From 9c15999108016ff161a9fad217af43262120cb8e Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 03:26:50 -0700 Subject: [PATCH 1/7] DOCS-482 - Map italicized definitions to glossary entries - Convert italicized term definitions to links (Scheduled Search, Installed Collector, entity, suppressed signal, related signal/insight, detected relationship, node, credit, Logs for Security) - Add 10 new glossary entries: Alert (expanded), Monitor, Keyword Search Expression, Scheduled action, Node, Credit, Related signal, Related insight, Detected relationship, Suppressed signal, Logs for Security - Remove italics from common industry terms (webhook definition sentence dropped), SRE standard terms (SLI, SLO, compliance period, error budget), and terms on their own feature pages - Fix non-breaking space in transactionize-operator.md - Convert argument names to backtick code formatting in deploy-with-terraform.md Co-Authored-By: Claude Sonnet 4.6 --- docs/alerts/monitors/overview.md | 2 +- .../monitors/use-playbooks-with-monitors.md | 4 +-- docs/alerts/scheduled-searches/index.md | 2 +- .../set-up-webhook-connections.md | 2 +- .../about-apis/terraform-with-sumo-logic.md | 6 ++--- docs/contributing/glossary.md | 25 ++++++++++++++++++- .../about-cse-insight-ui.md | 6 ++--- .../insight-generation-process.md | 2 +- .../standard-match-lists.md | 2 +- .../about-signal-suppression.md | 2 +- docs/cse/troubleshoot/troubleshoot-mappers.md | 2 +- .../manage-orgs-for-mssps.md | 2 +- docs/manage/security/access-keys.md | 2 +- .../metric-query-error-messages.md | 2 +- .../deploy-with-terraform.md | 4 +-- .../reliability-management-slo/index.md | 8 +++--- .../about-integration-framework.md | 2 +- .../playbooks/create-playbooks.md | 2 +- docs/reuse/account-credit.md | 2 +- .../keyword-search-expressions.md | 2 +- .../search-operators/sessionize.md | 2 +- .../transactionize-operator.md | 2 +- .../additional-security-features/index.md | 2 +- .../amazon-aws/grant-access-aws-product.md | 4 +-- docs/send-data/installed-collectors/index.md | 2 +- .../mapping-records-resources.md | 4 +-- .../data-source-configurations/overview.md | 2 +- 27 files changed, 61 insertions(+), 38 deletions(-) diff --git a/docs/alerts/monitors/overview.md b/docs/alerts/monitors/overview.md index 26f32bfa7dd..cfc29c2cf85 100644 --- a/docs/alerts/monitors/overview.md +++ b/docs/alerts/monitors/overview.md @@ -96,7 +96,7 @@ When a specific alerting condition is met, as defined on the monitor, an inciden ### Monitor -A _Monitor_ creates an _Alert_. Using the options below, you're subscribing to an _Alert's Monitor_. +A Monitor creates an Alert. Using the options below, you're subscribing to an Alert's Monitor. The monitor is the object that you configure within Sumo Logic that: * Checks for specific events of interest against a data source, based on your specified conditions. Events of interest are used in a general sense to denote an event that may be of interest to you. diff --git a/docs/alerts/monitors/use-playbooks-with-monitors.md b/docs/alerts/monitors/use-playbooks-with-monitors.md index c12a8d0a862..3dc37950f33 100644 --- a/docs/alerts/monitors/use-playbooks-with-monitors.md +++ b/docs/alerts/monitors/use-playbooks-with-monitors.md @@ -7,7 +7,7 @@ description: Learn how to use Automation Service playbooks with monitors. import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe'; -This article describes how to configure automated playbooks in monitors. An *automated playbook* is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. +This article describes how to configure automated playbooks in monitors. An automated playbook is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. To add an automated playbook to a monitor, see [Add an automated playbook to a monitor](#add-an-automated-playbook-to-a-monitor) below. @@ -80,7 +80,7 @@ You can create a monitor that triggers an alert that in turn runs an automated p An anomaly monitor is triggered when unusual conditions are detected. Anomaly monitors leverage a machine learning model to detect anomalies and identify unusual patterns of activity. The output of the machine learning model are baselines for normal behavior, in the form of lower and upper thresholds, so that deviations from baselines signal unusual activity and trigger alerts. :::note -Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (*Weekly seasonality detection* is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) +Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (Weekly seasonality detection is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) ::: :::training Micro Lesson diff --git a/docs/alerts/scheduled-searches/index.md b/docs/alerts/scheduled-searches/index.md index 7da367f25b1..1acea6fe789 100644 --- a/docs/alerts/scheduled-searches/index.md +++ b/docs/alerts/scheduled-searches/index.md @@ -6,7 +6,7 @@ description: Schedule log searches in Sumo Logic to run continuously and send al import useBaseUrl from '@docusaurus/useBaseUrl'; -A _Scheduled Search_ is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack. +A [Scheduled Search](/docs/alerts/scheduled-searches/schedule-search) is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack.
diff --git a/docs/alerts/webhook-connections/set-up-webhook-connections.md b/docs/alerts/webhook-connections/set-up-webhook-connections.md index 82c536eb55b..2777fd69b76 100644 --- a/docs/alerts/webhook-connections/set-up-webhook-connections.md +++ b/docs/alerts/webhook-connections/set-up-webhook-connections.md @@ -11,7 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; To create a webhook connection, you need the View Connections and Manage Connections [role capabilities](/docs/manage/users-roles/roles/role-capabilities). Contact your org administrator for assistance. ::: -A _webhook_ is an HTTP callback, which is an HTTP POST that occurs when something happens. Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. +Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. For example, once you set up a webhook connection in Sumo Logic and create a scheduled search, you can send an alert from that scheduled search as a post to a Slack channel, or integrate with third-party systems. In addition to an alert, you can include a link directly to a search and even a few search results (depending on the third party tool you're connecting to). There is no limit to the number of webhooks you can send from Sumo Logic, but your third party might impose restrictions. In addition, the payload of a webhook may be restricted by Sumo Logic or the third party. diff --git a/docs/api/about-apis/terraform-with-sumo-logic.md b/docs/api/about-apis/terraform-with-sumo-logic.md index 67e9d68c08d..1656c852e91 100644 --- a/docs/api/about-apis/terraform-with-sumo-logic.md +++ b/docs/api/about-apis/terraform-with-sumo-logic.md @@ -210,7 +210,7 @@ Let's look at some examples: ### Terraform providers -A *provider* is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A provider is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). Sumo Logic has an established Terraform provider plugin, as does AWS and other major cloud vendors. The Terraform script section defining the provider for resources defined by other parts of the script might look like this: @@ -238,7 +238,7 @@ terraform { ### Terraform resources -A *resource* is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A resource is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). A resource definition will look similar in form to the provider definition: @@ -352,7 +352,7 @@ data "httpclient_request" "enable_searchaudit_policy" { ### Terraform state files -After running Terraform, there is another file type you should be aware of. A *state file* is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. +After running Terraform, there is another file type you should be aware of. A state file is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. The state file is used by Terraform to track the current infrastructure state in order to properly process updates or deletes. The state file should be kept safe and secure (since it may contain sensitive data such as access keys and secrets) and is not meant to be edited directly, even though it is a simple human-readable JSON text file. An example state file might look like the screenshot below: diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index b5bd1e0a512..96812c97bed 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -29,7 +29,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Aggregate](/docs/search/search-query-language/group-aggregate-operators)**. A group of data returned by a search, displayed in a simple table in the Aggregates tab of the Search page. -**[Alert](/docs/alerts)**. A notification you can configure for a scheduled search. There are multiple alert types, such as Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. +**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when trigger conditions — critical, warning, or missing data — are satisfied, and it includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. **[Allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses)**. A list of IP addresses or CIDR ranges that are explicitly granted access to logins, APIs, and dashboards. Configured on the **Service Allowlist Settings** tab in Account Security Settings. @@ -55,6 +55,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Cardinality](/docs/metrics/logs-to-metrics/#manage-metric-cardinality)**. Refers to the uniqueness of values in a database column or metric dimension. High cardinality metrics are metrics with dimensions that have many different values, which can result in a high volume of unique time series. In Sumo Logic, you can use a transformation rule to aggregate high cardinality data from ephemeral sources into higher-level metrics that you want to analyze over time. +**[Credit](/docs/manage/manage-subscription/sumo-logic-credits-accounts)**. A unit of measure that tracks account usage, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. + **[Clobber](/docs/send-data/installed-collectors/collector-installation-reference/force-collectors-name-clobber/)**. During the installation process, use the clobber flag in situations where you're creating a new collector that will use a name that is already in use by another collector. Clobber deletes (clobbers) the existing collector with the same name. [**Cloud SIEM**](/docs/cse). A cloud-native security information and event management solution that automatically normalizes, correlates, and analyzes your security data. Cloud SIEM surfaces insights that help security analysts detect and investigate threats faster. @@ -88,6 +90,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Deployment](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created. +**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record — for example, an IP and hostname in the same log message — even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. + @@ -164,6 +168,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## K +**[Keyword Search Expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions)**. The portion of a log search query that precedes the first pipe symbol. Defines the scope of data for the query using Boolean logic, wildcards, and metadata fields such as `_sourceCategory` and `_collector`. + **[Kubernetes Views](/docs/observability/kubernetes/monitoring)**. Allows you to intuitively filter on four hierarchical components of your Kubernetes system to focus your search on nodes, deployments, services, or namespaces. Kubernetes Views make it easier to traverse your Kubernetes hierarchy to monitor specific components, identify problems, discover root problems, and take progressive action. @@ -175,6 +181,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Local configuration file management](/docs/send-data/use-json-configure-sources/local-configuration-file-management)**. Local configuration file management allows you to set up and manage sources on an installed collector using one or more JSON files. +**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. + **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. @@ -214,9 +222,16 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. It uses a suite of specialized agents to help you search, analyze, and learn about your data using natural language. +**[Monitor](/docs/alerts/monitors/overview)**. An object you configure in Sumo Logic that tracks your metrics and logs data in real time and sends notifications when noteworthy changes happen in your production applications. A monitor checks for specific events of interest against a data source based on your conditions, then notifies you according to your preferences. + **[Multiline](/docs/send-data/reference-information/collect-multiline-logs)**. Log messages that span multiple lines are called multiline messages. +## N + +**[Node](/docs/platform-services/automation-service/playbooks/create-playbooks)**. In Automation Service playbooks, a step that performs a specific action within a playbook. Nodes run in the order they are placed; when all nodes complete without error, the playbook is considered to have executed successfully. + + ## O **[OpenTelemetry Collector, Sumo Logic](/docs/send-data/opentelemetry-collector/)**. An open-source, vendor-agnostic agent for collecting, processing, and exporting telemetry data such as logs, metrics, and traces. Sumo Logic supports the OpenTelemetry Collector as a unified alternative to installed collectors for sending observability data to Sumo Logic. @@ -262,6 +277,10 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. +**[Related insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, an insight that a related signal is attached to. + +**[Related signal](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a signal that isn't part of the current insight (not attached), but fired on the same entity as the current insight's attached signals within 7 days of those signals. + **[Relative expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m. **[Role](/docs/manage/users-roles/roles/)**. In Sumo Logic role-based access control (RBAC), you grant users access to data and to Sumo Logic functions using roles. You assign role capabilities and a role search filter to a role, and assign one or more roles to a user. @@ -278,6 +297,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[SAML](/docs/manage/security/saml)**. Sumo Logic supports self-provisioning of Security Assertion Markup Language (SAML) to enable Single Sign-On (SSO). In addition to basic SAML configuration, you can choose optional on-demand user creation (via SAML 2.0 assertions), and designate custom log in and/or log out portals. +**[Scheduled action](/docs/platform-services/automation-service/integration-framework/about-integration-framework)**. In the Automation Service integration framework, an action type whose execution repeats until a specific exit condition is met, enabling loops within a playbook. + **[Scheduled search](/docs/alerts/scheduled-searches/schedule-search)**. When you save a log search, you can schedule it to run it on a periodic basis, and configure an alert that will issue a notification every time the search runs, or when a condition you specify is met. **[Scheduled view](/docs/manage/scheduled-views)**. A scheduled view is a pre-aggregated index of a subset of data. After building a scheduled view, you'll be able to run queries against that data set. Because the data is pre-aggregated, meaning that query you'll use to create a scheduled view contains an aggregate function, search results return much quicker. Additionally, queries run against a scheduled view cannot time out. Queries that run against views can be used in scheduled searches, dashboards, and in ad hoc searches. @@ -292,6 +313,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. +**[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. + **[Subqueries](/docs/search/subqueries)**. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query. **[Support account](/docs/manage/security/enable-support-account)**. A support account is a special Sumo Logic user account that you can enable so that Sumo Logic support personnel can access your Sumo Logic org. Typically, you enable your support account for a limited period of time, just long enough to allow Sumo Logic support to diagnose a problem or answer a question. diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md index 4ff2e60a57b..1cd675cba70 100644 --- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md +++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md @@ -176,8 +176,8 @@ At the top of the insight details page, you’ll see a signal timeline that visu * **Anomaly**. Signals that were triggered by User and Entity Behavior Analytics (UEBA) rules. * **Threat intelligence**. Signals that were fired by threat intel rules. 1. **Show Related**. Click this link to show related signals in addition to attached signals. If you click the **Show Related** check box, the page updates and also displays any related signals or related insights. - * A *related signal* is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals.  - * A *related insight* is an insight that a related signal is attached to. + * A related signal is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals. + * A related insight is an insight that a related signal is attached to. 1. **Sort options**. You can sort the signals list by Content Type, Event Time, Created Time, Name, or Severity. Note that you can further sort by ascending or descending value. 1. **Add Signals**. Click this option if you want to add a signal to the insight. You’ll be prompted with a list of signals that have the same entity as the current insight (if there are any), and are not already attached to another insight. A signal that you add to an insight manually is considered an attached signal. @@ -280,7 +280,7 @@ By default, this view shows the same entities that are displayed on the list vie * A **time frame** control, which controls what time frame to use when searching for and viewing relationships outside of the insight. In addition, the following can appear in the graph: -* **Detected entities**. Entities with a *detected* relationship will be connected with solid lines. A *detected relationship* is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). +* **Detected entities**. Entities with a detected relationship will be connected with solid lines. A detected relationship is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). * **Threat indicators**. Any entity with a threat indicator will have an additional icon in the upper right. If the threat indicator is Malicious or Suspicious, the entity will be highlighted in red or yellow accordingly. For more information about threat indicators, see [View threat indicator labels in the Cloud SIEM UI](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#view-threat-indicator-labels-in-the-cloud-siem-ui). * **Hover**. If you hover over an entity, it and all connections to it will be highlighted in blue. If its value is not fully visible by default, the full value will be displayed. diff --git a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md index 5e16395834e..7f47abea845 100644 --- a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md +++ b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md @@ -10,7 +10,7 @@ import Iframe from 'react-iframe';  This page explains Cloud SIEM's insight generation process.  -The concept of an *entity* is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). +The concept of an entity is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). :::training Micro Lesson Watch this micro lesson to learn how insights are created. diff --git a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md index 9ab694334b6..2ea8de72e7a 100644 --- a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md +++ b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md @@ -255,7 +255,7 @@ The following Cloud SIEM rules refer to this match list: **Description:** DNS domain names that are known business-related domains. This is intended to capture domains related to validated, expected, or critical business functions and may be used for allowlisting or filtering related uninteresting results from query result sets. -*Domain* matches against the `domain` field, not the FQDN (i.e. hostname or query), so *example.com* is a valid entry is but *www.example.com* is not. +Domain matches against the `domain` field, not the FQDN (i.e. hostname or query), so `example.com` is a valid entry but `www.example.com` is not. The following Cloud SIEM rules refer to this match list: * Bitsadmin to Uncommon TLD diff --git a/docs/cse/records-signals-entities-insights/about-signal-suppression.md b/docs/cse/records-signals-entities-insights/about-signal-suppression.md index b61fcbcd121..9dd174452bc 100644 --- a/docs/cse/records-signals-entities-insights/about-signal-suppression.md +++ b/docs/cse/records-signals-entities-insights/about-signal-suppression.md @@ -13,7 +13,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This topic describes the various ways that signals can get suppressed. -In Cloud SIEM, a *suppressed signal* is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. +In Cloud SIEM, a suppressed signal is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. Signal suppression can occur for a variety of reasons, including [entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the signal ID of an identical signal that caused subsequent redundant signals to be suppressed, or it may contain the name of the network block with suppression enabled. diff --git a/docs/cse/troubleshoot/troubleshoot-mappers.md b/docs/cse/troubleshoot/troubleshoot-mappers.md index 4fae6407f63..13cd3683bc9 100644 --- a/docs/cse/troubleshoot/troubleshoot-mappers.md +++ b/docs/cse/troubleshoot/troubleshoot-mappers.md @@ -63,7 +63,7 @@ Incomplete records result when a record is created, but key information is not m ### A mapper does not exist for parsed events -Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a _default_ pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. +Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a default pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. This assumes the data source for which the mapping is failing has a parser and mappers in place already. This applies to net-new data sources and parsers. diff --git a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md index 67a5bb1d19d..eebec451410 100644 --- a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md +++ b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md @@ -115,7 +115,7 @@ You can push the following: - If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](#view-history). - Push operations may take longer based on the volume of content being pushed. - Rule tuning expressions must be pushed separately from rules. -- *Cloud SIEM Legacy Rule Type* is not supported for sync or push. +- Cloud SIEM Legacy Rule Type is not supported for sync or push. - For library content, breaching 15,000 cap (Items selected in one job X Child orgs targeted in one job) would fail the sync job. - The maximum runtime for jobs below 1200 requests (Items selected in one job X Child orgs targeted in one job) is less than or equal to 2 mins. Linear increase beyond 1200 request would take more runtime, for example, 15,201 would nearly take 30 mins. - For CSIEM rules and tuning expression (Rule or Tuning Exp × child-orgs): diff --git a/docs/manage/security/access-keys.md b/docs/manage/security/access-keys.md index 0750d2cdd47..68317f5e8ba 100644 --- a/docs/manage/security/access-keys.md +++ b/docs/manage/security/access-keys.md @@ -56,7 +56,7 @@ Watch this micro lesson to learn how to create access keys. ### From the Personal Access Keys tab -A *personal access key* is a key that you can create to manage access for personal use. +A personal access key is a key that you can create to manage access for personal use. :::tip If you are an administrator who needs to create an access key for system use (such as for API scripts, third party integrations, or infrastructure as code), we recommend you create the access key on a [service account](#from-a-service-account). diff --git a/docs/metrics/metrics-queries/metric-query-error-messages.md b/docs/metrics/metrics-queries/metric-query-error-messages.md index ee6d1d6f795..8646e98d362 100644 --- a/docs/metrics/metrics-queries/metric-query-error-messages.md +++ b/docs/metrics/metrics-queries/metric-query-error-messages.md @@ -46,7 +46,7 @@ Sumo Logic imposes limits on the input data for a query and the data output by t #### Input data limit -*Input data* is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. +Input data is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. For a single metrics query row, Sumo Logic limits the number of input time series to 1000 for non-aggregate queries. For aggregate queries (queries that have an aggregate operator like `avg` or `max`) the limit is at least 200,000 for time ranges within last 24 hours and 50,000 otherwise. diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md index cbef317af84..06dc69a971e 100644 --- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md +++ b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md @@ -1633,7 +1633,7 @@ This error can occur when cloudtrail is not enabled for EventBridge to capture ` #### Solution CloudTrail must be enabled for EventBridge to capture `CreateLoadBalancer` events, since these events are recorded and delivered through CloudTrail. -### Argument named *managed_apps* is not expected +### Argument named `managed_apps` is not expected #### Error Message ``` @@ -1645,7 +1645,7 @@ managed_apps = { #### Solution Refer to [this module in GitHub](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-integrations/tree/master/sumologic). -### Argument named *admin_mode* is not expected +### Argument named `admin_mode` is not expected #### Error Message ``` diff --git a/docs/observability/reliability-management-slo/index.md b/docs/observability/reliability-management-slo/index.md index 01105e8e7d9..b1efaa05ded 100644 --- a/docs/observability/reliability-management-slo/index.md +++ b/docs/observability/reliability-management-slo/index.md @@ -42,11 +42,11 @@ To work with SLOs, you need the following Sumo Logic [role capabilities](/docs/m Reliability is essentially the uptime of systems and services. This includes the following concepts: -**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the _SLI_ for a _compliance period_. +**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the SLI for a compliance period. -**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the _SLO_ — the quality promised to end users — is being met. +**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the SLO — the quality promised to end users — is being met. -**Error Budget**. The tolerable amount/level of system unavailability in the _compliance period_. +**Error Budget**. The tolerable amount/level of system unavailability in the compliance period. **Compliance period**. The duration of time used to monitor and score your system/service availability. Breaking down your organization's quantitative success rate over consistent time periods is useful internally and can be communicated to customers that you're meeting your goals. See the following information for the max compliance period: @@ -70,7 +70,7 @@ Reliability is essentially the uptime of systems and services. This includes the As an example, let's say an ecommerce app considers its checkout service transactions to be successful (good) when completed in less than 500ms. A successful five-minute (5m) time window may be one in which the p99 of latency is less than 500ms. -The _SLI_ can be defined as the percentage of successful 5m windows in a _compliance period_ of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an _error budget_ is 0.1% of these 5m windows in 30d. +The SLI can be defined as the percentage of successful 5m windows in a compliance period of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an error budget is 0.1% of these 5m windows in 30d. The following chart shows our calculations and an example 5m window for the month of January where a number of requests were unsuccessful due to completions that were greater than 500ms: diff --git a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md index 9277bc315d2..2526fb78765 100644 --- a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md +++ b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md @@ -326,7 +326,7 @@ All available actions are: #### Scheduled action definitions -A _Scheduled action_ represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. +A Scheduled action represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. YAML example: diff --git a/docs/platform-services/automation-service/playbooks/create-playbooks.md b/docs/platform-services/automation-service/playbooks/create-playbooks.md index 15cd846c74c..c2887842b24 100644 --- a/docs/platform-services/automation-service/playbooks/create-playbooks.md +++ b/docs/platform-services/automation-service/playbooks/create-playbooks.md @@ -46,7 +46,7 @@ See [Add nodes to a playbook](/docs/platform-services/automation-service/playboo ## Add nodes to a playbook -You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A *node* is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. +You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A node is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. See the following sections to learn how to add the following node types: * [**Action**](#add-an-action-node-to-a-playbook). Automatically take specific actions such as enriching data or taking containment steps. diff --git a/docs/reuse/account-credit.md b/docs/reuse/account-credit.md index 0ed36c92235..fa4cbddedf8 100644 --- a/docs/reuse/account-credit.md +++ b/docs/reuse/account-credit.md @@ -1 +1 @@ -A *credit* is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. +A credit is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. diff --git a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md index 0f3786f8f80..34c597f1696 100644 --- a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md +++ b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md @@ -4,7 +4,7 @@ title: Keyword Search Expressions description: The text that comes before the first pipe symbol in a query is called the keyword expression or scope. --- -A _Keyword Search Expression_ defines the scope of data for the query. +A Keyword Search Expression defines the scope of data for the query. Boolean logic and wildcards enable you to search for multiple terms, express logic about term distribution within messages, and specify partial terms with wildcards. The keyword expression can include [built-in metadata fields](../search-basics/built-in-metadata.md) such as `_collector`, `_sourceCategory`, `_sourceName`, and `_sourceHost` as well as custom log metadata fields. diff --git a/docs/search/search-query-language/search-operators/sessionize.md b/docs/search/search-query-language/search-operators/sessionize.md index c09d23d82d9..a96c12186b4 100644 --- a/docs/search/search-query-language/search-operators/sessionize.md +++ b/docs/search/search-query-language/search-operators/sessionize.md @@ -25,7 +25,7 @@ Queries using `sessionize` cannot be added to a Dashboard. `sessionize ("") as (), ("") as ()` -Where *anchor pattern* is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). +Where anchor pattern is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). ## Rules diff --git a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md index 4ca6957e287..ce3819f0ce3 100644 --- a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md +++ b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md @@ -5,7 +5,7 @@ title: Transactionize Operator import useBaseUrl from '@docusaurus/useBaseUrl'; -The _Transactionize_ operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. +The Transactionize operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. Unlike other "group by" operators, where the logs in a group must match on all defined fields, `transactionize` just needs one field to match in order to assign logs to the same group. diff --git a/docs/security/additional-security-features/index.md b/docs/security/additional-security-features/index.md index d32b600932e..65e4ced008a 100644 --- a/docs/security/additional-security-features/index.md +++ b/docs/security/additional-security-features/index.md @@ -5,7 +5,7 @@ title: Logs for Security import useBaseUrl from '@docusaurus/useBaseUrl'; -*Logs for Security* is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. +Logs for Security is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. :::training Sumo Logic Academy diff --git a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md index 4e12b932271..2ce93ab1b20 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md +++ b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md @@ -88,8 +88,8 @@ Before generating the template, the source’s configuration must have the AWS-s 1. **Account ID**. Enter the following Sumo Logic ID: `926226587429`. 1. In the **Options** section, checkmark the **Require external ID for better security**.  1. **External ID**. The External ID is formed from your Sumo Logic region identifier and your Sumo Logic account identifier in this format: *SumoDeployment:SumoAccountId*, where: - * *SumoDeployment* is your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. - * *SumoAccountId* is the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. + * *SumoDeployment* is a placeholder for your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. + * *SumoAccountId* is a placeholder for the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. 1. **Require MFA**. Don’t select this option; it is not supported. 1. Click **Next: Permissions**.
AWS IAM 'Create role' interface specifying trusted entities and accounts, highlighting fields for Account ID and External ID 1. Click **Create policy**. The **Create policy** page opens in a separate window. diff --git a/docs/send-data/installed-collectors/index.md b/docs/send-data/installed-collectors/index.md index d9f4959f4c0..7d485f6353c 100644 --- a/docs/send-data/installed-collectors/index.md +++ b/docs/send-data/installed-collectors/index.md @@ -8,7 +8,7 @@ keywords: import useBaseUrl from '@docusaurus/useBaseUrl'; -Our *Installed Collector* is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. +Our Installed Collector is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. In this section, we'll introduce the following concepts: diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md index 5f82a24ee1f..981f62af300 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md @@ -14,7 +14,7 @@ OpenTelemetry has a [rich data model](https://github.com/open-telemetry/opentele * **Instrumentation Scope**. Additional information about the scope of data. For example, instrumentation library name. * **Record**. Refers to a specific entry of data, such as a Log, Span, or Metric. :::note -For logs, this is usually called a _Record_; for traces, it's usually called a _Span_; and for metrics, a _Datapoint_ (or _sample_, if Prometheus is used). In this documentation, we'll use _Record_ for all of these. +For logs, this is usually called a Record; for traces, it's usually called a Span; and for metrics, a Datapoint (or sample, if Prometheus is used). In this documentation, we'll use Record for all of these. ::: Each Record has its own set of attributes, which may include key/value pairs that are specific to the context of the Record. Logs, in particular, can also include attributes in the body of the Record. Some Record types may follow certain conventions for signal types, such as [trace](https://github.com/open-telemetry/semantic-conventions), [metrics](https://github.com/open-telemetry/semantic-conventions), or [logs](https://github.com/open-telemetry/semantic-conventions). @@ -27,7 +27,7 @@ Looking from the OpenTelemetry standpoint, [Fields](/docs/manage/fields) are a g All **Resource-level** attributes are stored as fields, and any attributes that do not match a defined field will be skipped. You can check the list of ignored fields using the [dropped fields view](/docs/manage/fields/#view-dropped-fields). When a log contains attributes at the **Record-level**, they are stored as JSON, and if there is a body, it will be stored under the `log` key. :::info -If your log record has any **Record-level** attributes, Sumo will interpret this as a _structured log_, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as _unstructured_ and display the body. **Resource-level** attributes are interpreted as fields. +If your log record has any **Record-level** attributes, Sumo will interpret this as a structured log, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as unstructured and display the body. **Resource-level** attributes are interpreted as fields. ::: ## Example: Log with both Resource-level and Record-level attributes diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md index 54c905e7b55..d910194ae89 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md @@ -13,7 +13,7 @@ After you complete source configuration on the Sumo Logic OpenTelemetry (OTel) C ## Data Sources -_Data sources_ (or _Source_ in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. +Data sources (or Source in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. Sources are components that generate data that is then collected by receivers. A source can be thought of as the originating point for data that is being ingested into the Sumo Logic OTel collector. Sources are responsible for collecting and formatting data, and then passing it along to the appropriate receiver. From 259849588e18113b7c8ca2abd4dfffdbb89f56aa Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 05:38:49 -0700 Subject: [PATCH 2/7] DOCS-482 - Update glossary, word list, and style guide contributing docs Co-Authored-By: Claude Sonnet 4.6 --- docs/contributing/glossary.md | 50 ++++++++++++++++++++++++++++++-- docs/contributing/style-guide.md | 6 ++++ docs/contributing/word-list.md | 32 ++++++++++++-------- 3 files changed, 73 insertions(+), 15 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index 96812c97bed..e09ef751932 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -35,8 +35,14 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Amazon S3 Audit source](/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source)**. The Amazon S3 Audit source, also called Server Access Logging, tracks and collects your Amazon S3 bucket's activity logs. +**[Analyst](/docs/get-started/onboarding-checklists#onboarding-checklist-for-analysts)**. A Sumo Logic user role for non-administrators who primarily search logs, build dashboards, investigate data, and monitor their environment. Analyst capabilities are determined by the roles and permissions assigned to them. + +**[Audit Index](/docs/manage/security/audit-indexes/audit-index)**. A Sumo Logic index that stores event logs about internal account activities such as account management, throttling, and scheduled searches. Administrators must enable the Audit Index before it can be queried using `_index=sumologic_audit`. + **[Apps](/docs/integrations)**. Sumo Logic apps (short for applications) deliver out-of-the-box dashboards, reports, saved searches, and field extraction for popular data sources, such as AWS, Windows, Apache, and many more. When a customer installs an app in Sumo Logic, preconfigured searches and dashboards are customized with the customer's source configurations and populated in a folder. Customers then can monitor their system's behavior visually using the dashboards. +**[Automation Bridge](/docs/platform-services/automation-service/automation-service-bridge)**. A component of the Automation Service that you install in your on-premises environment to run custom actions and integrations outside the Sumo Logic cloud. + **[Automation Service](/docs/cse/automation/about-automation-service-and-cloud-siem)**. In Cloud SIEM, a service that automatically runs tasks such as sending notifications or adding data to records when security incidents occur. @@ -63,6 +69,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo [**Cloud SOAR**](/docs/cloud-soar). A security orchestration, automation, and response platform that helps security teams streamline incident response. Cloud SOAR automates repetitive tasks, orchestrates workflows across security tools, and tracks the full incident lifecycle. +**[Cloud-to-Cloud Integration Framework](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework)**. A fully-managed collection system that collects logs and events directly from SaaS and cloud platforms such as Salesforce, Microsoft 365, and Okta. The framework handles authentication, scheduling, and state tracking automatically. Also referred to as C2C. + @@ -84,6 +92,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Data Forwarding](/docs/manage/data-forwarding)**. When enabled, the Data Forwarding feature allows Sumo Logic to upload data to an Amazon S3 bucket that belongs to your organization. Log messages are saved as CSV files in compressed gzip files. They are accumulated and returned right after being ingested by Sumo Logic. +**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers — Continuous, Frequent, or Infrequent — based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. + **[Data type](/docs/get-started/faq)**. A data type is a specific type of log used with a Sumo Logic source or app, such as Apache, MySQL, or Windows IIS. You can also use a custom data type for a custom application. **[Data volume index](/docs/manage/ingestion-volume/data-volume-index)**. The data volume index automatically provides data that allows you to understand your account’s data ingest volume in bytes and number of log messages processed overall. The data volume index gives you better visibility into how much data you are sending to Sumo Logic, allowing you to proactively manage your systems’ behavior and to fine tune your data ingest with respect to the data plan for your Sumo Logic subscription. @@ -100,6 +110,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[DPM](/docs/metrics/manage-metric-volume/data-limits-for-metrics)**. Stands for data points per minute. Metric data volume is measured in DPM. For example, a CPU metric reported on a single host every 15 seconds produces 4 DPM. +**[Dynamic Parsing](/docs/search/get-started-with-search/build-search/dynamic-parsing)**. A Sumo Logic feature that automatically extracts fields from JSON log messages at search time, without requiring manual parse rules. Also called Auto Parse — "Dynamic Parsing" is used in documentation and the API, while "Auto Parse" appears in the UI. + @@ -122,12 +134,18 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Fields](/docs/manage/fields)**. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields. +**[`fields` operator](/docs/search/search-query-language/search-operators/fields)**. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest. + **[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. **[Fingerprint](/docs/send-data/installed-collectors/configuration/#fingerprint)**. A fingerprint consists of the first 2048 bytes of a file and is used by installed collectors to track what data has been collected. +**[Flex Account](/docs/manage/manage-subscription/sumo-logic-flex-accounts)**. Sumo Logic's credit-based account packaging, available as Free, Trial, Essentials, or Enterprise Suite Flex. All Flex account types use [credits](/docs/manage/manage-subscription/sumo-logic-credits-accounts) as the unit of measure for data ingested, stored, and scanned. + **[Flow graph](/docs/integrations/amazon-aws/guardduty-benchmark)**. A graph or map that dynamically displays a directional flow from a source to a target. Such as the flow of cyber threats from the geographic locations of sources to their targets, dynamically illustrated in the Threat Sources and Targets by Geography panel of the [Amazon GuardDuty Global Baseline](/docs/integrations/amazon-aws/guardduty-benchmark) dashboard. +**[`formatDate` operator](/docs/search/search-query-language/search-operators/formatdate)**. A search operator that converts a timestamp in milliseconds to a human-readable date string in the format you specify, such as `yyyy-MM-dd` or `MM/dd/yyyy HH:mm:ss`. + ## G @@ -142,6 +160,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## H +**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. + **[Hash rules](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. **[Host Metrics](/docs/integrations/hosts-operating-systems/host-metrics)**. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP. @@ -183,12 +203,16 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. +**[Log Analysis Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Log Analysis Agent interprets intent, guides investigations, and surfaces relevant data from your logs through natural language. Formerly called the Query Agent. + **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. **[Logs-to-Metrics](/docs/metrics/logs-to-metrics)**. A Sumo Logic feature you can use to extract or create metrics from log data. You can extract metrics that are embedded in logs, or count logs as a metric. +**[Lookup Table](/docs/search/lookup-tables)**. A table of reference data hosted in Sumo Logic that you can join to log search results to enrich them with additional context — for example, mapping a user ID in a log to an email address, department, or other attribute stored in the table. + @@ -200,6 +224,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Mask rule](/docs/send-data/collection/processing-rules/mask-rules)**. Mask rules are a type of processing rule that replaces an expression with a mask string that you can customize—another option to protect data, such as passwords, that you wouldn't normally track. +**[MCP Server, Sumo Logic](/docs/api/mcp-server)**. A Sumo Logic service that lets MCP-compatible AI clients — such as Claude Code, developer IDEs, and enterprise AI platforms — connect to Sumo Logic using natural language to query logs, investigate Cloud SIEM insights, manage alerts, and more. + **[Messages tab](/docs/search/get-started-with-search/search-page/set-messages-tab-preferences)**. When you run a search query, messages display in the Messages tab in the lower half of the browser window of the Search page. **[Metadata](/docs/send-data/data-enrichment)**. Data about other data. If the logs and metrics you ingest have associated metadata, you can leverage it for more targeted log searches and metric queries. Metadata for metrics includes both intrinsic tags and meta tags. @@ -220,7 +246,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Microservices](/docs/integrations/app-development)**. The microservices architecture enables you to structure applications as collections of loosely coupled services that are fine-grained, with protocols that are lightweight. Building applications using different smaller services improves modularity and provides for the continuous delivery and deployment of large, complex applications. --> -**[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. It uses a suite of specialized agents to help you search, analyze, and learn about your data using natural language. +**[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. Ask questions in natural language to search logs, investigate security insights, get platform guidance, and more. Mobot automatically routes questions to specialized agents based on your intent. **[Monitor](/docs/alerts/monitors/overview)**. An object you configure in Sumo Logic that tracks your metrics and logs data in real time and sends notifications when noteworthy changes happen in your production applications. A monitor checks for specific events of interest against a data source based on your conditions, then notifies you according to your preferences. @@ -249,12 +275,24 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[`parse` operator](/docs/search/search-query-language/parse-operators/parse-predictable-patterns-using-an-anchor)**. A search operator that extracts fields from strings. `parse` (also called `parse anchor`) uses literal start and stop anchors; `parse regex` (also called `extract`) uses a regular expression. +**[`parse json` operator](/docs/search/search-query-language/parse-operators/parse-json-formatted-logs)**. A search operator that extracts values from JSON-formatted log messages using JSONPath expressions. Supports single fields, multiple fields, nested keys, and array elements. + +**[`parse keyvalue` operator](/docs/search/search-query-language/parse-operators/parse-keyvalue-formatted-logs)**. A search operator that extracts values from key-value pair formatted log messages by specifying the key you want to retrieve. Also written as `keyvalue`. + +**[`parse nodrop` option](/docs/search/search-query-language/parse-operators/parse-nodrop-option)**. A parse option that forces results to include messages that do not match the parse expression. Without `nodrop`, non-matching messages are dropped from results. + +**[`parse regex` operator](/docs/search/search-query-language/parse-operators/parse-variable-patterns-using-regex)**. A search operator that uses regular expressions with named capturing groups to extract complex or nested fields from log messages. Also written as `extract`. + **[Parser](/docs/cse/schema/parser-editor)**. In Cloud SIEM, a script that parses logs and normalizes them into structured records. **[Partition](/docs/manage/partitions)**. Sumo Logic allows you to filter a subset of the messages in an index into a partition. Partitioning messages in an index improves search query performance, as the total number of messages that need to be searched is reduced. Once messages are routed to a partition, you can limit your search to those messages using the partition name in a search query. **[Pinned searches](/docs/get-started/library)**. The pinned search feature allows you to start a search, then “pin” it, so it will continue running in the background independent of the browser session. Then, you can close the Search tab or log out and find your results later in the Library on the Recent tab in a folder named Pinned Searches. +**[Platform Optimization Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Platform Optimization Agent answers how-to questions about Sumo Logic, helps troubleshoot issues, and helps users get more from the platform, drawing on official Sumo Logic documentation. Formerly called the Knowledge Agent. + +**[Playbook](/docs/platform-services/automation-service/playbooks)**. In the Automation Service, a predefined set of actions and conditional statements that run as an automated workflow in response to a security event or incident. Playbooks can run automatically without user intervention or in interactive mode, where a user must authorize specific actions. + **[Processing rules](/docs/send-data/collection/processing-rules)**. A Sumo Logic feature you can use to filter or forward log data ingested by Sumo Logic from a Sumo Logic source. You can use processing rules to include or exclude messages, and to mask or hash sensitive information in logs. You can also forward matching messages to external destinations, including AWS S3. **[Prometheus](/docs/send-data/collect-from-other-data-sources/collect-prometheus-metrics/)**. A metric format in which a time series is uniquely identified by its metric name and a set of labels in key-value pairs format. Sumo Logic’s [HTTP source](/docs/send-data/hosted-collectors/http-source) and [Streaming Metric source](/docs/send-data/installed-collectors/sources/streaming-metrics-source) support Prometheus metrics. Sumo Logic’s [Kubernetes solution](/docs/observability/kubernetes) also collects Prometheus metrics. @@ -262,7 +300,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## Q -**[Quantization](/docs/metrics/introduction/metric-quantization)**. The process by which Sumo Logic aggregates raw metric data points over a particular time bucket. Similar to “timeslice” in logs, Sumo Logic will automatically bucket your datapoints into quantization intervals based on the timerange of your search. For example, 5 second quantization intervals for a 15-minute search and 15 seconds for a 60-minute search. +**[Quantization](/docs/metrics/introduction/metric-quantization)**. The process by which Sumo Logic aggregates raw metric data points over a particular time bucket. Similar to “timeslice” in logs, Sumo Logic will automatically bucket your datapoints into quantization intervals based on the time range of your search. For example, 5 second quantization intervals for a 15-minute search and 15 seconds for a 60-minute search. **[`quantize` operator](/docs/metrics/metrics-operators/quantize/)**. A metrics operator that sets the size of the time buckets Sumo Logic aggregates metrics into, and the aggregation method for each bucket. It is the metrics-query counterpart of the `timeslice` search operator. @@ -275,6 +313,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[RBAC](/docs/manage/users-roles/roles/role-based-access-control/)**. Sumo Logic supports Role-Based Access Control (RBAC) to allow administrators to customize system access. With RBAC, administrators create roles for groups of users who perform various job functions. Users are not assigned permissions directly, but inherit permissions through roles (or even through a single role). Role assignments can grant users permissions to access some data sets, or can restrict users from accessing types of data. +**[Real User Monitoring (RUM)](/docs/apm/real-user-monitoring)**. A Sumo Logic APM capability that captures end-to-end user transactions directly in the browser using OpenTelemetry instrumentation. RUM records performance timings, rendering events, errors, and user cohort data so you can understand the quality of your web application experience. + **[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. **[Related insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, an insight that a related signal is attached to. @@ -289,7 +329,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Rollup tables](/docs/metrics/manage-metric-volume/metric-ingestion-and-storage)**. Metric data is stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data is retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months. -**[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, set of logic that creates signals based on information in incoming records. +**[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, a set of logic that fires on incoming records and creates signals when its conditions are met. Cloud SIEM includes six rule types: **Match** (fires on a single record match), **Threshold** (fires when a record matches a minimum number of times in a time window), **Chain** (fires on combinations of event types over a time window), **Aggregation** (fires when aggregation conditions are met), **First Seen** (fires when an entity exhibits a behavior for the first time), and **Outlier** (fires when entity behavior deviates from its established baseline). @@ -311,6 +351,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Signal](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, an indicator of an event of interest that fires when rule conditions are met. +**[SOC Analyst Agent](/docs/cse/get-started-with-cloud-siem/soc-analyst-agent)**. An AI-powered Cloud SIEM feature that automatically investigates security insights, delivers evidence-backed verdicts (malicious, suspicious, or benign), and surfaces key findings from triggered signals to help security analysts triage faster and reduce false-positive noise. + **[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. **[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. @@ -326,6 +368,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Throttling](/docs/manage/ingestion-volume/log-ingestion)**. Slows the rate of ingestion across all collectors in an account to not exceed the allowable rate. +**[Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence)**. A Sumo Logic feature that lets you ingest and query threat indicators — data points about known threats such as malicious IP addresses, file hashes, and hostnames — to enrich log searches and Cloud SIEM detections. Indicators come from Sumo Logic-managed sources or custom sources you configure. + **[Time Compare](/docs/search/time-compare)**. Time Compare uses the compare operator to compare current aggregated search results with aggregated data from a past time period. **[Time series](/docs/dashboards/panels#time-series-panel)**. A set of timestamped values of a specific measurement. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index a1685750563..c41b7c89d96 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -973,6 +973,12 @@ Use exclamation points to express excitement or encourage the user. Don't use th Use ellipses for truncation. Don’t use ellipses for placeholders or trailing off a sentence unless it is getting cut off. When truncating, think about which part of the string is most essential for the user. This may require truncating in the beginning, middle, or end of a string. +### Dashes + +**Em dash (—)**. Use sparingly. Insert the em dash symbol (—) directly — do not use a double hyphen (--) as a substitute. + +**En dash (–)**. Use for date and time ranges: "June 1–15", "9:00–5:00 pm". Insert the en dash symbol (–) directly. + ### Periods In the UI, avoid periods for single sentences on their own. Whenever there are two or more sentences, use periods at the end of each sentence. Separate sentences by one space, not two. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 1a930c6ed43..6b7930d0d06 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -13,6 +13,8 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Aggregates tab**. When referring to the Aggregates tab (where aggregate search results are displayed) the term Aggregates is capitalized. +**Aka**. Don't use. Write out "also known as" instead. + **Ampersand (&)**. Don't use for "and". Spell out. **Anomaly Detection**. Always capitalize. @@ -23,19 +25,23 @@ This word list gives the preferred spelling, capitalization, and punctuation for +## B + +**Backend**. One word. Don't use "back-end" (hyphenated) or "back end" (two words). + ## C -**Check box**. Check box is two words. Don't use checkbox. +**Checkbox**. One word. Don't use "check box" (two words). **Classic UI**. Use this term to clarify that you're talking about the legacy UI. **Click**. You click a UI element. Do not use "click on". -**Collector**. Lowercase. `collector`, `hosted collector`, and `installed collector` are descriptive terms, not product names, so they follow the same rule as "collecting events" or "data collection". Capitalize only in a literal UI label, such as the **Add Collector** button. +**Collector**. Lowercase. `collector`, `hosted collector`, and `installed collector` are descriptive terms, not product names, so they follow the same rule as "collecting events" or "data collection". Capitalize only in a literal UI label, such as the **Add Collector** button. Exception: **OpenTelemetry Collector** is a proper product name — always capitalize it. **Color palette**. Use the [official Sumo Logic color palette](https://sites.google.com/sumologic.com/sumo-logic-brand/color) when creating diagrams. -**Column**. When referring to a column in a dashboard, the term is not capitalized unless it's the only word in a line of UI (for example, in the Add to Dashboard dialog box "Column" is capitalized). The word "column" doesn't appear in the main dashboard UI. +**Column**. When referring to a column in a dashboard, the term is not capitalized unless it's the only word in a line of UI (for example, in the Add to Dashboard dialog box, "Column" is capitalized). The word "column" doesn't appear in the main dashboard UI. @@ -51,21 +57,15 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Drill down**. Drill down, as in a menu, or other filtering feature is two words, not one. -**Dropdown**. - * Use drop-down (Adjective). Example: Choose your favorite model from a *drop-down* menu. - * Use dropdown (Noun). Example: Select a source category from the *dropdown*. Do not use drop down (two words). - -:::info -If we are not clear on its usage, the term shouldn’t be used at all: Don't use 'drop-down'; use menu or list. We should keep our target audience in mind, that is, developers or engineers. For example, "Select a source from the list". Developers or Engineers already know they have to select the source from the dropdown only. -::: +**Dropdown**. Use "dropdown" (one word, no hyphen) as an adjective before a noun: "dropdown list," "dropdown menu." Don’t use it as a standalone noun. When possible, describe the action instead: "Select X from the list." Do not use "drop-down" (hyphenated) or "drop down" (two words). ## E -**E.g., i.e., and etc.,** These abbreviations are parenthetical, which means they take a comma after. [Avoid using these abbreviations](/docs/contributing/style-guide/#abbreviations). +**E.g., i.e., and etc.** Don't use these abbreviations. Use "for example" instead of "e.g.", "that is" instead of "i.e.", and avoid "etc." by listing items explicitly or using "such as." See [Abbreviations](/docs/contributing/style-guide/#abbreviations) in the style guide. **Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. -**Em dash**. We do not use this often, but if you need to use it, insert the em dash symbol (—), do not use a double hyphen (–). +**Em dash** and **en dash**. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. **Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. @@ -106,6 +106,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use **Library**. The Sumo Logic Library (formerly the Content Library) is now just the Library. Capitalize. +**Lifecycle**. One word. Don't use "life cycle" (two words) or "life-cycle" (hyphenated). + **Login vs Log In**. Login as one word is a _noun_ or an _adjective_. Log in as two words is a _verb_. For example, "You can log in on the login page." @@ -119,6 +121,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use **Messages tab**. When referring to the Messages tab (where non-aggregate search results are displayed) the term Messages is capitalized. +**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. + **Multiline**. Should be one word, not two, or hyphenated. @@ -151,6 +155,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use ## R +**Real time / real-time**. Two words as a noun: "Data updates in real time." Hyphenate as an adjective before a noun: "real-time alerts," "real-time dashboard." + **Repo**. Short for repository. No need to spell out repository as our audience is technical enough for this to be clear. @@ -201,6 +207,8 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Time slice**. Time slice is two words, not one. +**Timeout**. One word, no hyphen, whether used as a noun or adjective. Don't use "time-out" or "time out." + **Timestamp**. Timestamp is one word. **Time zone**. Time zone is two words, not one. From fa2ca41f5791f7009e7f406f4f4e62b249a6e019 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 07:04:46 -0700 Subject: [PATCH 3/7] DOCS-482 - Restore original em dash word list entry; remove personal em dash preference from sumo-style skill Co-Authored-By: Claude Sonnet 4.6 --- .claude/skills/sumo-style/SKILL.md | 1 - docs/contributing/style-guide.md | 6 ------ docs/contributing/word-list.md | 2 +- 3 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.claude/skills/sumo-style/SKILL.md b/.claude/skills/sumo-style/SKILL.md index 3d113e8158f..064231f3c50 100644 --- a/.claude/skills/sumo-style/SKILL.md +++ b/.claude/skills/sumo-style/SKILL.md @@ -208,7 +208,6 @@ Fetch the full list at https://www.sumologic.com/help/docs/contributing/word-lis These are Sumo Logic- and repo-specific facts that override general assumptions. -- **No em dashes, ever.** Do not use "--" as a substitution for an em dash either. Rewrite the sentence instead. - **Site URL is `sumologic.com/help`**, not `help.sumologic.com`. Always use the former in docs and links. - **`:::training` is a custom Sumo Logic admonition** (purple, graduation cap icon). It is not a standard Docusaurus admonition -- do not treat it like one or omit it. - **`:::sumo` is also custom.** Standard Docusaurus will not recognize it outside this repo. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index c41b7c89d96..a1685750563 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -973,12 +973,6 @@ Use exclamation points to express excitement or encourage the user. Don't use th Use ellipses for truncation. Don’t use ellipses for placeholders or trailing off a sentence unless it is getting cut off. When truncating, think about which part of the string is most essential for the user. This may require truncating in the beginning, middle, or end of a string. -### Dashes - -**Em dash (—)**. Use sparingly. Insert the em dash symbol (—) directly — do not use a double hyphen (--) as a substitute. - -**En dash (–)**. Use for date and time ranges: "June 1–15", "9:00–5:00 pm". Insert the en dash symbol (–) directly. - ### Periods In the UI, avoid periods for single sentences on their own. Whenever there are two or more sentences, use periods at the end of each sentence. Separate sentences by one space, not two. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 6b7930d0d06..74c2da5e05f 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -65,7 +65,7 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. -**Em dash** and **en dash**. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. +**Em dash**. We do not use this often, but if you need to use it, insert the em dash symbol (—), do not use a double hyphen (–). **Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. From cb604168f4b27a69f4439947c85defab10a9c030 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 07:12:29 -0700 Subject: [PATCH 4/7] DOCS-482 - Add Accessibility section to style guide Co-Authored-By: Claude Sonnet 4.6 --- docs/contributing/style-guide.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index a1685750563..b619632d4cf 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -184,6 +184,35 @@ Subject matter expert guidance, best practices, and Sumo Logic-specific notes. R Links to training courses, certifications, and micro lessons. ::: +## Accessibility + +Sumo Logic documentation follows [WCAG 2.1 AA](https://www.w3.org/TR/WCAG21/) as its accessibility baseline. + +For **alt text** guidance, see [Images](#images). For **link text** (avoid "click here"), see [Links](#links). For **ableist and non-inclusive language**, see [Inclusive language](#inclusive-language). + +### Heading hierarchy + +Don't skip heading levels. Screen readers and keyboard users navigate by headings, and a broken hierarchy makes content harder to scan. + +**Do:** move through levels in order — H2 → H3 → H4. + +**Don't:** jump from H2 to H4, or use headings for visual styling rather than document structure. + +### Color and contrast + +Don't rely on color alone to convey meaning. Users with color blindness or high-contrast display modes may not perceive color differences. + +- If a screenshot or diagram uses color to highlight something, add a label, callout, or annotation so the meaning is clear without color. +- For custom diagrams or graphics, use a text contrast ratio of at least 4.5:1 (WCAG AA). Check with the [WebAIM Contrast Checker](https://webaim.org/resources/contrastchecker/) or [TPGi's Colour Contrast Analyser](https://www.tpgi.com/color-contrast-checker/). + +### Screen reader testing + +Before submitting a PR for a new doc, consider a quick screen reader check to catch heading, link, and table issues: + +- **macOS**: VoiceOver — press **Command+F5** to toggle. +- **Windows**: [NVDA](https://www.nvaccess.org/) (free) or Narrator (**Windows+Ctrl+Enter**). +- **Chrome**: [ChromeVox](https://chrome.google.com/webstore/detail/screen-reader/kgejglhpjiefppelpmljglcjbhoiplfn) extension. + ## Capitalization * Title case all doc titles. Example: `Cloud SOAR Incident Management and Triage`. From d1c8be4dad62570670eec32d00b84e573cf28ac3 Mon Sep 17 00:00:00 2001 From: "Kim (Sumo Logic)" <56411016+kimsauce@users.noreply.github.com> Date: Wed, 2 Sep 2026 08:43:26 -0700 Subject: [PATCH 5/7] Update SKILL.md --- .claude/skills/sumo-style/SKILL.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.claude/skills/sumo-style/SKILL.md b/.claude/skills/sumo-style/SKILL.md index 064231f3c50..3d113e8158f 100644 --- a/.claude/skills/sumo-style/SKILL.md +++ b/.claude/skills/sumo-style/SKILL.md @@ -208,6 +208,7 @@ Fetch the full list at https://www.sumologic.com/help/docs/contributing/word-lis These are Sumo Logic- and repo-specific facts that override general assumptions. +- **No em dashes, ever.** Do not use "--" as a substitution for an em dash either. Rewrite the sentence instead. - **Site URL is `sumologic.com/help`**, not `help.sumologic.com`. Always use the former in docs and links. - **`:::training` is a custom Sumo Logic admonition** (purple, graduation cap icon). It is not a standard Docusaurus admonition -- do not treat it like one or omit it. - **`:::sumo` is also custom.** Standard Docusaurus will not recognize it outside this repo. From e399f7ba5466b1804bb5ff9947da49178741c9ca Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Thu, 10 Sep 2026 17:22:51 -0700 Subject: [PATCH 6/7] sort word list/glossary changes --- docs/contributing/glossary.md | 18 +++++++++--------- docs/contributing/word-list.md | 10 +++++----- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index e09ef751932..309a9005f86 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -29,7 +29,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Aggregate](/docs/search/search-query-language/group-aggregate-operators)**. A group of data returned by a search, displayed in a simple table in the Aggregates tab of the Search page. -**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when trigger conditions — critical, warning, or missing data — are satisfied, and it includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. +**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when critical, warning, or missing data trigger conditions are satisfied. It includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. **[Allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses)**. A list of IP addresses or CIDR ranges that are explicitly granted access to logins, APIs, and dashboards. Configured on the **Service Allowlist Settings** tab in Account Security Settings. @@ -92,7 +92,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Data Forwarding](/docs/manage/data-forwarding)**. When enabled, the Data Forwarding feature allows Sumo Logic to upload data to an Amazon S3 bucket that belongs to your organization. Log messages are saved as CSV files in compressed gzip files. They are accumulated and returned right after being ingested by Sumo Logic. -**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers — Continuous, Frequent, or Infrequent — based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. +**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers (Continuous, Frequent, or Infrequent) based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. **[Data type](/docs/get-started/faq)**. A data type is a specific type of log used with a Sumo Logic source or app, such as Apache, MySQL, or Windows IIS. You can also use a custom data type for a custom application. @@ -100,7 +100,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Deployment](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created. -**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record — for example, an IP and hostname in the same log message — even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. +**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record, such as an IP address and hostname in the same log message, even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. @@ -160,10 +160,10 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## H -**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. - **[Hash rules](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. +**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. + **[Host Metrics](/docs/integrations/hosts-operating-systems/host-metrics)**. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP. **[Hosted collectors](/docs/send-data/hosted-collectors)**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. @@ -201,14 +201,14 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Local configuration file management](/docs/send-data/use-json-configure-sources/local-configuration-file-management)**. Local configuration file management allows you to set up and manage sources on an installed collector using one or more JSON files. -**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. - **[Log Analysis Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Log Analysis Agent interprets intent, guides investigations, and surfaces relevant data from your logs through natural language. Formerly called the Query Agent. **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. +**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. + **[Logs-to-Metrics](/docs/metrics/logs-to-metrics)**. A Sumo Logic feature you can use to extract or create metrics from log data. You can extract metrics that are embedded in logs, or count logs as a metric. **[Lookup Table](/docs/search/lookup-tables)**. A table of reference data hosted in Sumo Logic that you can join to log search results to enrich them with additional context. For example, you can map a user ID in a log to an email address, department, or other attribute stored in the table. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 3fe6a999537..2f55fd339db 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -113,6 +113,8 @@ This word list gives the preferred spelling, capitalization, and punctuation for ## M +**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. + **Markdown**. Always capitalize. It's a proper noun (the name of the markup language). **MB and Mbit.** MB is the acronym for megabytes. Mbit or Mb is the acronym for megabits. Make sure to capitalize correctly. Don't use a space between the acronym and the number. (Example: 10MB or 15Mbit.) @@ -121,8 +123,6 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Messages tab**. When referring to the Messages tab (where non-aggregate search results are displayed) the term Messages is capitalized. -**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. - **Multiline**. Should be one word, not two, or hyphenated.