Skip to content

Commit

Permalink
Merge branch 'master' into hotjar
Browse files Browse the repository at this point in the history
  • Loading branch information
nico-shishkin authored Jan 3, 2024
2 parents c99d1c8 + 8a965fc commit 0630c12
Show file tree
Hide file tree
Showing 17 changed files with 263 additions and 92 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,10 @@ At this point, you can preview the alert and verify it's successfully monitoring
### 4. Add details for your alert


You can add additional details to the alert to provide context when and if it triggers. For example, adding `{{$labels.path}}` and `{{$values.D}}` to the summary will automatically populate information from the relevant services.
You can add additional details to the alert to provide context when and if it triggers. For example, adding `{{$labels.path}}` and `{{$values.D}}` to the summary will automatically populate information from the relevant services.

[Learn more about adding annotations and context to your alerts](https://grafana.com/docs/grafana/latest/alerting/alerting-rules/create-grafana-managed-rule/#add-annotations).


Click **Save** or **Save and exit**, located at the top right corner of the screen, to save your alert. You'll be redirected back to the panel view.

Expand Down
2 changes: 1 addition & 1 deletion docs/user-guide/admin/authentication-tokens/api-tokens.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ title: Manage API Tokens
---

If you're an Enterprise or Pro plan subscriber (or during your trial period),
your account includes API access. You can reference the [API guide](https://docs.logz.io/api/) and [Terraform Logz.io Provider guide](https://docs.logz.io/integrations/terraform/) to help you build integrations with Logz.io.
your account includes API access. You can reference the [API guide](https://api-docs.logz.io/docs/logz/logz-io-api/) and [Terraform Logz.io Provider guide](https://docs.logz.io/integrations/terraform/) to help you build integrations with Logz.io.

API tokens are unique to each account. The only exception is a subset of account configuration operations that must be run with the API token of the main account.

Expand Down
2 changes: 1 addition & 1 deletion docs/user-guide/admin/authentication-tokens/tokens.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ API tokens are available to Enterprise and Pro plan subscribers, as well as duri
To manage your API tokens, select [**<i class="li li-gear"></i>Settings > Tools > Manage tokens**](https://app.logz.io/#/dashboard/settings/manage-tokens/api) in the top menu and select the **API tokens** tab.

* For more information on [managing API tokens](https://docs.logz.io/user-guide/tokens/api-tokens.html)
* If you want to build your own integration, visit the [Logz.io API Developer Guide](https://docs.logz.io/api/)
* If you want to build your own integration, visit the [Logz.io API Developer Guide](https://api-docs.logz.io/docs/logz/logz-io-api/)

## About token permissions

Expand Down
28 changes: 14 additions & 14 deletions docs/user-guide/admin/hosting-regions/migration.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,10 @@ If you have custom parsing, ask your Logz.io Customer Success Manager or Account

Retrieve all sub-accounts and re-create them in your new account. You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve the settings for all of your Log Management accounts](https://docs.logz.io/api/#operation/getAllDetailedTimeBasedAccount).
1. In your pre-migration account, [retrieve the settings for all of your Log Management accounts](https://api-docs.logz.io/docs/logz/get-all-detailed-time-based-account).
2. In your post-migration account:
1. [Create a new sub-account](https://docs.logz.io/api/#operation/createTimeBasedAccount) with the matching settings. Repeat for each sub account.
2. [Update your main account](https://docs.logz.io/api/#operation/updateTimeBasedAccount) with the appropriate settings and daily capacity.
1. [Create a new sub-account](https://api-docs.logz.io/docs/logz/create-time-based-account) with the matching settings. Repeat for each sub account.
2. [Update your main account](https://api-docs.logz.io/docs/logz/update-time-based-account) with the appropriate settings and daily capacity.



Expand All @@ -63,15 +63,15 @@ Export any and all OpenSearch Dashboards objects you want to keep and import the
The process can be performed by API or manually. Export & import guides:

* [Export & import guide](https://docs.logz.io/user-guide/logs/share-import-export)
* [API guide](https://docs.logz.io/api/#tag/Import-or-export-Kibana-objects)
* [API guide](https://api-docs.logz.io/docs/logz/import-or-export-kibana-objects/)


### (Re-)Create your archive settings

Retrieve your archive settings and re-create them in your new account. You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve the archive settings](https://docs.logz.io/api/#operation/getSettingsForAccount). Repeat for each sub account.
2. In your post-migration account, [set up log archiving](https://docs.logz.io/api/#operation/createSettings). Repeat for each sub account, as necessary.
1. In your pre-migration account, [retrieve the archive settings](https://api-docs.logz.io/docs/logz/get-settings-for-account/). Repeat for each sub account.
2. In your post-migration account, [set up log archiving](https://api-docs.logz.io/docs/logz/create-settings/). Repeat for each sub account, as necessary.

If you prefer to perform the process manually, see the [archiving guide](https://docs.logz.io/user-guide/archive-and-restore/configure-archiving.html).

Expand All @@ -84,8 +84,8 @@ Note that only one archive can be active per account.

Retrieve all drop filters and re-create them in your new account. You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve the drop filters for all of your Log Management accounts](https://docs.logz.io/api/#operation/getAllForAccount). Repeat for each sub account.
2. In your post-migration account, [create a new drop filter](https://docs.logz.io/api/#operation/create). Repeat for each filter and sub account, as necessary.
1. In your pre-migration account, [retrieve the drop filters for all of your Log Management accounts](https://api-docs.logz.io/docs/logz/get-all-for-account/). Repeat for each sub account.
2. In your post-migration account, [create a new drop filter](https://api-docs.logz.io/docs/logz/create/). Repeat for each filter and sub account, as necessary.


If you prefer to perform the process manually, see the [drop filters guide](https://docs.logz.io/user-guide/accounts/drop-filters/).
Expand All @@ -110,8 +110,8 @@ Optimizers are currently not supported by the Logz.io API.

Retrieve all notification endpoints and re-create them in your new account. You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve all notification endpoints for your main Log Management account](https://docs.logz.io/api/#operation/getAllEndpoints). Repeat for each sub account.
2. In your post-migration account, [create a new endpoint](https://docs.logz.io/api/#tag/Manage-notification-endpoints). Repeat for each endpoint and account, as necessary.
1. In your pre-migration account, [retrieve all notification endpoints for your main Log Management account](https://api-docs.logz.io/docs/logz/get-all-endpoints/). Repeat for each sub account.
2. In your post-migration account, [create a new endpoint](https://api-docs.logz.io/docs/logz/manage-notification-endpoints). Repeat for each endpoint and account, as necessary.


If you prefer to perform the process manually, see the [notification endpoints guide](https://docs.logz.io/user-guide/integrations/endpoints.html).
Expand All @@ -122,11 +122,11 @@ If you prefer to perform the process manually, see the [notification endpoints g
Retrieve all logging alerts you want to keep and re-create them in your new account.
You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve all log alerts](https://docs.logz.io/api/#operation/getAllAlerts). Repeat for each sub account.
1. In your pre-migration account, [retrieve all log alerts](https://api-docs.logz.io/docs/logz/get-all-alerts/). Repeat for each sub account.
2. Update and prepare the alerts with your new, post-migration account information:
1. Update the account IDs, under the parameter `accountIdsToQueryOn`. If your alerts are set to run on all accounts, this will not be necessary. (That is, if the parameter `QueryOnAllAccounts` is set to true.)
2. Update the notification endpoints, if relevant, under the parameter `notificationEndpointIds`.
3. In your post-migration account, [create a new alert](https://docs.logz.io/api/#operation/createAlert) with the matching settings. Repeat for each alert and account.
3. In your post-migration account, [create a new alert](https://api-docs.logz.io/docs/logz/create-alert/) with the matching settings. Repeat for each alert and account.

If you prefer to perform the process manually, see the [alert guide](https://docs.logz.io/user-guide/alerts/configure-an-alert.html).

Expand All @@ -144,10 +144,10 @@ Scheduled reports are currently not supported by the Logz.io API.
Retrieve all existing users and re-create them in your new account.
You can do so using the Logz.io API endpoints as follows:

1. In your pre-migration account, [retrieve users for all associated accounts](https://docs.logz.io/api/#operation/listAllAccountUsers).
1. In your pre-migration account, [retrieve users for all associated accounts](https://api-docs.logz.io/docs/logz/list-all-account-users/).
* This endpoint returns a list of users in the main account and all associated sub accounts as an array of JSON objects per account.
* If a user appears in multiple accounts, it will be listed separately under each account.
2. In your post-migration account, [create a new user/admin user](https://docs.logz.io/api/#operation/createUser). Repeat for each user and account.
2. In your post-migration account, [create a new user/admin user](https://api-docs.logz.io/docs/logz/create-user/). Repeat for each user and account.

If you prefer to perform the process manually, see the [user management guide](https://docs.logz.io/user-guide/users/).

Expand Down
11 changes: 6 additions & 5 deletions docs/user-guide/cloud-siem/about-siem/highlights.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
---
sidebar_position: 2
title: Cloud SIEM Highlights
image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg
description: Detect threats and investigate security incidents with Logz.io's Cloud SIEM
keywords: [siem, logz.io siem. security solution, Managed Security Service Provider, Security information and event management]
---


# Cloud SIEM Highlights


Logz.io Cloud SIEM will help you detect threats and investigate security incidents as soon as you start sending logs.
Here's how your Cloud SIEM will help you reduce mean-time-to-response and improve team productivity.

Expand Down Expand Up @@ -40,14 +41,14 @@ Threats are tagged by their level of severity as indicated by the confidence of

### Manage security events

Monitor the triggered security events, assign event handlers, and track the resolution process in [Cloud SIEM Event Management](/user-guide/cloud-siem/siem-event-management.html).
Monitor the triggered security events, assign event handlers, and track the resolution process in [Cloud SIEM Event Management](/docs/user-guide/cloud-siem/investigate-events/siem-event-management/).


### Create a shared Repository for security content

Build a dedicated security library of the most useful dashboards, visualizations, saved searches, and private security feeds to share with all your Cloud SIEM accounts.

Learn more about creating your own SIEM Repository account in [Manage the shared SIEM Repository](/user-guide/accounts/shared_repository.html).
Learn more about creating your own SIEM Repository account in [Manage the shared SIEM Repository](/docs/user-guide/admin/logzio-accounts/shared_repository/).

### Dedicated support from security experts

Expand Down
11 changes: 6 additions & 5 deletions docs/user-guide/cloud-siem/about-siem/why-siem.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
---
sidebar_position: 1
title: Why Cloud SIEM
image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg
description: Meet Logz.io Cloud SIEM Solution
keywords: [SIEM, cloud security, Security information and event management, Security information, event management]
---


# Why Cloud SIEM


Logz.io Cloud SIEM (_Security Information and Event Management_) aggregates security logs and alerts across distributed environments to allow your team to investigate security incidents from a single observability platform.
Logz.io [Cloud SIEM](https://app.logz.io/#/dashboard/security/summary) (_Security Information and Event Management_) aggregates security logs and alerts across distributed environments to allow your team to investigate security incidents from a single observability platform.

Cloud SIEM comes fully configured to save your team the effort of configuring hundreds of alerts and dashboards. Each integration includes a set of pre-configured security rules and dashboards that can form the basis of your security operations. You can further edit and expand on any existing rules, dashboards, and reports as you see fit.

Expand All @@ -15,4 +16,4 @@ Logz.io Cloud SIEM integrates with dozens of security services, including firewa
As soon as you start using Cloud SIEM, your logs will be cross referenced against multiple Threat Intelligence feeds to flag malicious IPs, DNSs, and URLs and identify the method of attack. Cloud SIEM can help your team drastically reduce threat detection time and oversee the security of even the largest environments at scale, regardless of whether they are on-prem, cloud, or hybrid environments.


![Showcase Security SIEM](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem/siem-intro_aug2021.png)
![Showcase Security SIEM](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem/siem-main-dec.png)
20 changes: 9 additions & 11 deletions docs/user-guide/cloud-siem/mssp-accounts.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,16 @@ keywords: [mssp, siem, logz.io siem. security solution, Managed Security Service
---


As an MSSP you can create a dedicated SIEM account for each logging account. This lets your customers access their data without the risk of accidentally seeing other customers’ data.
As a Managed Security Service Provider (MSSP) you can create a dedicated SIEM account for each logging account. This lets your customers access their data without the risk of accidentally seeing other customers’ data.

To do this:
## Configure MSSP account


1. Sign in to Logz.io as an administrator user.
1. Sign in to Logz.io as an **administrator user**.

2. Go to **Settings > Manage accounts**.
2. Go to **[Settings > Manage accounts](https://app.logz.io/#/dashboard/settings/manage-accounts)**.

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-1.png)
<!-- ![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-1.png) -->


3. In the **Plan Summary** section, select **Add sub account**.
Expand All @@ -41,11 +41,11 @@ To do this:

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-4.png)

5. Scroll down to **Cloud SIEM plan**.
5. Scroll down the page to **Cloud SIEM plan** and select **Add security account**.

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-5.png)
<!-- > ![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-5.png)
6. Select **Add security account**.
6. Select **Add security account**. -->

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-6.png)

Expand All @@ -59,9 +59,7 @@ To do this:

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-7.png)

8. Go to **Cloud SIEM**.

9. Click the account selection menu in the top right corner of the **Summary** screen.
8. Go to your **Cloud SIEM** account in Logz.io. Click the account selection menu in the top right corner of the **Summary** screen.

![Manage_accounts](https://dytvr9ot2sszz.cloudfront.net/logz-docs/siem-quick-start/mssp-8.png)

Expand Down
Loading

0 comments on commit 0630c12

Please sign in to comment.