the Source to forward the logs it ingests to Cloud SIEM.
+1. **Forward to SIEM**. Click if you want the Source to forward the logs it ingests to [Cloud SIEM](/docs/cse/).
1. **Fields.** (Optional) Click **+Add Field** to define the fields you want to associate, each field needs a name (key) and value. For more information, see [Fields](/docs/manage/fields).
*  A green circle with a checkmark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo Logic that does not exist in the Fields schema it is ignored (i.e., dropped).
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-source.md
index 5f45cb08ad..49d075562f 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-workspace-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/google-workspace/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/google-workspace/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/google-workspace/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -92,7 +93,7 @@ To configure a Google Workspace User Inventory source:
1. Select **Google Workspace: User Inventory**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM and become part of User Inventory.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/) so it becomes part of User Inventory.
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source.md
index 83f3c6b40d..79fefb22a4 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-azure-ad-inventory-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/microsoft-azure-ad-inventory/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/microsoft-azure-ad-inventory/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/microsoft-azure-ad-inventory/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -80,7 +81,7 @@ To configure a Microsoft Azure AD Inventory Source:
1. Search for and select **Microsoft Azure AD Inventory**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md
index 5157158222..137183504c 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-azure-ad-reporting-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/microsoft-graph-azure-ad-reporting/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/microsoft-graph-azure-ad-reporting/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/microsoft-graph-azure-ad-reporting/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -79,7 +80,7 @@ To configure a Microsoft Graph Azure AD Reporting Source:
1. Search for and select **MS Graph Azure AD Reporting**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source.md
index 289f544673..03d5a9048b 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-identity-protection-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/microsoft-graph-identity-protection/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/microsoft-graph-identity-protection/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/microsoft-graph-identity-protection/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -74,7 +75,7 @@ To configure a Microsoft Graph Identity Protection Source:
1. Search for and select **Microsoft Graph Identity Protection Source**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source.md
index 471fa7ee52..1fa2c06528 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/microsoft-graph-security-api-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/microsoft-graph-security-api/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/microsoft-graph-security-api/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/microsoft-graph-security-api/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -73,7 +74,7 @@ To configure a Microsoft Graph Security API Source:
1. Search for and select **Microsoft Graph Security API**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mimecast-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mimecast-source.md
index 0370a242d6..5f4b932548 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mimecast-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mimecast-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/mimecast/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/mimecast/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/mimecast/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -50,7 +51,7 @@ To configure a Mimecast Source:
1. Search for and select **Mimecast**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-source.md
index 579b02e53d..450dfdea2e 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/netskope/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/netskope/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/netskope/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -79,7 +80,7 @@ To configure a Netskope Source:
1. Search for and select **Netskope**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-webtx-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-webtx-source.md
index 61dd571514..3ae68ec091 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-webtx-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/netskope-webtx-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/netskope-webtx/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/netskope-webtx/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/netskope-webtx/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -50,7 +51,7 @@ When you create a Netskope WebTx API Source, you add it to a Hosted Collector. B
1. Search for and select **Netskope WebTx API**.
1. Enter a **Name** to display the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/okta-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/okta-source.md
index bbb0fbc885..a71abbbd36 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/okta-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/okta-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/okta/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/okta/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/okta/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -42,7 +43,7 @@ To configure an Okta Source:
1. Select **Okta**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source.md
index 16dd9a372c..91c6116a04 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/palo-alto-cortex-xdr/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/palo-alto-cortex-xdr/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/palo-alto-cortex-xdr/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -75,7 +76,7 @@ To configure a Palo Alto Cortex XDR Source:
1. Select **Palo Alto Cortex XDR**.
1. Enter a **Name** to display for the Source in the Sumo Logic web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-on-demand-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-on-demand-source.md
index 411a9c0c53..cc8518263d 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-on-demand-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-on-demand-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/proofpoint-on-demand/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/proofpoint-on-demand/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/proofpoint-on-demand/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -50,7 +51,7 @@ To configure a Proofpoint On Demand Source:
3. Select **Proofpoint On Demand**.
4. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
5. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-6. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
7. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-tap-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-tap-source.md
index 9fbecede7e..86c160671b 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-tap-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/proofpoint-tap-source.md
@@ -10,6 +10,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/proofpoint-tap/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/proofpoint-tap/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/proofpoint-tap/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -188,7 +189,7 @@ To configure a Proofpoint TAP Source:
1. Search for and select **Proofpoint TAP**.
1. Enter a **Name** for the Source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source.md
index 28d89f23a1..84e9e69fbb 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sailpoint-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/sailpoint/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/sailpoint/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/sailpoint/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -54,7 +55,7 @@ To configure a Duo Source:
1. Search for and select **SailPoint**.
1. Enter a **Name** for the Source. The **description** is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/salesforce-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/salesforce-source.md
index 4bfe427c27..b220d5c0bd 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/salesforce-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/salesforce-source.md
@@ -13,6 +13,7 @@ import MyComponentSource from '!!raw-loader!/files/c2c/salesforce/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/salesforce/example.tf';
import useBaseUrl from '@docusaurus/useBaseUrl';
import CollBegin from '../../../reuse/collection-should-begin-note.md';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
})
@@ -71,7 +72,7 @@ To configure a Salesforce Source:
1. Select **Salesforce**.
1. Enter a **Name** for the Source in the Sumo Logic console. The description is optional.
1. For **Source Category (Optional)**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM.** Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source.md
index 6690b40267..6e9cc96ecd 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sentinelone-mgmt-api-source.md
@@ -11,6 +11,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/sentinelone-mgmt-api/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/sentinelone-mgmt-api/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/sentinelone-mgmt-api/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -59,7 +60,7 @@ To configure a SentinelOne Mgmt API Source:
1. Search for and select **SentinelOne Mgmt API**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM.
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source.md
index 7331a3d5ce..b7e27e3123 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sophos-central-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/sophos-central/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/sophos-central/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/sophos-central/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -51,7 +52,7 @@ To configure a Sophos Central Source:
1. Select **Sophos Central**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/source-info.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/source-info.md
index 7fd746b1aa..b2588fa105 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/source-info.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/source-info.md
@@ -28,7 +28,7 @@ Hover your mouse over the status icon to view a tooltip with a count of the dete
**Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
:::note
-The checkbox only shows up if you have CSE and if the C2C already have CSE content like parsers and rules.
+The checkbox only shows up if you have Cloud SIEM and if the C2C already has Cloud SIEM content like parsers and rules.
:::
| Field | Value | Description |
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source.md
index 7202fc1598..528ebcd671 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-web-security-service-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/symantec-web-security-service/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/symantec-web-security-service/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/symantec-web-security-service/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -61,7 +62,7 @@ To configure a Symantec Web Security Service Source:
1. Select **Symantec Web Security Service**.
1. Enter a **Name** to display for the Source in the Sumo web application. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields**. Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source.md
index 602d67c019..9f45c4ff4b 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/tenable-source.md
@@ -12,6 +12,7 @@ import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/tenable/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/tenable/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/tenable/example.tf';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import useBaseUrl from '@docusaurus/useBaseUrl';
})
@@ -50,7 +51,7 @@ To configure a Tenable source:
1. Select for and select **Tenable**.
1. Enter a **Name** for the source. The description is optional.
1. (Optional) For **Source Category**, enter any string to tag the output collected from the source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) is stored in a searchable field called `_sourceCategory`.
-1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse).
+1. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
*  A green circle with a check mark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source.md
index eb1105696a..57b1ec8ca5 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/workday-source.md
@@ -13,6 +13,7 @@ import ExampleJSON from '/files/c2c/workday/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/workday/example.json';
import TerraformExample from '!!raw-loader!/files/c2c/workday/example.tf';
import useBaseUrl from '@docusaurus/useBaseUrl';
+import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
import CollBegin from '../../../reuse/collection-should-begin-note.md';
})
@@ -45,7 +46,7 @@ To configure a Workday Source, follow the steps below:
3. Select for and select **Workday**.
4. Enter a **Name** to display for the Source in the Sumo Logic web application. The **description** is optional.
5. For **Source Category** (Optional), enter any string to tag the output collected from the Source. Category [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata/) is stored in a searchable field called `_sourceCategory`.
-6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
+6. **Forward to SIEM**. Check the checkbox to forward your data to [Cloud SIEM](/docs/cse/).
7. **Fields** (Optional). Click the **+Add** field link to define the fields you want to associate. Each field needs a name (key) and value.
*  A green circle with a checkmark is shown when the field exists in the Fields table schema.
*  An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.