})
Tokens
diff --git a/docs/api/threat-intel-ingest.md b/docs/api/threat-intel-ingest.md
index d3e2f58688..11d62e1c92 100644
--- a/docs/api/threat-intel-ingest.md
+++ b/docs/api/threat-intel-ingest.md
@@ -1,21 +1,25 @@
---
id: threat-intel-ingest
title: Threat Intel Ingest Management APIs
-sidebar_label: Threat Intel Ingest Management
+sidebar_label: Threat Intel
description: The Threat Intel Ingest Management API allows you to upload STIX 2.x threat intel indicators, view storage status of threat intel ingest service, and view and set the retention period for threat intel indicators.
-hide_table_of_contents: true
---
import useBaseUrl from '@docusaurus/useBaseUrl';
import ApiIntro from '../reuse/api-intro.md';
+import ApiRoles from '../reuse/api-roles.md';
})
-The [Threat Intel Ingest Management](/docs/security/threat-intelligence) API allows you to:
+The Threat Intel Ingest Management API allows you to:
-* Upload STIX 2.x threat intel indicators
-* View storage status of threat intel ingest service
-* View and set the retention period for threat intel indicators
+* Upload threat intelligence indicators
+* View storage status of threat intelligence ingest service
+* View and set the retention period for threat intelligence indicators
+
+For more information about threat intelligence, see [About Sumo Logic Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/).
+
+## Documentation
@@ -30,3 +34,11 @@ The [Threat Intel Ingest Management](/docs/security/threat-intelligence) API all
| JP | https://api.jp.sumologic.com/docs/#tag/threatIntelIngest |
| US1 | https://api.sumologic.com/docs/#tag/threatIntelIngest |
| US2 | https://api.us2.sumologic.com/docs/#tag/threatIntelIngest |
+
+## Required role capabilities
+
+
+
+* Threat Intel
+ * View Threat Intel Data Store
+ * Manage Threat Intel Data Store
diff --git a/docs/cse/administration/create-custom-threat-intel-source.md b/docs/cse/administration/create-custom-threat-intel-source.md
index 9f85b6020c..0830bbc5a7 100644
--- a/docs/cse/administration/create-custom-threat-intel-source.md
+++ b/docs/cse/administration/create-custom-threat-intel-source.md
@@ -10,7 +10,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
@@ -19,7 +19,7 @@ This topic has information about setting up a *custom threat intelligence source
You can set up and populate custom threat intelligence sources interactively from the Cloud SIEM UI, by uploading a .csv file, or using Cloud SIEM APIs. You can populate the sources with IP addresses, domains, URLs, email addresses, and file hashes.
:::note
-You can also use the Sumo Logic threat intelligence framework to add sources. See [Threat Intelligence](/docs/security/threat-intelligence/).
+You can also use the Sumo Logic threat intelligence framework to add sources. See [Sumo Logic Threat Intelligence](/docs/security/threat-intelligence/).
:::
## How Cloud SIEM uses indicators
diff --git a/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md b/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md
index 4613a13e20..14a3478211 100644
--- a/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md
+++ b/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md
@@ -171,7 +171,7 @@ See: [Create and Use Network Blocks](/docs/cse/administration/create-use-network
Cloud SIEM heavily leverages threat intelligence to do real-time comparisons against known bad indicators. You can configure popular free threat feeds. But if your security team pays for premium threat intelligence (such as RecordedFuture, Anomali, Crowdstrike, ThreatConnect, and so on), you can configure these too.
-See: [Manage Threat Intelligence Indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/)
+See: [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators)
### Create lists
Perform the following steps to create lists to allow or suppress information monitored for Cloud SIEM.
diff --git a/docs/cse/rules/about-cse-rules.md b/docs/cse/rules/about-cse-rules.md
index 713baf6974..d07418d147 100644
--- a/docs/cse/rules/about-cse-rules.md
+++ b/docs/cse/rules/about-cse-rules.md
@@ -181,7 +181,7 @@ This example below checks a record for a field named `listMatches` that contains
### Threat Intelligence
-Threat Intelligence sources contain values that, when encountered in a record, are clear indicators of compromise. To create a new source of Threat Intelligence, see [Manage Threat Intelligence Indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/).
+Threat Intelligence sources contain values that, when encountered in a record, are clear indicators of compromise. To create a new source of Threat Intelligence, see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators).
Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/).
diff --git a/docs/manage/users-roles/roles/role-capabilities.md b/docs/manage/users-roles/roles/role-capabilities.md
index ea0708d55c..227d4e1b40 100644
--- a/docs/manage/users-roles/roles/role-capabilities.md
+++ b/docs/manage/users-roles/roles/role-capabilities.md
@@ -129,8 +129,8 @@ Folder-level permissions are available if your org has fine-grained Monitor perm
## Threat Intel
| Capability | Description |
| :-- | :-- |
-| View Threat Intel Data Store | Search log data using [threat intelligence indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/). |
-| Manage Threat Intel Data Store | Create, edit, and delete [threat intelligence indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/). |
+| View Threat Intel Data Store | View the [Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/) tab. |
+| Manage Threat Intel Data Store | Create, edit, and delete threat intelligence sources on the [Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/) tab. |
## Cloud SOAR
diff --git a/docs/platform-services/index.md b/docs/platform-services/index.md
index 2d5d453212..4397b71264 100644
--- a/docs/platform-services/index.md
+++ b/docs/platform-services/index.md
@@ -15,10 +15,4 @@ Platform services are services that are available to use across the entire Sumo
Learn how to use the Automation Service to automate actions.
})
}){kind=icon}
}){kind=icon}