From cb5b874315f5ca88c259c74794fd5db1d2035e68 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Tue, 4 Mar 2025 11:58:08 -0600 Subject: [PATCH 1/2] DOCS-25 - Fix minor threat intel issues --- blog-service/2025-03-03-security.md | 4 ++-- docs/api/index.md | 5 ++++ docs/api/threat-intel-ingest.md | 24 ++++++++++++++----- .../create-custom-threat-intel-source.md | 4 ++-- .../onboarding-checklist-cse.md | 2 +- docs/cse/rules/about-cse-rules.md | 2 +- .../users-roles/roles/role-capabilities.md | 4 ++-- docs/platform-services/index.md | 6 ----- .../search-operators/index.md | 2 +- .../search-operators/threatlookup.md | 4 ++-- docs/search/subqueries.md | 2 +- .../threat-intelligence-indicators.md | 2 +- .../threat-intelligence/upload-formats.md | 4 ++-- .../crowdstrike-threat-intel-source.md | 2 +- .../index.md | 2 +- .../intel-471-threat-intel-source.md | 2 +- .../mandiant-threat-intel-source.md | 2 +- .../stix-taxii-1-client-source.md | 2 +- .../stix-taxii-2-client-source.md | 2 +- .../zerofox-intel-source.md | 4 ++-- docusaurus.config.js | 6 ----- sidebars.ts | 1 + 22 files changed, 47 insertions(+), 41 deletions(-) diff --git a/blog-service/2025-03-03-security.md b/blog-service/2025-03-03-security.md index f092f4df97..65a2ebc7b3 100644 --- a/blog-service/2025-03-03-security.md +++ b/blog-service/2025-03-03-security.md @@ -1,8 +1,8 @@ --- title: Threat Intelligence (Security) -image: https://www.sumologic.com/img/logo.svg +image: https://help.sumologic.com/img/sumo-square.png keywords: - - platform services + - security - threat intel hide_table_of_contents: true --- diff --git a/docs/api/index.md b/docs/api/index.md index 2ad887755a..44297850d2 100644 --- a/docs/api/index.md +++ b/docs/api/index.md @@ -230,6 +230,11 @@ To connect with other Sumo Logic users, post feedback, or ask a question, visit Thumbnail icon

Span Analytics

 +
+
+ Thumbnail icon

Threat Intel Ingest

 +
+
Thumbnail icon

Tokens

 diff --git a/docs/api/threat-intel-ingest.md b/docs/api/threat-intel-ingest.md index d3e2f58688..11d62e1c92 100644 --- a/docs/api/threat-intel-ingest.md +++ b/docs/api/threat-intel-ingest.md @@ -1,21 +1,25 @@ --- id: threat-intel-ingest title: Threat Intel Ingest Management APIs -sidebar_label: Threat Intel Ingest Management +sidebar_label: Threat Intel description: The Threat Intel Ingest Management API allows you to upload STIX 2.x threat intel indicators, view storage status of threat intel ingest service, and view and set the retention period for threat intel indicators. -hide_table_of_contents: true --- import useBaseUrl from '@docusaurus/useBaseUrl'; import ApiIntro from '../reuse/api-intro.md'; +import ApiRoles from '../reuse/api-roles.md'; icon -The [Threat Intel Ingest Management](/docs/security/threat-intelligence) API allows you to: +The Threat Intel Ingest Management API allows you to: -* Upload STIX 2.x threat intel indicators -* View storage status of threat intel ingest service -* View and set the retention period for threat intel indicators +* Upload threat intelligence indicators +* View storage status of threat intelligence ingest service +* View and set the retention period for threat intelligence indicators + +For more information about threat intelligence, see [About Sumo Logic Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/). + +## Documentation @@ -30,3 +34,11 @@ The [Threat Intel Ingest Management](/docs/security/threat-intelligence) API all | JP | https://api.jp.sumologic.com/docs/#tag/threatIntelIngest | | US1 | https://api.sumologic.com/docs/#tag/threatIntelIngest | | US2 | https://api.us2.sumologic.com/docs/#tag/threatIntelIngest | + +## Required role capabilities + + + +* Threat Intel + * View Threat Intel Data Store + * Manage Threat Intel Data Store diff --git a/docs/cse/administration/create-custom-threat-intel-source.md b/docs/cse/administration/create-custom-threat-intel-source.md index 9f85b6020c..0830bbc5a7 100644 --- a/docs/cse/administration/create-custom-threat-intel-source.md +++ b/docs/cse/administration/create-custom-threat-intel-source.md @@ -10,7 +10,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -19,7 +19,7 @@ This topic has information about setting up a *custom threat intelligence source You can set up and populate custom threat intelligence sources interactively from the Cloud SIEM UI, by uploading a .csv file, or using Cloud SIEM APIs. You can populate the sources with IP addresses, domains, URLs, email addresses, and file hashes. :::note -You can also use the Sumo Logic threat intelligence framework to add sources. See [Threat Intelligence](/docs/security/threat-intelligence/). +You can also use the Sumo Logic threat intelligence framework to add sources. See [Sumo Logic Threat Intelligence](/docs/security/threat-intelligence/). ::: ## How Cloud SIEM uses indicators diff --git a/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md b/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md index 4613a13e20..14a3478211 100644 --- a/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md +++ b/docs/cse/get-started-with-cloud-siem/onboarding-checklist-cse.md @@ -171,7 +171,7 @@ See: [Create and Use Network Blocks](/docs/cse/administration/create-use-network Cloud SIEM heavily leverages threat intelligence to do real-time comparisons against known bad indicators. You can configure popular free threat feeds. But if your security team pays for premium threat intelligence (such as RecordedFuture, Anomali, Crowdstrike, ThreatConnect, and so on), you can configure these too. -See: [Manage Threat Intelligence Indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/) +See: [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators) ### Create lists Perform the following steps to create lists to allow or suppress information monitored for Cloud SIEM. diff --git a/docs/cse/rules/about-cse-rules.md b/docs/cse/rules/about-cse-rules.md index 713baf6974..d07418d147 100644 --- a/docs/cse/rules/about-cse-rules.md +++ b/docs/cse/rules/about-cse-rules.md @@ -181,7 +181,7 @@ This example below checks a record for a field named `listMatches` that contains ### Threat Intelligence -Threat Intelligence sources contain values that, when encountered in a record, are clear indicators of compromise. To create a new source of Threat Intelligence, see [Manage Threat Intelligence Indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/). +Threat Intelligence sources contain values that, when encountered in a record, are clear indicators of compromise. To create a new source of Threat Intelligence, see [Ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators). Threat Intelligence sources are used at the time of record ingestion. When a record is ingested, Cloud SIEM determines whether any of the fields in the record exist in any of your Threat Intelligence sources. When a record contains a value that matches an entry in one or more Threat Intelligence sources, the `hasThreatMatch` Cloud SIEM rules function searches incoming records in Cloud SIEM for matches to threat intelligence indicators. For more information, see [Threat Intelligence Indicators in Cloud SIEM](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/). diff --git a/docs/manage/users-roles/roles/role-capabilities.md b/docs/manage/users-roles/roles/role-capabilities.md index ea0708d55c..227d4e1b40 100644 --- a/docs/manage/users-roles/roles/role-capabilities.md +++ b/docs/manage/users-roles/roles/role-capabilities.md @@ -129,8 +129,8 @@ Folder-level permissions are available if your org has fine-grained Monitor perm ## Threat Intel | Capability | Description | | :-- | :-- | -| View Threat Intel Data Store | Search log data using [threat intelligence indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/). | -| Manage Threat Intel Data Store | Create, edit, and delete [threat intelligence indicators](/docs/security/threat-intelligence/threat-intelligence-indicators/). | +| View Threat Intel Data Store | View the [Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/) tab. | +| Manage Threat Intel Data Store | Create, edit, and delete threat intelligence sources on the [Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence/) tab. | ## Cloud SOAR diff --git a/docs/platform-services/index.md b/docs/platform-services/index.md index 2d5d453212..4397b71264 100644 --- a/docs/platform-services/index.md +++ b/docs/platform-services/index.md @@ -15,10 +15,4 @@ Platform services are services that are available to use across the entire Sumo

Learn how to use the Automation Service to automate actions.

-
-
- icon

Threat Intelligence

 -

Learn about Sumo Logic's threat intelligence capabilities.

-
-
diff --git a/docs/search/search-query-language/search-operators/index.md b/docs/search/search-query-language/search-operators/index.md index d242f8bf6c..4189426fac 100644 --- a/docs/search/search-query-language/search-operators/index.md +++ b/docs/search/search-query-language/search-operators/index.md @@ -381,7 +381,7 @@ In this section, we'll introduce the following concepts:
icon

threatip

 -

Correlates CrowdStrike's threat intelligence data based on IP addresses from your log data, helping you detect threats in your environment.

+

Correlates threat intelligence data based on IP addresses from your log data, helping you detect threats in your environment.