From 9c15999108016ff161a9fad217af43262120cb8e Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 03:26:50 -0700 Subject: [PATCH 01/14] DOCS-482 - Map italicized definitions to glossary entries - Convert italicized term definitions to links (Scheduled Search, Installed Collector, entity, suppressed signal, related signal/insight, detected relationship, node, credit, Logs for Security) - Add 10 new glossary entries: Alert (expanded), Monitor, Keyword Search Expression, Scheduled action, Node, Credit, Related signal, Related insight, Detected relationship, Suppressed signal, Logs for Security - Remove italics from common industry terms (webhook definition sentence dropped), SRE standard terms (SLI, SLO, compliance period, error budget), and terms on their own feature pages - Fix non-breaking space in transactionize-operator.md - Convert argument names to backtick code formatting in deploy-with-terraform.md Co-Authored-By: Claude Sonnet 4.6 --- docs/alerts/monitors/overview.md | 2 +- .../monitors/use-playbooks-with-monitors.md | 4 +-- docs/alerts/scheduled-searches/index.md | 2 +- .../set-up-webhook-connections.md | 2 +- .../about-apis/terraform-with-sumo-logic.md | 6 ++--- docs/contributing/glossary.md | 25 ++++++++++++++++++- .../about-cse-insight-ui.md | 6 ++--- .../insight-generation-process.md | 2 +- .../standard-match-lists.md | 2 +- .../about-signal-suppression.md | 2 +- docs/cse/troubleshoot/troubleshoot-mappers.md | 2 +- .../manage-orgs-for-mssps.md | 2 +- docs/manage/security/access-keys.md | 2 +- .../metric-query-error-messages.md | 2 +- .../deploy-with-terraform.md | 4 +-- .../reliability-management-slo/index.md | 8 +++--- .../about-integration-framework.md | 2 +- .../playbooks/create-playbooks.md | 2 +- docs/reuse/account-credit.md | 2 +- .../keyword-search-expressions.md | 2 +- .../search-operators/sessionize.md | 2 +- .../transactionize-operator.md | 2 +- .../additional-security-features/index.md | 2 +- .../amazon-aws/grant-access-aws-product.md | 4 +-- docs/send-data/installed-collectors/index.md | 2 +- .../mapping-records-resources.md | 4 +-- .../data-source-configurations/overview.md | 2 +- 27 files changed, 61 insertions(+), 38 deletions(-) diff --git a/docs/alerts/monitors/overview.md b/docs/alerts/monitors/overview.md index 26f32bfa7dd..cfc29c2cf85 100644 --- a/docs/alerts/monitors/overview.md +++ b/docs/alerts/monitors/overview.md @@ -96,7 +96,7 @@ When a specific alerting condition is met, as defined on the monitor, an inciden ### Monitor -A _Monitor_ creates an _Alert_. Using the options below, you're subscribing to an _Alert's Monitor_. +A Monitor creates an Alert. Using the options below, you're subscribing to an Alert's Monitor. The monitor is the object that you configure within Sumo Logic that: * Checks for specific events of interest against a data source, based on your specified conditions. Events of interest are used in a general sense to denote an event that may be of interest to you. diff --git a/docs/alerts/monitors/use-playbooks-with-monitors.md b/docs/alerts/monitors/use-playbooks-with-monitors.md index c12a8d0a862..3dc37950f33 100644 --- a/docs/alerts/monitors/use-playbooks-with-monitors.md +++ b/docs/alerts/monitors/use-playbooks-with-monitors.md @@ -7,7 +7,7 @@ description: Learn how to use Automation Service playbooks with monitors. import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe'; -This article describes how to configure automated playbooks in monitors. An *automated playbook* is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. +This article describes how to configure automated playbooks in monitors. An automated playbook is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. To add an automated playbook to a monitor, see [Add an automated playbook to a monitor](#add-an-automated-playbook-to-a-monitor) below. @@ -80,7 +80,7 @@ You can create a monitor that triggers an alert that in turn runs an automated p An anomaly monitor is triggered when unusual conditions are detected. Anomaly monitors leverage a machine learning model to detect anomalies and identify unusual patterns of activity. The output of the machine learning model are baselines for normal behavior, in the form of lower and upper thresholds, so that deviations from baselines signal unusual activity and trigger alerts. :::note -Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (*Weekly seasonality detection* is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) +Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (Weekly seasonality detection is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) ::: :::training Micro Lesson diff --git a/docs/alerts/scheduled-searches/index.md b/docs/alerts/scheduled-searches/index.md index 7da367f25b1..1acea6fe789 100644 --- a/docs/alerts/scheduled-searches/index.md +++ b/docs/alerts/scheduled-searches/index.md @@ -6,7 +6,7 @@ description: Schedule log searches in Sumo Logic to run continuously and send al import useBaseUrl from '@docusaurus/useBaseUrl'; -A _Scheduled Search_ is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack. +A [Scheduled Search](/docs/alerts/scheduled-searches/schedule-search) is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack.
diff --git a/docs/alerts/webhook-connections/set-up-webhook-connections.md b/docs/alerts/webhook-connections/set-up-webhook-connections.md index 82c536eb55b..2777fd69b76 100644 --- a/docs/alerts/webhook-connections/set-up-webhook-connections.md +++ b/docs/alerts/webhook-connections/set-up-webhook-connections.md @@ -11,7 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; To create a webhook connection, you need the View Connections and Manage Connections [role capabilities](/docs/manage/users-roles/roles/role-capabilities). Contact your org administrator for assistance. ::: -A _webhook_ is an HTTP callback, which is an HTTP POST that occurs when something happens. Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. +Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. For example, once you set up a webhook connection in Sumo Logic and create a scheduled search, you can send an alert from that scheduled search as a post to a Slack channel, or integrate with third-party systems. In addition to an alert, you can include a link directly to a search and even a few search results (depending on the third party tool you're connecting to). There is no limit to the number of webhooks you can send from Sumo Logic, but your third party might impose restrictions. In addition, the payload of a webhook may be restricted by Sumo Logic or the third party. diff --git a/docs/api/about-apis/terraform-with-sumo-logic.md b/docs/api/about-apis/terraform-with-sumo-logic.md index 67e9d68c08d..1656c852e91 100644 --- a/docs/api/about-apis/terraform-with-sumo-logic.md +++ b/docs/api/about-apis/terraform-with-sumo-logic.md @@ -210,7 +210,7 @@ Let's look at some examples: ### Terraform providers -A *provider* is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A provider is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). Sumo Logic has an established Terraform provider plugin, as does AWS and other major cloud vendors. The Terraform script section defining the provider for resources defined by other parts of the script might look like this: @@ -238,7 +238,7 @@ terraform { ### Terraform resources -A *resource* is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A resource is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). A resource definition will look similar in form to the provider definition: @@ -352,7 +352,7 @@ data "httpclient_request" "enable_searchaudit_policy" { ### Terraform state files -After running Terraform, there is another file type you should be aware of. A *state file* is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. +After running Terraform, there is another file type you should be aware of. A state file is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. The state file is used by Terraform to track the current infrastructure state in order to properly process updates or deletes. The state file should be kept safe and secure (since it may contain sensitive data such as access keys and secrets) and is not meant to be edited directly, even though it is a simple human-readable JSON text file. An example state file might look like the screenshot below: diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index b5bd1e0a512..96812c97bed 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -29,7 +29,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Aggregate](/docs/search/search-query-language/group-aggregate-operators)**. A group of data returned by a search, displayed in a simple table in the Aggregates tab of the Search page. -**[Alert](/docs/alerts)**. A notification you can configure for a scheduled search. There are multiple alert types, such as Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. +**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when trigger conditions — critical, warning, or missing data — are satisfied, and it includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. **[Allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses)**. A list of IP addresses or CIDR ranges that are explicitly granted access to logins, APIs, and dashboards. Configured on the **Service Allowlist Settings** tab in Account Security Settings. @@ -55,6 +55,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Cardinality](/docs/metrics/logs-to-metrics/#manage-metric-cardinality)**. Refers to the uniqueness of values in a database column or metric dimension. High cardinality metrics are metrics with dimensions that have many different values, which can result in a high volume of unique time series. In Sumo Logic, you can use a transformation rule to aggregate high cardinality data from ephemeral sources into higher-level metrics that you want to analyze over time. +**[Credit](/docs/manage/manage-subscription/sumo-logic-credits-accounts)**. A unit of measure that tracks account usage, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. + **[Clobber](/docs/send-data/installed-collectors/collector-installation-reference/force-collectors-name-clobber/)**. During the installation process, use the clobber flag in situations where you're creating a new collector that will use a name that is already in use by another collector. Clobber deletes (clobbers) the existing collector with the same name. [**Cloud SIEM**](/docs/cse). A cloud-native security information and event management solution that automatically normalizes, correlates, and analyzes your security data. Cloud SIEM surfaces insights that help security analysts detect and investigate threats faster. @@ -88,6 +90,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Deployment](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created. +**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record — for example, an IP and hostname in the same log message — even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. + @@ -164,6 +168,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## K +**[Keyword Search Expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions)**. The portion of a log search query that precedes the first pipe symbol. Defines the scope of data for the query using Boolean logic, wildcards, and metadata fields such as `_sourceCategory` and `_collector`. + **[Kubernetes Views](/docs/observability/kubernetes/monitoring)**. Allows you to intuitively filter on four hierarchical components of your Kubernetes system to focus your search on nodes, deployments, services, or namespaces. Kubernetes Views make it easier to traverse your Kubernetes hierarchy to monitor specific components, identify problems, discover root problems, and take progressive action. @@ -175,6 +181,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Local configuration file management](/docs/send-data/use-json-configure-sources/local-configuration-file-management)**. Local configuration file management allows you to set up and manage sources on an installed collector using one or more JSON files. +**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. + **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. @@ -214,9 +222,16 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. It uses a suite of specialized agents to help you search, analyze, and learn about your data using natural language. +**[Monitor](/docs/alerts/monitors/overview)**. An object you configure in Sumo Logic that tracks your metrics and logs data in real time and sends notifications when noteworthy changes happen in your production applications. A monitor checks for specific events of interest against a data source based on your conditions, then notifies you according to your preferences. + **[Multiline](/docs/send-data/reference-information/collect-multiline-logs)**. Log messages that span multiple lines are called multiline messages. +## N + +**[Node](/docs/platform-services/automation-service/playbooks/create-playbooks)**. In Automation Service playbooks, a step that performs a specific action within a playbook. Nodes run in the order they are placed; when all nodes complete without error, the playbook is considered to have executed successfully. + + ## O **[OpenTelemetry Collector, Sumo Logic](/docs/send-data/opentelemetry-collector/)**. An open-source, vendor-agnostic agent for collecting, processing, and exporting telemetry data such as logs, metrics, and traces. Sumo Logic supports the OpenTelemetry Collector as a unified alternative to installed collectors for sending observability data to Sumo Logic. @@ -262,6 +277,10 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. +**[Related insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, an insight that a related signal is attached to. + +**[Related signal](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a signal that isn't part of the current insight (not attached), but fired on the same entity as the current insight's attached signals within 7 days of those signals. + **[Relative expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m. **[Role](/docs/manage/users-roles/roles/)**. In Sumo Logic role-based access control (RBAC), you grant users access to data and to Sumo Logic functions using roles. You assign role capabilities and a role search filter to a role, and assign one or more roles to a user. @@ -278,6 +297,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[SAML](/docs/manage/security/saml)**. Sumo Logic supports self-provisioning of Security Assertion Markup Language (SAML) to enable Single Sign-On (SSO). In addition to basic SAML configuration, you can choose optional on-demand user creation (via SAML 2.0 assertions), and designate custom log in and/or log out portals. +**[Scheduled action](/docs/platform-services/automation-service/integration-framework/about-integration-framework)**. In the Automation Service integration framework, an action type whose execution repeats until a specific exit condition is met, enabling loops within a playbook. + **[Scheduled search](/docs/alerts/scheduled-searches/schedule-search)**. When you save a log search, you can schedule it to run it on a periodic basis, and configure an alert that will issue a notification every time the search runs, or when a condition you specify is met. **[Scheduled view](/docs/manage/scheduled-views)**. A scheduled view is a pre-aggregated index of a subset of data. After building a scheduled view, you'll be able to run queries against that data set. Because the data is pre-aggregated, meaning that query you'll use to create a scheduled view contains an aggregate function, search results return much quicker. Additionally, queries run against a scheduled view cannot time out. Queries that run against views can be used in scheduled searches, dashboards, and in ad hoc searches. @@ -292,6 +313,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. +**[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. + **[Subqueries](/docs/search/subqueries)**. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query. **[Support account](/docs/manage/security/enable-support-account)**. A support account is a special Sumo Logic user account that you can enable so that Sumo Logic support personnel can access your Sumo Logic org. Typically, you enable your support account for a limited period of time, just long enough to allow Sumo Logic support to diagnose a problem or answer a question. diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md index 4ff2e60a57b..1cd675cba70 100644 --- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md +++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md @@ -176,8 +176,8 @@ At the top of the insight details page, you’ll see a signal timeline that visu * **Anomaly**. Signals that were triggered by User and Entity Behavior Analytics (UEBA) rules. * **Threat intelligence**. Signals that were fired by threat intel rules. 1. **Show Related**. Click this link to show related signals in addition to attached signals. If you click the **Show Related** check box, the page updates and also displays any related signals or related insights. - * A *related signal* is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals.  - * A *related insight* is an insight that a related signal is attached to. + * A related signal is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals. + * A related insight is an insight that a related signal is attached to. 1. **Sort options**. You can sort the signals list by Content Type, Event Time, Created Time, Name, or Severity. Note that you can further sort by ascending or descending value. 1. **Add Signals**. Click this option if you want to add a signal to the insight. You’ll be prompted with a list of signals that have the same entity as the current insight (if there are any), and are not already attached to another insight. A signal that you add to an insight manually is considered an attached signal. @@ -280,7 +280,7 @@ By default, this view shows the same entities that are displayed on the list vie * A **time frame** control, which controls what time frame to use when searching for and viewing relationships outside of the insight. In addition, the following can appear in the graph: -* **Detected entities**. Entities with a *detected* relationship will be connected with solid lines. A *detected relationship* is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). +* **Detected entities**. Entities with a detected relationship will be connected with solid lines. A detected relationship is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). * **Threat indicators**. Any entity with a threat indicator will have an additional icon in the upper right. If the threat indicator is Malicious or Suspicious, the entity will be highlighted in red or yellow accordingly. For more information about threat indicators, see [View threat indicator labels in the Cloud SIEM UI](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#view-threat-indicator-labels-in-the-cloud-siem-ui). * **Hover**. If you hover over an entity, it and all connections to it will be highlighted in blue. If its value is not fully visible by default, the full value will be displayed. diff --git a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md index 5e16395834e..7f47abea845 100644 --- a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md +++ b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md @@ -10,7 +10,7 @@ import Iframe from 'react-iframe';  This page explains Cloud SIEM's insight generation process.  -The concept of an *entity* is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). +The concept of an entity is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). :::training Micro Lesson Watch this micro lesson to learn how insights are created. diff --git a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md index 9ab694334b6..2ea8de72e7a 100644 --- a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md +++ b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md @@ -255,7 +255,7 @@ The following Cloud SIEM rules refer to this match list: **Description:** DNS domain names that are known business-related domains. This is intended to capture domains related to validated, expected, or critical business functions and may be used for allowlisting or filtering related uninteresting results from query result sets. -*Domain* matches against the `domain` field, not the FQDN (i.e. hostname or query), so *example.com* is a valid entry is but *www.example.com* is not. +Domain matches against the `domain` field, not the FQDN (i.e. hostname or query), so `example.com` is a valid entry but `www.example.com` is not. The following Cloud SIEM rules refer to this match list: * Bitsadmin to Uncommon TLD diff --git a/docs/cse/records-signals-entities-insights/about-signal-suppression.md b/docs/cse/records-signals-entities-insights/about-signal-suppression.md index b61fcbcd121..9dd174452bc 100644 --- a/docs/cse/records-signals-entities-insights/about-signal-suppression.md +++ b/docs/cse/records-signals-entities-insights/about-signal-suppression.md @@ -13,7 +13,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This topic describes the various ways that signals can get suppressed. -In Cloud SIEM, a *suppressed signal* is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. +In Cloud SIEM, a suppressed signal is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. Signal suppression can occur for a variety of reasons, including [entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the signal ID of an identical signal that caused subsequent redundant signals to be suppressed, or it may contain the name of the network block with suppression enabled. diff --git a/docs/cse/troubleshoot/troubleshoot-mappers.md b/docs/cse/troubleshoot/troubleshoot-mappers.md index 4fae6407f63..13cd3683bc9 100644 --- a/docs/cse/troubleshoot/troubleshoot-mappers.md +++ b/docs/cse/troubleshoot/troubleshoot-mappers.md @@ -63,7 +63,7 @@ Incomplete records result when a record is created, but key information is not m ### A mapper does not exist for parsed events -Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a _default_ pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. +Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a default pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. This assumes the data source for which the mapping is failing has a parser and mappers in place already. This applies to net-new data sources and parsers. diff --git a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md index 67a5bb1d19d..eebec451410 100644 --- a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md +++ b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md @@ -115,7 +115,7 @@ You can push the following: - If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](#view-history). - Push operations may take longer based on the volume of content being pushed. - Rule tuning expressions must be pushed separately from rules. -- *Cloud SIEM Legacy Rule Type* is not supported for sync or push. +- Cloud SIEM Legacy Rule Type is not supported for sync or push. - For library content, breaching 15,000 cap (Items selected in one job X Child orgs targeted in one job) would fail the sync job. - The maximum runtime for jobs below 1200 requests (Items selected in one job X Child orgs targeted in one job) is less than or equal to 2 mins. Linear increase beyond 1200 request would take more runtime, for example, 15,201 would nearly take 30 mins. - For CSIEM rules and tuning expression (Rule or Tuning Exp × child-orgs): diff --git a/docs/manage/security/access-keys.md b/docs/manage/security/access-keys.md index 0750d2cdd47..68317f5e8ba 100644 --- a/docs/manage/security/access-keys.md +++ b/docs/manage/security/access-keys.md @@ -56,7 +56,7 @@ Watch this micro lesson to learn how to create access keys. ### From the Personal Access Keys tab -A *personal access key* is a key that you can create to manage access for personal use. +A personal access key is a key that you can create to manage access for personal use. :::tip If you are an administrator who needs to create an access key for system use (such as for API scripts, third party integrations, or infrastructure as code), we recommend you create the access key on a [service account](#from-a-service-account). diff --git a/docs/metrics/metrics-queries/metric-query-error-messages.md b/docs/metrics/metrics-queries/metric-query-error-messages.md index ee6d1d6f795..8646e98d362 100644 --- a/docs/metrics/metrics-queries/metric-query-error-messages.md +++ b/docs/metrics/metrics-queries/metric-query-error-messages.md @@ -46,7 +46,7 @@ Sumo Logic imposes limits on the input data for a query and the data output by t #### Input data limit -*Input data* is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. +Input data is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. For a single metrics query row, Sumo Logic limits the number of input time series to 1000 for non-aggregate queries. For aggregate queries (queries that have an aggregate operator like `avg` or `max`) the limit is at least 200,000 for time ranges within last 24 hours and 50,000 otherwise. diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md index cbef317af84..06dc69a971e 100644 --- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md +++ b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md @@ -1633,7 +1633,7 @@ This error can occur when cloudtrail is not enabled for EventBridge to capture ` #### Solution CloudTrail must be enabled for EventBridge to capture `CreateLoadBalancer` events, since these events are recorded and delivered through CloudTrail. -### Argument named *managed_apps* is not expected +### Argument named `managed_apps` is not expected #### Error Message ``` @@ -1645,7 +1645,7 @@ managed_apps = { #### Solution Refer to [this module in GitHub](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-integrations/tree/master/sumologic). -### Argument named *admin_mode* is not expected +### Argument named `admin_mode` is not expected #### Error Message ``` diff --git a/docs/observability/reliability-management-slo/index.md b/docs/observability/reliability-management-slo/index.md index 01105e8e7d9..b1efaa05ded 100644 --- a/docs/observability/reliability-management-slo/index.md +++ b/docs/observability/reliability-management-slo/index.md @@ -42,11 +42,11 @@ To work with SLOs, you need the following Sumo Logic [role capabilities](/docs/m Reliability is essentially the uptime of systems and services. This includes the following concepts: -**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the _SLI_ for a _compliance period_. +**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the SLI for a compliance period. -**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the _SLO_ — the quality promised to end users — is being met. +**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the SLO — the quality promised to end users — is being met. -**Error Budget**. The tolerable amount/level of system unavailability in the _compliance period_. +**Error Budget**. The tolerable amount/level of system unavailability in the compliance period. **Compliance period**. The duration of time used to monitor and score your system/service availability. Breaking down your organization's quantitative success rate over consistent time periods is useful internally and can be communicated to customers that you're meeting your goals. See the following information for the max compliance period: @@ -70,7 +70,7 @@ Reliability is essentially the uptime of systems and services. This includes the As an example, let's say an ecommerce app considers its checkout service transactions to be successful (good) when completed in less than 500ms. A successful five-minute (5m) time window may be one in which the p99 of latency is less than 500ms. -The _SLI_ can be defined as the percentage of successful 5m windows in a _compliance period_ of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an _error budget_ is 0.1% of these 5m windows in 30d. +The SLI can be defined as the percentage of successful 5m windows in a compliance period of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an error budget is 0.1% of these 5m windows in 30d. The following chart shows our calculations and an example 5m window for the month of January where a number of requests were unsuccessful due to completions that were greater than 500ms: diff --git a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md index 9277bc315d2..2526fb78765 100644 --- a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md +++ b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md @@ -326,7 +326,7 @@ All available actions are: #### Scheduled action definitions -A _Scheduled action_ represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. +A Scheduled action represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. YAML example: diff --git a/docs/platform-services/automation-service/playbooks/create-playbooks.md b/docs/platform-services/automation-service/playbooks/create-playbooks.md index 15cd846c74c..c2887842b24 100644 --- a/docs/platform-services/automation-service/playbooks/create-playbooks.md +++ b/docs/platform-services/automation-service/playbooks/create-playbooks.md @@ -46,7 +46,7 @@ See [Add nodes to a playbook](/docs/platform-services/automation-service/playboo ## Add nodes to a playbook -You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A *node* is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. +You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A node is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. See the following sections to learn how to add the following node types: * [**Action**](#add-an-action-node-to-a-playbook). Automatically take specific actions such as enriching data or taking containment steps. diff --git a/docs/reuse/account-credit.md b/docs/reuse/account-credit.md index 0ed36c92235..fa4cbddedf8 100644 --- a/docs/reuse/account-credit.md +++ b/docs/reuse/account-credit.md @@ -1 +1 @@ -A *credit* is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. +A credit is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. diff --git a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md index 0f3786f8f80..34c597f1696 100644 --- a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md +++ b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md @@ -4,7 +4,7 @@ title: Keyword Search Expressions description: The text that comes before the first pipe symbol in a query is called the keyword expression or scope. --- -A _Keyword Search Expression_ defines the scope of data for the query. +A Keyword Search Expression defines the scope of data for the query. Boolean logic and wildcards enable you to search for multiple terms, express logic about term distribution within messages, and specify partial terms with wildcards. The keyword expression can include [built-in metadata fields](../search-basics/built-in-metadata.md) such as `_collector`, `_sourceCategory`, `_sourceName`, and `_sourceHost` as well as custom log metadata fields. diff --git a/docs/search/search-query-language/search-operators/sessionize.md b/docs/search/search-query-language/search-operators/sessionize.md index c09d23d82d9..a96c12186b4 100644 --- a/docs/search/search-query-language/search-operators/sessionize.md +++ b/docs/search/search-query-language/search-operators/sessionize.md @@ -25,7 +25,7 @@ Queries using `sessionize` cannot be added to a Dashboard. `sessionize ("") as (), ("") as ()` -Where *anchor pattern* is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). +Where anchor pattern is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). ## Rules diff --git a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md index 4ca6957e287..ce3819f0ce3 100644 --- a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md +++ b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md @@ -5,7 +5,7 @@ title: Transactionize Operator import useBaseUrl from '@docusaurus/useBaseUrl'; -The _Transactionize_ operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. +The Transactionize operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. Unlike other "group by" operators, where the logs in a group must match on all defined fields, `transactionize` just needs one field to match in order to assign logs to the same group. diff --git a/docs/security/additional-security-features/index.md b/docs/security/additional-security-features/index.md index d32b600932e..65e4ced008a 100644 --- a/docs/security/additional-security-features/index.md +++ b/docs/security/additional-security-features/index.md @@ -5,7 +5,7 @@ title: Logs for Security import useBaseUrl from '@docusaurus/useBaseUrl'; -*Logs for Security* is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. +Logs for Security is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. :::training Sumo Logic Academy diff --git a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md index 4e12b932271..2ce93ab1b20 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md +++ b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md @@ -88,8 +88,8 @@ Before generating the template, the source’s configuration must have the AWS-s 1. **Account ID**. Enter the following Sumo Logic ID: `926226587429`. 1. In the **Options** section, checkmark the **Require external ID for better security**.  1. **External ID**. The External ID is formed from your Sumo Logic region identifier and your Sumo Logic account identifier in this format: *SumoDeployment:SumoAccountId*, where: - * *SumoDeployment* is your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. - * *SumoAccountId* is the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. + * *SumoDeployment* is a placeholder for your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. + * *SumoAccountId* is a placeholder for the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. 1. **Require MFA**. Don’t select this option; it is not supported. 1. Click **Next: Permissions**.
AWS IAM 'Create role' interface specifying trusted entities and accounts, highlighting fields for Account ID and External ID 1. Click **Create policy**. The **Create policy** page opens in a separate window. diff --git a/docs/send-data/installed-collectors/index.md b/docs/send-data/installed-collectors/index.md index d9f4959f4c0..7d485f6353c 100644 --- a/docs/send-data/installed-collectors/index.md +++ b/docs/send-data/installed-collectors/index.md @@ -8,7 +8,7 @@ keywords: import useBaseUrl from '@docusaurus/useBaseUrl'; -Our *Installed Collector* is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. +Our Installed Collector is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. In this section, we'll introduce the following concepts: diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md index 5f82a24ee1f..981f62af300 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md @@ -14,7 +14,7 @@ OpenTelemetry has a [rich data model](https://github.com/open-telemetry/opentele * **Instrumentation Scope**. Additional information about the scope of data. For example, instrumentation library name. * **Record**. Refers to a specific entry of data, such as a Log, Span, or Metric. :::note -For logs, this is usually called a _Record_; for traces, it's usually called a _Span_; and for metrics, a _Datapoint_ (or _sample_, if Prometheus is used). In this documentation, we'll use _Record_ for all of these. +For logs, this is usually called a Record; for traces, it's usually called a Span; and for metrics, a Datapoint (or sample, if Prometheus is used). In this documentation, we'll use Record for all of these. ::: Each Record has its own set of attributes, which may include key/value pairs that are specific to the context of the Record. Logs, in particular, can also include attributes in the body of the Record. Some Record types may follow certain conventions for signal types, such as [trace](https://github.com/open-telemetry/semantic-conventions), [metrics](https://github.com/open-telemetry/semantic-conventions), or [logs](https://github.com/open-telemetry/semantic-conventions). @@ -27,7 +27,7 @@ Looking from the OpenTelemetry standpoint, [Fields](/docs/manage/fields) are a g All **Resource-level** attributes are stored as fields, and any attributes that do not match a defined field will be skipped. You can check the list of ignored fields using the [dropped fields view](/docs/manage/fields/#view-dropped-fields). When a log contains attributes at the **Record-level**, they are stored as JSON, and if there is a body, it will be stored under the `log` key. :::info -If your log record has any **Record-level** attributes, Sumo will interpret this as a _structured log_, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as _unstructured_ and display the body. **Resource-level** attributes are interpreted as fields. +If your log record has any **Record-level** attributes, Sumo will interpret this as a structured log, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as unstructured and display the body. **Resource-level** attributes are interpreted as fields. ::: ## Example: Log with both Resource-level and Record-level attributes diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md index 54c905e7b55..d910194ae89 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md @@ -13,7 +13,7 @@ After you complete source configuration on the Sumo Logic OpenTelemetry (OTel) C ## Data Sources -_Data sources_ (or _Source_ in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. +Data sources (or Source in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. Sources are components that generate data that is then collected by receivers. A source can be thought of as the originating point for data that is being ingested into the Sumo Logic OTel collector. Sources are responsible for collecting and formatting data, and then passing it along to the appropriate receiver. From 259849588e18113b7c8ca2abd4dfffdbb89f56aa Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 05:38:49 -0700 Subject: [PATCH 02/14] DOCS-482 - Update glossary, word list, and style guide contributing docs Co-Authored-By: Claude Sonnet 4.6 --- docs/contributing/glossary.md | 50 ++++++++++++++++++++++++++++++-- docs/contributing/style-guide.md | 6 ++++ docs/contributing/word-list.md | 32 ++++++++++++-------- 3 files changed, 73 insertions(+), 15 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index 96812c97bed..e09ef751932 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -35,8 +35,14 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Amazon S3 Audit source](/docs/send-data/hosted-collectors/amazon-aws/amazon-s3-audit-source)**. The Amazon S3 Audit source, also called Server Access Logging, tracks and collects your Amazon S3 bucket's activity logs. +**[Analyst](/docs/get-started/onboarding-checklists#onboarding-checklist-for-analysts)**. A Sumo Logic user role for non-administrators who primarily search logs, build dashboards, investigate data, and monitor their environment. Analyst capabilities are determined by the roles and permissions assigned to them. + +**[Audit Index](/docs/manage/security/audit-indexes/audit-index)**. A Sumo Logic index that stores event logs about internal account activities such as account management, throttling, and scheduled searches. Administrators must enable the Audit Index before it can be queried using `_index=sumologic_audit`. + **[Apps](/docs/integrations)**. Sumo Logic apps (short for applications) deliver out-of-the-box dashboards, reports, saved searches, and field extraction for popular data sources, such as AWS, Windows, Apache, and many more. When a customer installs an app in Sumo Logic, preconfigured searches and dashboards are customized with the customer's source configurations and populated in a folder. Customers then can monitor their system's behavior visually using the dashboards. +**[Automation Bridge](/docs/platform-services/automation-service/automation-service-bridge)**. A component of the Automation Service that you install in your on-premises environment to run custom actions and integrations outside the Sumo Logic cloud. + **[Automation Service](/docs/cse/automation/about-automation-service-and-cloud-siem)**. In Cloud SIEM, a service that automatically runs tasks such as sending notifications or adding data to records when security incidents occur. @@ -63,6 +69,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo [**Cloud SOAR**](/docs/cloud-soar). A security orchestration, automation, and response platform that helps security teams streamline incident response. Cloud SOAR automates repetitive tasks, orchestrates workflows across security tools, and tracks the full incident lifecycle. +**[Cloud-to-Cloud Integration Framework](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework)**. A fully-managed collection system that collects logs and events directly from SaaS and cloud platforms such as Salesforce, Microsoft 365, and Okta. The framework handles authentication, scheduling, and state tracking automatically. Also referred to as C2C. + @@ -84,6 +92,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Data Forwarding](/docs/manage/data-forwarding)**. When enabled, the Data Forwarding feature allows Sumo Logic to upload data to an Amazon S3 bucket that belongs to your organization. Log messages are saved as CSV files in compressed gzip files. They are accumulated and returned right after being ingested by Sumo Logic. +**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers — Continuous, Frequent, or Infrequent — based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. + **[Data type](/docs/get-started/faq)**. A data type is a specific type of log used with a Sumo Logic source or app, such as Apache, MySQL, or Windows IIS. You can also use a custom data type for a custom application. **[Data volume index](/docs/manage/ingestion-volume/data-volume-index)**. The data volume index automatically provides data that allows you to understand your account’s data ingest volume in bytes and number of log messages processed overall. The data volume index gives you better visibility into how much data you are sending to Sumo Logic, allowing you to proactively manage your systems’ behavior and to fine tune your data ingest with respect to the data plan for your Sumo Logic subscription. @@ -100,6 +110,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[DPM](/docs/metrics/manage-metric-volume/data-limits-for-metrics)**. Stands for data points per minute. Metric data volume is measured in DPM. For example, a CPU metric reported on a single host every 15 seconds produces 4 DPM. +**[Dynamic Parsing](/docs/search/get-started-with-search/build-search/dynamic-parsing)**. A Sumo Logic feature that automatically extracts fields from JSON log messages at search time, without requiring manual parse rules. Also called Auto Parse — "Dynamic Parsing" is used in documentation and the API, while "Auto Parse" appears in the UI. + @@ -122,12 +134,18 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Fields](/docs/manage/fields)**. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields. +**[`fields` operator](/docs/search/search-query-language/search-operators/fields)**. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest. + **[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. **[Fingerprint](/docs/send-data/installed-collectors/configuration/#fingerprint)**. A fingerprint consists of the first 2048 bytes of a file and is used by installed collectors to track what data has been collected. +**[Flex Account](/docs/manage/manage-subscription/sumo-logic-flex-accounts)**. Sumo Logic's credit-based account packaging, available as Free, Trial, Essentials, or Enterprise Suite Flex. All Flex account types use [credits](/docs/manage/manage-subscription/sumo-logic-credits-accounts) as the unit of measure for data ingested, stored, and scanned. + **[Flow graph](/docs/integrations/amazon-aws/guardduty-benchmark)**. A graph or map that dynamically displays a directional flow from a source to a target. Such as the flow of cyber threats from the geographic locations of sources to their targets, dynamically illustrated in the Threat Sources and Targets by Geography panel of the [Amazon GuardDuty Global Baseline](/docs/integrations/amazon-aws/guardduty-benchmark) dashboard. +**[`formatDate` operator](/docs/search/search-query-language/search-operators/formatdate)**. A search operator that converts a timestamp in milliseconds to a human-readable date string in the format you specify, such as `yyyy-MM-dd` or `MM/dd/yyyy HH:mm:ss`. + ## G @@ -142,6 +160,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## H +**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. + **[Hash rules](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. **[Host Metrics](/docs/integrations/hosts-operating-systems/host-metrics)**. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP. @@ -183,12 +203,16 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. +**[Log Analysis Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Log Analysis Agent interprets intent, guides investigations, and surfaces relevant data from your logs through natural language. Formerly called the Query Agent. + **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. **[Logs-to-Metrics](/docs/metrics/logs-to-metrics)**. A Sumo Logic feature you can use to extract or create metrics from log data. You can extract metrics that are embedded in logs, or count logs as a metric. +**[Lookup Table](/docs/search/lookup-tables)**. A table of reference data hosted in Sumo Logic that you can join to log search results to enrich them with additional context — for example, mapping a user ID in a log to an email address, department, or other attribute stored in the table. + @@ -200,6 +224,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Mask rule](/docs/send-data/collection/processing-rules/mask-rules)**. Mask rules are a type of processing rule that replaces an expression with a mask string that you can customize—another option to protect data, such as passwords, that you wouldn't normally track. +**[MCP Server, Sumo Logic](/docs/api/mcp-server)**. A Sumo Logic service that lets MCP-compatible AI clients — such as Claude Code, developer IDEs, and enterprise AI platforms — connect to Sumo Logic using natural language to query logs, investigate Cloud SIEM insights, manage alerts, and more. + **[Messages tab](/docs/search/get-started-with-search/search-page/set-messages-tab-preferences)**. When you run a search query, messages display in the Messages tab in the lower half of the browser window of the Search page. **[Metadata](/docs/send-data/data-enrichment)**. Data about other data. If the logs and metrics you ingest have associated metadata, you can leverage it for more targeted log searches and metric queries. Metadata for metrics includes both intrinsic tags and meta tags. @@ -220,7 +246,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Microservices](/docs/integrations/app-development)**. The microservices architecture enables you to structure applications as collections of loosely coupled services that are fine-grained, with protocols that are lightweight. Building applications using different smaller services improves modularity and provides for the continuous delivery and deployment of large, complex applications. --> -**[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. It uses a suite of specialized agents to help you search, analyze, and learn about your data using natural language. +**[Mobot](/docs/search/mobot)**. Sumo Logic's AI assistant. Ask questions in natural language to search logs, investigate security insights, get platform guidance, and more. Mobot automatically routes questions to specialized agents based on your intent. **[Monitor](/docs/alerts/monitors/overview)**. An object you configure in Sumo Logic that tracks your metrics and logs data in real time and sends notifications when noteworthy changes happen in your production applications. A monitor checks for specific events of interest against a data source based on your conditions, then notifies you according to your preferences. @@ -249,12 +275,24 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[`parse` operator](/docs/search/search-query-language/parse-operators/parse-predictable-patterns-using-an-anchor)**. A search operator that extracts fields from strings. `parse` (also called `parse anchor`) uses literal start and stop anchors; `parse regex` (also called `extract`) uses a regular expression. +**[`parse json` operator](/docs/search/search-query-language/parse-operators/parse-json-formatted-logs)**. A search operator that extracts values from JSON-formatted log messages using JSONPath expressions. Supports single fields, multiple fields, nested keys, and array elements. + +**[`parse keyvalue` operator](/docs/search/search-query-language/parse-operators/parse-keyvalue-formatted-logs)**. A search operator that extracts values from key-value pair formatted log messages by specifying the key you want to retrieve. Also written as `keyvalue`. + +**[`parse nodrop` option](/docs/search/search-query-language/parse-operators/parse-nodrop-option)**. A parse option that forces results to include messages that do not match the parse expression. Without `nodrop`, non-matching messages are dropped from results. + +**[`parse regex` operator](/docs/search/search-query-language/parse-operators/parse-variable-patterns-using-regex)**. A search operator that uses regular expressions with named capturing groups to extract complex or nested fields from log messages. Also written as `extract`. + **[Parser](/docs/cse/schema/parser-editor)**. In Cloud SIEM, a script that parses logs and normalizes them into structured records. **[Partition](/docs/manage/partitions)**. Sumo Logic allows you to filter a subset of the messages in an index into a partition. Partitioning messages in an index improves search query performance, as the total number of messages that need to be searched is reduced. Once messages are routed to a partition, you can limit your search to those messages using the partition name in a search query. **[Pinned searches](/docs/get-started/library)**. The pinned search feature allows you to start a search, then “pin” it, so it will continue running in the background independent of the browser session. Then, you can close the Search tab or log out and find your results later in the Library on the Recent tab in a folder named Pinned Searches. +**[Platform Optimization Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Platform Optimization Agent answers how-to questions about Sumo Logic, helps troubleshoot issues, and helps users get more from the platform, drawing on official Sumo Logic documentation. Formerly called the Knowledge Agent. + +**[Playbook](/docs/platform-services/automation-service/playbooks)**. In the Automation Service, a predefined set of actions and conditional statements that run as an automated workflow in response to a security event or incident. Playbooks can run automatically without user intervention or in interactive mode, where a user must authorize specific actions. + **[Processing rules](/docs/send-data/collection/processing-rules)**. A Sumo Logic feature you can use to filter or forward log data ingested by Sumo Logic from a Sumo Logic source. You can use processing rules to include or exclude messages, and to mask or hash sensitive information in logs. You can also forward matching messages to external destinations, including AWS S3. **[Prometheus](/docs/send-data/collect-from-other-data-sources/collect-prometheus-metrics/)**. A metric format in which a time series is uniquely identified by its metric name and a set of labels in key-value pairs format. Sumo Logic’s [HTTP source](/docs/send-data/hosted-collectors/http-source) and [Streaming Metric source](/docs/send-data/installed-collectors/sources/streaming-metrics-source) support Prometheus metrics. Sumo Logic’s [Kubernetes solution](/docs/observability/kubernetes) also collects Prometheus metrics. @@ -262,7 +300,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## Q -**[Quantization](/docs/metrics/introduction/metric-quantization)**. The process by which Sumo Logic aggregates raw metric data points over a particular time bucket. Similar to “timeslice” in logs, Sumo Logic will automatically bucket your datapoints into quantization intervals based on the timerange of your search. For example, 5 second quantization intervals for a 15-minute search and 15 seconds for a 60-minute search. +**[Quantization](/docs/metrics/introduction/metric-quantization)**. The process by which Sumo Logic aggregates raw metric data points over a particular time bucket. Similar to “timeslice” in logs, Sumo Logic will automatically bucket your datapoints into quantization intervals based on the time range of your search. For example, 5 second quantization intervals for a 15-minute search and 15 seconds for a 60-minute search. **[`quantize` operator](/docs/metrics/metrics-operators/quantize/)**. A metrics operator that sets the size of the time buckets Sumo Logic aggregates metrics into, and the aggregation method for each bucket. It is the metrics-query counterpart of the `timeslice` search operator. @@ -275,6 +313,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[RBAC](/docs/manage/users-roles/roles/role-based-access-control/)**. Sumo Logic supports Role-Based Access Control (RBAC) to allow administrators to customize system access. With RBAC, administrators create roles for groups of users who perform various job functions. Users are not assigned permissions directly, but inherit permissions through roles (or even through a single role). Role assignments can grant users permissions to access some data sets, or can restrict users from accessing types of data. +**[Real User Monitoring (RUM)](/docs/apm/real-user-monitoring)**. A Sumo Logic APM capability that captures end-to-end user transactions directly in the browser using OpenTelemetry instrumentation. RUM records performance timings, rendering events, errors, and user cohort data so you can understand the quality of your web application experience. + **[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. **[Related insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, an insight that a related signal is attached to. @@ -289,7 +329,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Rollup tables](/docs/metrics/manage-metric-volume/metric-ingestion-and-storage)**. Metric data is stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data is retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months. -**[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, set of logic that creates signals based on information in incoming records. +**[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, a set of logic that fires on incoming records and creates signals when its conditions are met. Cloud SIEM includes six rule types: **Match** (fires on a single record match), **Threshold** (fires when a record matches a minimum number of times in a time window), **Chain** (fires on combinations of event types over a time window), **Aggregation** (fires when aggregation conditions are met), **First Seen** (fires when an entity exhibits a behavior for the first time), and **Outlier** (fires when entity behavior deviates from its established baseline). @@ -311,6 +351,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Signal](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, an indicator of an event of interest that fires when rule conditions are met. +**[SOC Analyst Agent](/docs/cse/get-started-with-cloud-siem/soc-analyst-agent)**. An AI-powered Cloud SIEM feature that automatically investigates security insights, delivers evidence-backed verdicts (malicious, suspicious, or benign), and surfaces key findings from triggered signals to help security analysts triage faster and reduce false-positive noise. + **[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. **[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. @@ -326,6 +368,8 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Throttling](/docs/manage/ingestion-volume/log-ingestion)**. Slows the rate of ingestion across all collectors in an account to not exceed the allowable rate. +**[Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence)**. A Sumo Logic feature that lets you ingest and query threat indicators — data points about known threats such as malicious IP addresses, file hashes, and hostnames — to enrich log searches and Cloud SIEM detections. Indicators come from Sumo Logic-managed sources or custom sources you configure. + **[Time Compare](/docs/search/time-compare)**. Time Compare uses the compare operator to compare current aggregated search results with aggregated data from a past time period. **[Time series](/docs/dashboards/panels#time-series-panel)**. A set of timestamped values of a specific measurement. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index a1685750563..c41b7c89d96 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -973,6 +973,12 @@ Use exclamation points to express excitement or encourage the user. Don't use th Use ellipses for truncation. Don’t use ellipses for placeholders or trailing off a sentence unless it is getting cut off. When truncating, think about which part of the string is most essential for the user. This may require truncating in the beginning, middle, or end of a string. +### Dashes + +**Em dash (—)**. Use sparingly. Insert the em dash symbol (—) directly — do not use a double hyphen (--) as a substitute. + +**En dash (–)**. Use for date and time ranges: "June 1–15", "9:00–5:00 pm". Insert the en dash symbol (–) directly. + ### Periods In the UI, avoid periods for single sentences on their own. Whenever there are two or more sentences, use periods at the end of each sentence. Separate sentences by one space, not two. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 1a930c6ed43..6b7930d0d06 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -13,6 +13,8 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Aggregates tab**. When referring to the Aggregates tab (where aggregate search results are displayed) the term Aggregates is capitalized. +**Aka**. Don't use. Write out "also known as" instead. + **Ampersand (&)**. Don't use for "and". Spell out. **Anomaly Detection**. Always capitalize. @@ -23,19 +25,23 @@ This word list gives the preferred spelling, capitalization, and punctuation for +## B + +**Backend**. One word. Don't use "back-end" (hyphenated) or "back end" (two words). + ## C -**Check box**. Check box is two words. Don't use checkbox. +**Checkbox**. One word. Don't use "check box" (two words). **Classic UI**. Use this term to clarify that you're talking about the legacy UI. **Click**. You click a UI element. Do not use "click on". -**Collector**. Lowercase. `collector`, `hosted collector`, and `installed collector` are descriptive terms, not product names, so they follow the same rule as "collecting events" or "data collection". Capitalize only in a literal UI label, such as the **Add Collector** button. +**Collector**. Lowercase. `collector`, `hosted collector`, and `installed collector` are descriptive terms, not product names, so they follow the same rule as "collecting events" or "data collection". Capitalize only in a literal UI label, such as the **Add Collector** button. Exception: **OpenTelemetry Collector** is a proper product name — always capitalize it. **Color palette**. Use the [official Sumo Logic color palette](https://sites.google.com/sumologic.com/sumo-logic-brand/color) when creating diagrams. -**Column**. When referring to a column in a dashboard, the term is not capitalized unless it's the only word in a line of UI (for example, in the Add to Dashboard dialog box "Column" is capitalized). The word "column" doesn't appear in the main dashboard UI. +**Column**. When referring to a column in a dashboard, the term is not capitalized unless it's the only word in a line of UI (for example, in the Add to Dashboard dialog box, "Column" is capitalized). The word "column" doesn't appear in the main dashboard UI. @@ -51,21 +57,15 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Drill down**. Drill down, as in a menu, or other filtering feature is two words, not one. -**Dropdown**. - * Use drop-down (Adjective). Example: Choose your favorite model from a *drop-down* menu. - * Use dropdown (Noun). Example: Select a source category from the *dropdown*. Do not use drop down (two words). - -:::info -If we are not clear on its usage, the term shouldn’t be used at all: Don't use 'drop-down'; use menu or list. We should keep our target audience in mind, that is, developers or engineers. For example, "Select a source from the list". Developers or Engineers already know they have to select the source from the dropdown only. -::: +**Dropdown**. Use "dropdown" (one word, no hyphen) as an adjective before a noun: "dropdown list," "dropdown menu." Don’t use it as a standalone noun. When possible, describe the action instead: "Select X from the list." Do not use "drop-down" (hyphenated) or "drop down" (two words). ## E -**E.g., i.e., and etc.,** These abbreviations are parenthetical, which means they take a comma after. [Avoid using these abbreviations](/docs/contributing/style-guide/#abbreviations). +**E.g., i.e., and etc.** Don't use these abbreviations. Use "for example" instead of "e.g.", "that is" instead of "i.e.", and avoid "etc." by listing items explicitly or using "such as." See [Abbreviations](/docs/contributing/style-guide/#abbreviations) in the style guide. **Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. -**Em dash**. We do not use this often, but if you need to use it, insert the em dash symbol (—), do not use a double hyphen (–). +**Em dash** and **en dash**. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. **Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. @@ -106,6 +106,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use **Library**. The Sumo Logic Library (formerly the Content Library) is now just the Library. Capitalize. +**Lifecycle**. One word. Don't use "life cycle" (two words) or "life-cycle" (hyphenated). + **Login vs Log In**. Login as one word is a _noun_ or an _adjective_. Log in as two words is a _verb_. For example, "You can log in on the login page." @@ -119,6 +121,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use **Messages tab**. When referring to the Messages tab (where non-aggregate search results are displayed) the term Messages is capitalized. +**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. + **Multiline**. Should be one word, not two, or hyphenated. @@ -151,6 +155,8 @@ If we are not clear on its usage, the term shouldn’t be used at all: Don't use ## R +**Real time / real-time**. Two words as a noun: "Data updates in real time." Hyphenate as an adjective before a noun: "real-time alerts," "real-time dashboard." + **Repo**. Short for repository. No need to spell out repository as our audience is technical enough for this to be clear. @@ -201,6 +207,8 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Time slice**. Time slice is two words, not one. +**Timeout**. One word, no hyphen, whether used as a noun or adjective. Don't use "time-out" or "time out." + **Timestamp**. Timestamp is one word. **Time zone**. Time zone is two words, not one. From fa2ca41f5791f7009e7f406f4f4e62b249a6e019 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 07:04:46 -0700 Subject: [PATCH 03/14] DOCS-482 - Restore original em dash word list entry; remove personal em dash preference from sumo-style skill Co-Authored-By: Claude Sonnet 4.6 --- .claude/skills/sumo-style/SKILL.md | 1 - docs/contributing/style-guide.md | 6 ------ docs/contributing/word-list.md | 2 +- 3 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.claude/skills/sumo-style/SKILL.md b/.claude/skills/sumo-style/SKILL.md index 3d113e8158f..064231f3c50 100644 --- a/.claude/skills/sumo-style/SKILL.md +++ b/.claude/skills/sumo-style/SKILL.md @@ -208,7 +208,6 @@ Fetch the full list at https://www.sumologic.com/help/docs/contributing/word-lis These are Sumo Logic- and repo-specific facts that override general assumptions. -- **No em dashes, ever.** Do not use "--" as a substitution for an em dash either. Rewrite the sentence instead. - **Site URL is `sumologic.com/help`**, not `help.sumologic.com`. Always use the former in docs and links. - **`:::training` is a custom Sumo Logic admonition** (purple, graduation cap icon). It is not a standard Docusaurus admonition -- do not treat it like one or omit it. - **`:::sumo` is also custom.** Standard Docusaurus will not recognize it outside this repo. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index c41b7c89d96..a1685750563 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -973,12 +973,6 @@ Use exclamation points to express excitement or encourage the user. Don't use th Use ellipses for truncation. Don’t use ellipses for placeholders or trailing off a sentence unless it is getting cut off. When truncating, think about which part of the string is most essential for the user. This may require truncating in the beginning, middle, or end of a string. -### Dashes - -**Em dash (—)**. Use sparingly. Insert the em dash symbol (—) directly — do not use a double hyphen (--) as a substitute. - -**En dash (–)**. Use for date and time ranges: "June 1–15", "9:00–5:00 pm". Insert the en dash symbol (–) directly. - ### Periods In the UI, avoid periods for single sentences on their own. Whenever there are two or more sentences, use periods at the end of each sentence. Separate sentences by one space, not two. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 6b7930d0d06..74c2da5e05f 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -65,7 +65,7 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. -**Em dash** and **en dash**. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. +**Em dash**. We do not use this often, but if you need to use it, insert the em dash symbol (—), do not use a double hyphen (–). **Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. From cb604168f4b27a69f4439947c85defab10a9c030 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Wed, 2 Sep 2026 07:12:29 -0700 Subject: [PATCH 04/14] DOCS-482 - Add Accessibility section to style guide Co-Authored-By: Claude Sonnet 4.6 --- docs/contributing/style-guide.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index a1685750563..b619632d4cf 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -184,6 +184,35 @@ Subject matter expert guidance, best practices, and Sumo Logic-specific notes. R Links to training courses, certifications, and micro lessons. ::: +## Accessibility + +Sumo Logic documentation follows [WCAG 2.1 AA](https://www.w3.org/TR/WCAG21/) as its accessibility baseline. + +For **alt text** guidance, see [Images](#images). For **link text** (avoid "click here"), see [Links](#links). For **ableist and non-inclusive language**, see [Inclusive language](#inclusive-language). + +### Heading hierarchy + +Don't skip heading levels. Screen readers and keyboard users navigate by headings, and a broken hierarchy makes content harder to scan. + +**Do:** move through levels in order — H2 → H3 → H4. + +**Don't:** jump from H2 to H4, or use headings for visual styling rather than document structure. + +### Color and contrast + +Don't rely on color alone to convey meaning. Users with color blindness or high-contrast display modes may not perceive color differences. + +- If a screenshot or diagram uses color to highlight something, add a label, callout, or annotation so the meaning is clear without color. +- For custom diagrams or graphics, use a text contrast ratio of at least 4.5:1 (WCAG AA). Check with the [WebAIM Contrast Checker](https://webaim.org/resources/contrastchecker/) or [TPGi's Colour Contrast Analyser](https://www.tpgi.com/color-contrast-checker/). + +### Screen reader testing + +Before submitting a PR for a new doc, consider a quick screen reader check to catch heading, link, and table issues: + +- **macOS**: VoiceOver — press **Command+F5** to toggle. +- **Windows**: [NVDA](https://www.nvaccess.org/) (free) or Narrator (**Windows+Ctrl+Enter**). +- **Chrome**: [ChromeVox](https://chrome.google.com/webstore/detail/screen-reader/kgejglhpjiefppelpmljglcjbhoiplfn) extension. + ## Capitalization * Title case all doc titles. Example: `Cloud SOAR Incident Management and Triage`. From d1c8be4dad62570670eec32d00b84e573cf28ac3 Mon Sep 17 00:00:00 2001 From: "Kim (Sumo Logic)" <56411016+kimsauce@users.noreply.github.com> Date: Wed, 2 Sep 2026 08:43:26 -0700 Subject: [PATCH 05/14] Update SKILL.md --- .claude/skills/sumo-style/SKILL.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.claude/skills/sumo-style/SKILL.md b/.claude/skills/sumo-style/SKILL.md index 064231f3c50..3d113e8158f 100644 --- a/.claude/skills/sumo-style/SKILL.md +++ b/.claude/skills/sumo-style/SKILL.md @@ -208,6 +208,7 @@ Fetch the full list at https://www.sumologic.com/help/docs/contributing/word-lis These are Sumo Logic- and repo-specific facts that override general assumptions. +- **No em dashes, ever.** Do not use "--" as a substitution for an em dash either. Rewrite the sentence instead. - **Site URL is `sumologic.com/help`**, not `help.sumologic.com`. Always use the former in docs and links. - **`:::training` is a custom Sumo Logic admonition** (purple, graduation cap icon). It is not a standard Docusaurus admonition -- do not treat it like one or omit it. - **`:::sumo` is also custom.** Standard Docusaurus will not recognize it outside this repo. From e399f7ba5466b1804bb5ff9947da49178741c9ca Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Thu, 10 Sep 2026 17:22:51 -0700 Subject: [PATCH 06/14] sort word list/glossary changes --- docs/contributing/glossary.md | 18 +++++++++--------- docs/contributing/word-list.md | 10 +++++----- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index e09ef751932..309a9005f86 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -29,7 +29,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Aggregate](/docs/search/search-query-language/group-aggregate-operators)**. A group of data returned by a search, displayed in a simple table in the Aggregates tab of the Search page. -**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when trigger conditions — critical, warning, or missing data — are satisfied, and it includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. +**[Alert](/docs/alerts)**. A notification triggered when a monitoring condition is met. In [monitors](/docs/alerts/monitors/overview), an alert is created when critical, warning, or missing data trigger conditions are satisfied. It includes contextual information to help investigate the issue. In [scheduled searches](/docs/alerts/scheduled-searches/schedule-search), alert types include Email, Script Action, ServiceNow Connection, Webhook, and Save to Index. **[Allowlist](/docs/manage/security/create-allowlist-ip-cidr-addresses)**. A list of IP addresses or CIDR ranges that are explicitly granted access to logins, APIs, and dashboards. Configured on the **Service Allowlist Settings** tab in Account Security Settings. @@ -92,7 +92,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Data Forwarding](/docs/manage/data-forwarding)**. When enabled, the Data Forwarding feature allows Sumo Logic to upload data to an Amazon S3 bucket that belongs to your organization. Log messages are saved as CSV files in compressed gzip files. They are accumulated and returned right after being ingested by Sumo Logic. -**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers — Continuous, Frequent, or Infrequent — based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. +**[Data Tiers](/docs/manage/partitions/data-tiers)**. A Sumo Logic feature that lets you allocate log data to one of three storage tiers (Continuous, Frequent, or Infrequent) based on how often you need to access it. All data defaults to the Continuous tier; only data stored in partitions can be assigned to the Frequent or Infrequent tier. **[Data type](/docs/get-started/faq)**. A data type is a specific type of log used with a Sumo Logic source or app, such as Apache, MySQL, or Windows IIS. You can also use a custom data type for a custom application. @@ -100,7 +100,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Deployment](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created. -**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record — for example, an IP and hostname in the same log message — even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. +**[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record, such as an IP address and hostname in the same log message, even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. @@ -160,10 +160,10 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## H -**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. - **[Hash rules](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. +**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. + **[Host Metrics](/docs/integrations/hosts-operating-systems/host-metrics)**. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP. **[Hosted collectors](/docs/send-data/hosted-collectors)**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. @@ -201,14 +201,14 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Local configuration file management](/docs/send-data/use-json-configure-sources/local-configuration-file-management)**. Local configuration file management allows you to set up and manage sources on an installed collector using one or more JSON files. -**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. - **[Log Analysis Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Log Analysis Agent interprets intent, guides investigations, and surfaces relevant data from your logs through natural language. Formerly called the Query Agent. **[LogCompare](/docs/search/behavior-insights/logcompare)**. LogCompare allows you to compare a section of your log messages from one point in time with the same section at another point in time, and display the changes in patterns. **[LogReduce](/docs/search/behavior-insights/logreduce)**. LogReduce uses fuzzy logic to cluster messages together based on string and pattern similarity. Use the LogReduce button and operator to quickly assess activity patterns for things like a range of devices or traffic on a website. +**[Logs for Security](/docs/security/additional-security-features)**. Sumo Logic's full set of features that leverage logs for security use cases, including pre-built dashboards, out-of-the-box security apps, and robust query capabilities for analyzing security log and event data. + **[Logs-to-Metrics](/docs/metrics/logs-to-metrics)**. A Sumo Logic feature you can use to extract or create metrics from log data. You can extract metrics that are embedded in logs, or count logs as a metric. **[Lookup Table](/docs/search/lookup-tables)**. A table of reference data hosted in Sumo Logic that you can join to log search results to enrich them with additional context. For example, you can map a user ID in a log to an email address, department, or other attribute stored in the table. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 3fe6a999537..2f55fd339db 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -113,6 +113,8 @@ This word list gives the preferred spelling, capitalization, and punctuation for ## M +**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. + **Markdown**. Always capitalize. It's a proper noun (the name of the markup language). **MB and Mbit.** MB is the acronym for megabytes. Mbit or Mb is the acronym for megabits. Make sure to capitalize correctly. Don't use a space between the acronym and the number. (Example: 10MB or 15Mbit.) @@ -121,8 +123,6 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Messages tab**. When referring to the Messages tab (where non-aggregate search results are displayed) the term Messages is capitalized. -**Manipulate**. Avoid. Use "work with," "handle," or "use" instead. - **Multiline**. Should be one word, not two, or hyphenated. From 086af0372a8daaf4914c83b3504b663d0b9c449b Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 13:43:55 -0700 Subject: [PATCH 08/14] DOCS-482 - Add Concise, human phrasing and Dashes sections to style guide Adds the style guide sections requested in PR review: a Concise, human phrasing subsection under Voice and tone, and a Dashes subsection under Punctuation. Updates the word list's Em dash entry and adds an En dash entry, both pointing to the new Dashes section. Co-Authored-By: Claude Sonnet 5 --- docs/contributing/style-guide.md | 18 ++++++++++++++++++ docs/contributing/word-list.md | 4 +++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index b619632d4cf..c3917a59b3a 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -115,6 +115,16 @@ By writing inclusively and using culturally neutral language, our words resonate |:---------------|:-------------------| | "allowlist"
"denylist"
"placeholder data"
"primary" or "main"
"press" or "click" | "whitelist"
"blacklist"
"dummy data"
"master"
"hit" | +### Concise, human phrasing + +Write the way a knowledgeable colleague would explain something in person. Cut anything that does not carry information. This also keeps our docs from reading like generic AI output. + +* **No throat-clearing.** Start with the point. Drop preambles like "It's worth noting that", "It's important to understand", and "In this section, we will". +* **No filler.** Cut "simply", "just", "of course", "as you can see", "needless to say", and intensifiers like "very", "really", and "quite". +* **Do not restate.** Skip summary sentences that repeat what the paragraph, list, or procedure just said. +* **One idea per sentence.** Prefer short sentences over long ones stitched together with "and", "which", or semicolons. +* **Say it once.** When two sentences make the same point, keep the clearer one and delete the other. + ## Abbreviations Avoid the use of abbreviations like “e.g.”, “i.e.”, and “etc.”. Although they may be well understood, such abbreviations don’t support our goal of a conversational tone. In other words, don’t use language you wouldn’t use verbally. @@ -994,6 +1004,14 @@ Colons are used to introduce lists or to separate titles from subtitles. Only in We use the Oxford (serial) comma. For example, use "I had eggs, toast, and orange juice", not "[I had eggs, toast and orange juice](https://www.verbicidemagazine.com/wp-content/uploads/2012/01/why-i-still-use-the-oxford-comma.jpg)". +### Dashes + +Try not to use em dashes (the long dash) as they read as generic AI output. Rewrite instead: use a period or semicolon to split two independent clauses, a colon to introduce something, or commas or parentheses for a brief aside. + +Use the en dash (–) only for numeric and date ranges, with no space on either side: `9–17`, `2023–2024`. See [Numbers](#numbers) and [Dates](#dates). + +Use the hyphen (-) for compound modifiers, such as `drop-down menu` or `read-only field`. + ### Exclamation points Use exclamation points to express excitement or encourage the user. Don't use them for errors, warnings, or confirmation of basic actions as they are usually unnecessary and can distract from important details. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 2f55fd339db..875b09bda12 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -65,7 +65,9 @@ This word list gives the preferred spelling, capitalization, and punctuation for **Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. -**Em dash**. We do not use this often, but if you need to use it, insert the em dash symbol (—), do not use a double hyphen (–). +**Em dash**. Avoid em dashes (—). See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. + +**En dash**. Use the en dash (–) only for numeric and date ranges. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. **Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. From fa0503e2c077544bb55419a053b4ab636aaeb120 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 18:17:28 -0700 Subject: [PATCH 09/14] DOCS-482 - Restructure Voice and tone, refresh trademark list Splits the Voice and tone catch-all into focused, alphabetized subsections (Avoid hype, Concise writing, Conversational voice, How-to instructions, Inclusive language, Plain language, Tone by situation) so a rule can be found by name instead of by guessing an abstract category. Cleans up remaining em dashes and negative contractions against the guide's own rules, and adds a rationale for the British-style punctuation-outside-quotes rule. Verifies the Patents and trademarks list against USPTO filings, drops abandoned marks, adds currently registered ones, and adds a matching trademark notice to the site footer. Fixes two remaining glossary alphabetization slips (Suppressed signal, Threat Intelligence). Co-Authored-By: Claude Sonnet 5 --- docs/contributing/glossary.md | 8 +- docs/contributing/style-guide.md | 200 ++++++++++++++++++------------- docusaurus.config.js | 2 +- 3 files changed, 124 insertions(+), 86 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index 41e064f73cd..d8d055a5a62 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -355,21 +355,21 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. -**[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. - **[Subqueries](/docs/search/subqueries)**. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query. **[Support account](/docs/manage/security/enable-support-account)**. A support account is a special Sumo Logic user account that you can enable so that Sumo Logic support personnel can access your Sumo Logic org. Typically, you enable your support account for a limited period of time, just long enough to allow Sumo Logic support to diagnose a problem or answer a question. +**[Suppressed signal](/docs/cse/records-signals-entities-insights/about-signal-suppression)**. In Cloud SIEM, a signal that the insight algorithm excludes from the insight generation process. A suppressed signal does not contribute to or become part of an insight. By default, signals are automatically suppressed for 72 hours. -## T -**[Throttling](/docs/manage/ingestion-volume/log-ingestion)**. Slows the rate of ingestion across all collectors in an account to not exceed the allowable rate. +## T **[Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence)**. A Sumo Logic feature that lets you ingest and query threat indicators to enrich log searches and Cloud SIEM detections. Threat indicators are data points about known threats, such as malicious IP addresses, file hashes, and hostnames. Indicators come from Sumo Logic-managed sources or custom sources you configure. +**[Throttling](/docs/manage/ingestion-volume/log-ingestion)**. Slows the rate of ingestion across all collectors in an account to not exceed the allowable rate. + **[Time Compare](/docs/search/time-compare)**. Time Compare uses the compare operator to compare current aggregated search results with aggregated data from a past time period. **[Time series](/docs/dashboards/panels#time-series-panel)**. A set of timestamped values of a specific measurement. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index c3917a59b3a..89bc9565694 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -17,22 +17,22 @@ import TabItem from '@theme/TabItem'; This is the editorial style guide for Sumo Logic documentation. Use it to keep docs consistent in voice, tone, terminology, and formatting, whether you're on the Docs Team or contributing from outside. -Our docs are built with [Docusaurus](https://docusaurus.io/), a static site generator, and written in GitHub-flavored Markdown. This is a living document: if a rule or UI term you need isn't here, let us know and we'll add it. +Our docs are built with [Docusaurus](https://docusaurus.io/), a static site generator, and written in GitHub-flavored Markdown. This is a living document: if a rule or UI term you need is not here, let us know and we'll add it. :::tip To create a new doc quickly, use a [template](/docs/contributing/templates). Copy the file, add your content, and submit a PR. The Docs Team reviews submissions, suggests edits, adds new content to the navigation, and answers your questions. -If you have Claude Code installed, this repo's `sumo-style` skill applies these conventions automatically when you draft or edit docs, so you don't need to invoke it manually. See AGENTS.md for details. +If you have Claude Code installed, this repo's `sumo-style` skill applies these conventions automatically when you draft or edit docs, so you do not need to invoke it manually. See AGENTS.md for details. ::: ## Style references -This guide comes first. When it doesn't cover something, defer to these, in order of precedence: +This guide comes first. When it does not cover something, defer to these, in order of precedence: 1. _Sumo Logic Brand Guidelines_. Brand Voice and Writing Style Guide. Voice, tone, and brand terms. 1. [_Microsoft Manual of Style_](https://docs.microsoft.com/en-us/style-guide/welcome/). UI, procedures, and technical formatting. See also [User Input | Formatting Text in Instructions](https://docs.microsoft.com/en-us/style-guide/procedures-instructions/formatting-text-in-instructions). 1. [_AP Stylebook_](https://www.apstylebook.com/). General usage. -1. [_The Chicago Manual of Style_](https://www.chicagomanualofstyle.org/home.html). Anything the above don't settle. +1. [_The Chicago Manual of Style_](https://www.chicagomanualofstyle.org/home.html). Anything the above do not settle. 1. [_Merriam-Webster Dictionary_](https://www.merriam-webster.com/). Spelling and hyphenation. For terminology usage guidance, see our [Word List](/docs/contributing/word-list). @@ -51,24 +51,61 @@ Helpful blogs on tech writing: ## Voice and tone -* **Clarity and professionalism**. We are clear, genuine, and trustworthy. We understand that our customers entrust us with their vital data and never make light about our commitment to data access and security. -* **Engagement and assistance**. The reader should feel confident and informed. We should strive to engage our customers and show them where to get additional assistance when needed. -* **Professional description**. Describe Sumo Logic in a professional and truthful manner. Avoid generic, unsubstantial adjectives like "very" or phrases like "we're the best". Instead, illustrate these points by letting our product speak for itself. -* **Conversational tone**. Avoid using a stiff, institutional voice. Instead, write with an instructive and conversational tone, using the sort of words that you would use in a face-to-face conversation. For example, when linking to the support site, use terms like "Need help? Let us know" instead of "Please email our support personnel" to give our company a friendly face. -* **Reader address**. Address the reader as "you", as you would in conversation. For example, instead of saying, "The user must provide his or her API key" or "One must provide their API key", say, "You'll need to provide your API key". -* **Readability and SEO**. Instructional content and blog posts should be written at approximately the 8th-grade reading level, particularly in introductory sections, for readability and SEO. You can test your content [here](http://www.writingtester.com). -* **First paragraph**. Open every page by telling the reader what it covers, why it matters, and who it's for. In a tutorial, also say which step or stage the page is. See [AEO](#aeo-answer-engine-optimization) for how this helps search and AI answers. -* **Brand guidelines**. Our brand guideline is to always refer to “Sumo Logic”, rather than Sumo. To be more conversational, it is also fine to say “we”. -* **Gentle Language**. Use “need to” instead of “have to” or “must”. “Have to” and “must” can sound harsh and unfriendly. -* **Judicious use of absolutes**. Be judicious in use of “always” and “never”. Sometimes it’s appropriate to say “always” or “never”. Keep in mind though that “always” can imply a result that is not guaranteed, and “never” may very well not be the case — the exception makes the rule. -* **Error messaging**. When explaining a process or procedure, clarity is critical. Edit words that distract or confuse. Put yourself into the reader's shoes and think about what actions you recommend to them when an error message is displayed, rather than merely stating what went wrong. Example: "Could not create the user." vs "This email is already registered in the system. Use a different email, or contact Sumo Logic for assistance." -* **Humor**. We have a sense of humor! Conveying that we do serious work, but we do not take ourselves too seriously, makes Sumo Logic feel likable. +We write like a knowledgeable colleague who explains things clearly and helps you get your work done: genuine and trustworthy. Readers should leave a page feeling confident and informed, with what they need to stay in their workflow and a clear place to get more help. -### Active voice +Customers trust us with their vital data. We're committed to data observability and security. Write in a way that earns that trust. -When writing instructions, use the active voice whenever possible. This example below gives a call to action for the reader or user to effectively get something done. It also reduces word count and keeps instructions clear. +Three rules underpin everything below: accuracy, brevity, and clarity. -#### General statements +### Avoid hype + +* **Reader benefit**. Lead with what the reader gains. Avoid generic adjectives like "very" and phrases like "we're the best". Show what the product does instead. +* **Honest claims**. Do not overpromise. Describe what the product does, not what it might do at its best. When something does not work as expected, say so and tell the reader how to get it right. For example: + | ✅ **Do** | ❌ **Don't** | + |:---------------|:-------------------| + | Reduce thousands of log messages to a few patterns with LogReduce. | LogReduce is a very powerful, best-in-class feature. | +* **Judicious use of absolutes**. Use "always" and "never" only when they are true. "Always" can imply a result that is not guaranteed, and "never" may not hold in every case. + +#### Timeless documentation + +Docs content needs to be evergreen. Avoid words that anchor a sentence to the moment you wrote it, like "now", "currently", "at this time", or "soon". Write as if there is no publish date, and describe what the product does, not when it started doing it. + +| ✅ **Do** | ❌ **Don't** | +|:---------------|:-------------------| +| Sumo Logic supports AWS CloudTrail as a log source. | Sumo Logic now supports AWS CloudTrail as a log source. | +| This field is required. | In the future, this field will be required. | + +Release notes and other time-stamped content are the exception. Words like "now", "new", and forward-looking phrases like "coming in a future release" are fine there. That's the point of a release note. + +### Concise writing + +Avoid long-winded passages. Cut anything that does not carry information. This also keeps our docs from reading like verbose AI output. + +* **No throat-clearing or filler**. Start with the point, and cut words that add nothing. Drop preambles like "It should be noted that" and "It's important to understand", and cut words like "simply", "just", "of course", "as you can see", "needless to say", "very", "really", and "quite". +* **No restating**. Skip summary sentences that repeat what the paragraph, list, or procedure just said. +* **One idea per sentence**. Prefer short sentences over long ones stitched together with "and", "which", or semicolons. +* **Say it once**. When two sentences make the same point, keep the clearer one and delete the other. +* **One path**. Document the best path forward, not every possible path forward. + +### Conversational voice + +Write in an instructive, conversational voice, using the words you would use in a face-to-face conversation. Avoid a stiff, institutional voice. + +* **Second person**. Address the reader as "you", as you would in conversation. + | ✅ **Do** | ❌ **Don't** | + |:---------------|:-------------------| + | You'll need to provide your API key. | One must provide their API key. | +* **Friendly help**. When linking to the support site, use phrases like "Need help? Let us know" instead of "Please email our support personnel". +* **Humor**. We have a sense of humor! We do serious work, but we do not take ourselves too seriously. That makes Sumo Logic feel likable. +* **Gentle language**. Use "need to" instead of "have to" or "must". "Have to" and "must" can sound harsh and unfriendly. + +### How-to instructions + +#### Active voice + +Use the active voice whenever possible. It gives the reader a clear call to action, reduces word count, and keeps instructions clear. + +Not sure if a sentence is passive? Try the zombie test: add "by zombies" after the verb. If the sentence still makes sense, it's passive. For example, "The query was saved (by zombies)" is passive. "You saved the query (by zombies)" is not. | ✅ **Do** | ❌ **Don't** | |:---------------|:-------------------| @@ -76,7 +113,7 @@ When writing instructions, use the active voice whenever possible. This example #### Task directives -We need them to complete a task. No need for please. +Skip "please" in instructions. The reader needs to complete the task, and "please" adds words without adding information. | ✅ **Do** | ❌ **Don't** | |:---------------|:-------------------| @@ -84,46 +121,49 @@ We need them to complete a task. No need for please. #### Instruction introduction (stem) -Introduce your instructions with the goal, then dive into the instructions. This is called a stem, and it helps focus the task and keeps you active: +Introduce your instructions with the goal, then list the steps. This is called a stem. It focuses the task and keeps your writing active. | ✅ **Do** | ❌ **Don't** | |:---------------|:-------------------| -| To add a new collector:
1. Access Sumo Logic and find the... | When you need to add a new collector, access Sumo Logic and find the... | - -### Inclusive language +| To add a new collector:

1. Access Sumo Logic and find the... | When you need to add a new collector, access Sumo Logic and find the... | -By writing inclusively and using culturally neutral language, our words resonate with global audiences and make everyone feel welcome, no matter their race, gender, socioeconomic status, and ability. +#### Conditional statements -#### Avoid Regional Language +Start with the condition. When a step begins with "if", readers know right away whether it applies to them. -* Do not use idioms, slang, expressions, or terminology only understood by a specific region or group. - -#### Simplify Language - -* Avoid overly technical jargon. -* Don’t use words just because they sound better. Choose short, simple words over long and complicated ones. +| ✅ **Do** | ❌ **Don't** | +|:---------------|:-------------------| +| If you use an Installed Collector, restart it. | Restart the collector if you use an Installed Collector. | -#### Gender Neutrality +### Inclusive language -* Unless you're referring to a specific person, do not use gender pronouns (he/she). +Inclusive, culturally neutral language resonates with global audiences and makes everyone feel welcome, no matter their race, gender, socioeconomic status, or ability. For approved terms, see the [Word List](/docs/contributing/word-list). -#### Cultural Neutrality +* **Regional language**. Do not use idioms, slang, expressions, or terms only a specific region or group understands. Phrases like "piece of cake" or "jump on the bandwagon" do not translate well and can confuse global audiences. Some idioms can also offend marginalized groups. Say what you mean directly. +* **Gender neutrality**. Unless you're referring to a specific person, use "they" or the person's role instead of gendered pronouns. For example: + | ✅ **Do** | ❌ **Don't** | + |:---------------|:-------------------| + | Contact your administrator. They may need to update your role. | Contact your administrator. He or she may need to update your role. | +* **Cultural neutrality**. Replace terms that carry negative connotations with culturally neutral ones. For example: + | ✅ **Do** | ❌ **Don't** | + |:---------------|:-------------------| + | "allowlist"
"denylist"
"placeholder data"
"primary" or "main"
"press" or "click" | "whitelist"
"blacklist"
"dummy data"
"master"
"hit" | -* Use culturally neutral terms to replace terms with negative connotations. For example: +### Plain language -| ✅ **Do** | ❌ **Don't** | -|:---------------|:-------------------| -| "allowlist"
"denylist"
"placeholder data"
"primary" or "main"
"press" or "click" | "whitelist"
"blacklist"
"dummy data"
"master"
"hit" | +* **Readability**. Write at about an eighth-grade reading level, especially in introductions. This helps readability and SEO. You can check your content with [Writing Tester](http://www.writingtester.com). +* **Simple words**. Avoid unnecessary technical jargon. Do not use words just because they sound better. Choose short, simple words over long, complicated ones. -### Concise, human phrasing +### Tone by situation -Write the way a knowledgeable colleague would explain something in person. Cut anything that does not carry information. This also keeps our docs from reading like generic AI output. +Our company voice stays the same on every page. Our tone adapts to the reader's frame of mind. Many readers arrive at our docs in the middle of an incident. -* **No throat-clearing.** Start with the point. Drop preambles like "It's worth noting that", "It's important to understand", and "In this section, we will". -* **No filler.** Cut "simply", "just", "of course", "as you can see", "needless to say", and intensifiers like "very", "really", and "quite". -* **Do not restate.** Skip summary sentences that repeat what the paragraph, list, or procedure just said. -* **One idea per sentence.** Prefer short sentences over long ones stitched together with "and", "which", or semicolons. -* **Say it once.** When two sentences make the same point, keep the clearer one and delete the other. +| Doc type | Reader situation | Tone | +|:---------|:------------------|:-----| +| Troubleshooting | An error or outage | Calm and direct. Acknowledge the problem, then give the next step. | +| Concept | Learning a new concept or feature | Patient. Walk through ideas in order and point to related resources. | +| How-to | Setting up or configuring | Efficient. Give the steps and skip the background. | +| Reference | Looking up an API, operator, or field | Neutral and scannable. Get to the answer fast, no narrative. | ## Abbreviations @@ -139,7 +179,7 @@ Avoid the use of abbreviations like “e.g.”, “i.e.”, and “etc.”. Alth ## Acronyms -An acronym uses the first initials of a word or phrase, for brevity. Our industry is full of them, and they can get confusing if their usage isn't clear. Acronyms should be capitalized, if not used directly in a query. Unless the usage is clear from the context, for the first usage, spell out the phrase, then present the acronym in parenthesis. +An acronym uses the first initials of a word or phrase, for brevity. Our industry is full of them, and they can get confusing if their usage is not clear. Acronyms should be capitalized, if not used directly in a query. Unless the usage is clear from the context, for the first usage, spell out the phrase, then present the acronym in parenthesis. For example, if you're writing a doc about AWS Application Load Balancer, say `AWS Application Load Balancer (ALB)` on first reference, and for the rest of the doc, use `ALB`. @@ -202,15 +242,15 @@ For **alt text** guidance, see [Images](#images). For **link text** (avoid "clic ### Heading hierarchy -Don't skip heading levels. Screen readers and keyboard users navigate by headings, and a broken hierarchy makes content harder to scan. +Do not skip heading levels. Screen readers and keyboard users navigate by headings, and a broken hierarchy makes content harder to scan. -**Do:** move through levels in order — H2 → H3 → H4. +**Do:** move through levels in order: H2 → H3 → H4. -**Don't:** jump from H2 to H4, or use headings for visual styling rather than document structure. +**Do not:** jump from H2 to H4, or use headings for visual styling rather than document structure. ### Color and contrast -Don't rely on color alone to convey meaning. Users with color blindness or high-contrast display modes may not perceive color differences. +Do not rely on color alone to convey meaning. Users with color blindness or high-contrast display modes may not perceive color differences. - If a screenshot or diagram uses color to highlight something, add a label, callout, or annotation so the meaning is clear without color. - For custom diagrams or graphics, use a text contrast ratio of at least 4.5:1 (WCAG AA). Check with the [WebAIM Contrast Checker](https://webaim.org/resources/contrastchecker/) or [TPGi's Colour Contrast Analyser](https://www.tpgi.com/color-contrast-checker/). @@ -219,7 +259,7 @@ Don't rely on color alone to convey meaning. Users with color blindness or high- Before submitting a PR for a new doc, consider a quick screen reader check to catch heading, link, and table issues: -- **macOS**: VoiceOver — press **Command+F5** to toggle. +- **macOS**: VoiceOver. Press **Command+F5** to toggle. - **Windows**: [NVDA](https://www.nvaccess.org/) (free) or Narrator (**Windows+Ctrl+Enter**). - **Chrome**: [ChromeVox](https://chrome.google.com/webstore/detail/screen-reader/kgejglhpjiefppelpmljglcjbhoiplfn) extension. @@ -227,7 +267,7 @@ Before submitting a PR for a new doc, consider a quick screen reader check to ca * Title case all doc titles. Example: `Cloud SOAR Incident Management and Triage`. * Sentence case all other headers (H2, H3, H4). The only exception is proper nouns, which are always title case. Example: `Throughput signals and contributing factors`. -* In body text, don't capitalize a term unless it's a proper noun or a literal UI label. Generic product terms are lowercase: collector, source, dashboard, panel, index, partition, role, scheduled view, alert, search. +* In body text, do not capitalize a term unless it's a proper noun or a literal UI label. Generic product terms are lowercase: collector, source, dashboard, panel, index, partition, role, scheduled view, alert, search. * **UI label vs. concept.** When you name a UI element or page as it appears on screen, match its on-screen capitalization and bold the label: the **Search** page, the **Scheduled Views** page, the **Aggregates** tab. When you mean the same thing as a general feature or concept, use lowercase and no bold: "scheduled views let you pre-aggregate data", "run a search". The generic word (`page`, `tab`, `button`) is always lowercase. See [Bold](#bold). * Always capitalized: proper nouns and product names (Sumo Logic, Cloud SIEM, Cloud SOAR, Kubernetes, Markdown, RBAC), and named UI areas when used as labels (the **Library**, the **Search** page, **Admin mode**). * **Feature names vs. use cases.** Coined or proper feature names stay capitalized (LogReduce, LogCompare, Cloud SIEM, Cloud SOAR, Automation Service). Generic capabilities and use cases are lowercase: security data lake, threat detection and investigation, audit and compliance, application security, observability, continuous intelligence. Marketing keeps a [product and feature name matrix](https://docs.google.com/spreadsheets/d/1U2yPSasgHHzQYXvCzfvEXfIM2t6ofBfW8DYEZLrtj2s/) for edge cases. @@ -349,9 +389,9 @@ Use **bold** for the name of a UI element the reader interacts with or navigates Bold only the label itself. The generic word that follows it (`button`, `tab`, `menu`, `dialog`, `field`, `page`, `pane`) stays outside the bold and lowercase: the **Search** page, not **Search page** or the **Search Page**. -**UI label vs. concept.** Bold and match the on-screen capitalization only when you're pointing to the UI control. When you're describing the feature or concept, don't bold it, and lowercase it. Write "A scheduled view is a pre-aggregated index of your data" (concept), but "Open the **Scheduled Views** page" (UI label). Capitalization follows the same split (see [Capitalization](#capitalization)). +**UI label vs. concept.** Bold and match the on-screen capitalization only when you're pointing to the UI control. When you're describing the feature or concept, do not bold it, and lowercase it. Write "A scheduled view is a pre-aggregated index of your data" (concept), but "Open the **Scheduled Views** page" (UI label). Capitalization follows the same split (see [Capitalization](#capitalization)). -Don't use bold to emphasize ordinary words. +Do not use bold to emphasize ordinary words. ### Italics @@ -440,7 +480,7 @@ Use hashtags `#` to indicate the heading level and group content. Always start w -Headings must be used in correct order. The subsection of an H2 header would be H3 - you wouldn't jump to an H4 or H5. Skipping over a header level affects search and SEO structures to search crawlers like Google. Docusaurus carefully formats generated pages to ensure strong search and SEO, and malformed structures can reduce that strength. +Headings must be used in correct order. The subsection of an H2 header would be H3: you would not jump to an H4 or H5. Skipping over a header level affects search and SEO structures to search crawlers like Google. Docusaurus carefully formats generated pages to ensure strong search and SEO, and malformed structures can reduce that strength. ### Step headings @@ -451,11 +491,9 @@ When a topic documents a long, multi-step process, break it into sections whose ## Hub pages -A hub page is a section's `index.md`. It opens with a short intro, then lists the section's child docs as a grid of cards. Build the grid by hand so you control the order, titles, icons, and descriptions: +A hub page is a section's `index.md`. It opens with a short intro, then lists the section's child docs as a grid of cards, with each card block containing its link, icon, title, and description. ``` -In this section, we'll introduce the following concepts: -
@@ -488,9 +526,9 @@ Save images to `/static/img/`, which mirrors the doc folder structure. Import `u .png')} alt="" style={{border: '1px solid gray'}} width="" /> ``` -* **Format.** Use PNG. Don't use animated GIFs — readers can't pause the motion (an accessibility barrier), and screen readers can't convey them. +* **Format.** Use PNG. Do not use animated GIFs: readers cannot pause the motion (an accessibility barrier), and screen readers cannot convey them. * **Size.** Keep files under 2MB. Use `width` to scale down oversized or pixelated images. -* **Replace, don't version.** When a UI change dates an image, overwrite the existing file rather than adding a second copy. Image files are large and slow the build. +* **Replace, do not version.** When a UI change dates an image, overwrite the existing file rather than adding a second copy. Image files are large and slow the build. * **Web-hosted images.** Pass the full URL and drop `useBaseUrl`: * ✅ `Jira Catalina` * ❌ `Jira Catalina` @@ -567,7 +605,6 @@ We mask sensitive information like usernames, email addresses, and IP addresses. Create callouts using the shape tool in SnagIt. Callouts should be red, 100% opacity, no drop shadow effect, 2 pts wide. - ## Lists You can mix ordered (or numbered) and unordered (or bulleted) lists together. Use extra lines and tabs (or 2 spaces) to move content under these bullets, including other bullets, paragraphs, images, and more. Be careful of indenting too much; three tab indents will automatically render as code. @@ -805,7 +842,7 @@ tags: [metrics, traces] | `slug:` | (Optional) Overrides the `id:` for the canonical link. Best used for index pages for sections. | | `title:` | **(Required)** For SEO purposes, include main keywords in your title and keep it under 60 characters. This title is used in navigation if a `sidebar_label` is not included. | | `sidebar_label:` | (Optional) Label for the sidebar navigation. Keep it title short. It does not affect the canonical link or page title. | -| `description:` | (Optional) 1-2 sentences describing the content in the doc. It appears in search engine results. Keep it 140–160 characters. Use plain text only — no Markdown or backtick formatting. If omitted, search engines will pull the first couple of sentences from the page. See [Metadata descriptions](#metadata-descriptions). | +| `description:` | (Optional) 1-2 sentences describing the content in the doc. It appears in search engine results. Keep it 140–160 characters. Use plain text only: no Markdown or backtick formatting. If omitted, search engines will pull the first couple of sentences from the page. See [Metadata descriptions](#metadata-descriptions). | | `keywords:` | (Optional) List of keywords to enhance SEO. | | `tags:` | (Optional) A string or list of tags that adds labels and permalinks to help with sorting. | @@ -841,17 +878,18 @@ The top navigation bar is configured in [`docusaurus.config.js`](https://docusau ## Patents and trademarks -Protecting our patents and trademarks is important to do correctly. We do not want to expose the company to a loss of trademark or patent just because we didn't list it correctly. +Protecting our patents and trademarks is important to do correctly. We do not want to expose the company to a loss of trademark or patent just because we did not list it correctly. + +Always refer to "Sumo Logic", rather than "Sumo". "Sumo" alone is a generic enough word that other, unrelated companies use it too, so the full name keeps our brand unambiguous. To be more conversational, it is also fine to say "we". Never use Sumo Logic in the plural or possessive form. -This is a partial list of trademarked terms, which should be capitalized exactly as shown below. +This is a list of trademarked terms, which should be displayed exactly as shown below: -* Sumo Logic -* Big Data for Real Time IT -* Log Reduce -* Elastic Log Processing -* Push Analytics +* LogReduce® (all one word, camelcase) +* See Business Differently® +* Empower the People Who Power Modern Business® +* Illuminate® -Never use Sumo Logic in the plural or possessive form. +Give a product or feature name (such as LogReduce) its trademark (™) or registered (®) symbol on the first reference on a page only, then drop it. No need to add the symbol to "Sumo Logic" in running text, as it's done in the site footer. ## Preview releases @@ -995,7 +1033,7 @@ When a feature becomes Generally Available (GA), remove all Preview-related labe ## Punctuation -Punctuation is placed outside of quotation marks, British English style. For everything else (dates, times, spelling), we use American English style. +Punctuation is placed outside of quotation marks, British English style. This keeps a quoted command, field value, or error string accurate. Trailing punctuation is not mistaken for part of it. For everything else (dates, times, spelling), we use American English style. ### Colons Colons are used to introduce lists or to separate titles from subtitles. Only include the colon if the introduction isn’t a complete sentence. @@ -1014,7 +1052,7 @@ Use the hyphen (-) for compound modifiers, such as `drop-down menu` or `read-onl ### Exclamation points -Use exclamation points to express excitement or encourage the user. Don't use them for errors, warnings, or confirmation of basic actions as they are usually unnecessary and can distract from important details. +Use exclamation points to express excitement or encourage the user. Do not use them for errors, warnings, or confirmation of basic actions as they are usually unnecessary and can distract from important details. ### Ellipses and truncation @@ -1051,11 +1089,11 @@ import ApiRoles from '../reuse/api-roles.md'; For example, `reuse/api-roles.md` is one sentence about required role capabilities. Around 50 API reference docs import it under their own `## Required role capabilities` heading, then follow it with the capabilities specific to that API. -Headings inside a reuse file don't show up in the right-side nav of the docs that import it. So keep any H2 or H3 heading in the importing doc, and put only the body (and any H4 or lower headings) in the reuse file. +Headings inside a reuse file do not show up in the right-side nav of the docs that import it. So keep any H2 or H3 heading in the importing doc, and put only the body (and any H4 or lower headings) in the reuse file. ## Tables -Use standard Markdown tables. Columns left-align by default; put `:--:` in a column's divider cell to center it, `--:` to right-align. Cells take inline Markdown, links, images, and `
` for line breaks. The site theme adds zebra striping automatically. Fall back to a raw HTML table only for layouts Markdown can't express, such as row or column spans. +Use standard Markdown tables. Columns left-align by default; put `:--:` in a column's divider cell to center it, `--:` to right-align. Cells take inline Markdown, links, images, and `
` for line breaks. The site theme adds zebra striping automatically. Fall back to a raw HTML table only for layouts Markdown cannot express, such as row or column spans. ## Tabs @@ -1070,7 +1108,7 @@ import TabItem from '@theme/TabItem'; Sumo conventions: * **Use `groupId`** when the same choice appears more than once on a page, or across pages, so the reader's selection syncs and sticks (for example, `groupId="k8s-nonk8s"`). -* **Make each tab self-contained.** A reader who picks one tab and ignores the rest should still get every step for that path. Don't split a procedure so that step 3 is under one tab and step 4 under another. +* **Make each tab self-contained.** A reader who picks one tab and ignores the rest should still get every step for that path. Do not split a procedure so that step 3 is under one tab and step 4 under another. * `className="unique-tabs"` appears in many existing docs but has no effect, since no stylesheet targets it. Leave it off new tab sets. @@ -1094,7 +1132,7 @@ For clarity and search engine discoverability: The `description` frontmatter field controls the snippet shown in search engine results. Follow these rules: -* **Length: 140–160 characters.** Google truncates descriptions at approximately 160 characters. Descriptions under 100 characters are too short to be useful — search engines may generate their own snippet instead. +* **Length: 140–160 characters.** Google truncates descriptions at approximately 160 characters. Descriptions under 100 characters are too short to be useful; search engines may generate their own snippet instead. * **Plain text only.** Do not use Markdown syntax in the `description` field. Backticks, bold (`**`), and other Markdown formatting render as literal characters in HTML `` tags and appear as symbols in search results. * **Lead with an action verb or the product/feature name.** Do not start with "This page", "This doc", or "This article." * **Write for humans.** Describe what the reader will learn or accomplish, not just what the page contains. @@ -1111,7 +1149,7 @@ Example: Answer Engine Optimization improves the chances of your content appearing as a direct answer in search results, including Google featured snippets and "People also ask" boxes. -* **Answer the question in the first 1–2 sentences.** The opening paragraph should directly state what the subject is or what the reader will accomplish. Do not bury the answer after several sentences of context. +* **Answer the question in the first 1–2 sentences.** The opening paragraph should directly state what the subject is or what the reader will accomplish. Do not bury the answer after several sentences of context. In a tutorial, also say which step or stage the page is. * **Use question-format H2 headings where natural.** Headings like "What is X?" or "How do I configure Y?" help search engines match content to user queries. * Example: ~~_Overview_~~ → _What is the Outlier operator?_ * **Use structured lists and tables.** Search engines extract lists and tables preferentially for featured snippets. Use them wherever content is enumerable or comparative. @@ -1124,7 +1162,7 @@ Generative Engine Optimization improves the likelihood that AI-powered search to * **Make the opening paragraph self-contained.** LLMs pull from the first few sentences to decide whether to cite a page. The opening should be understandable without reading anything else on the page. * **State facts as explicit standalone sentences.** Avoid burying key information in subordinate clauses. A fact stated in its own sentence is more likely to be cited verbatim. * Example: ~~_The operator, which supports up to 10,000 events per second depending on instance size, works with both collector types._~~ → _The operator supports up to 10,000 events per second on large instances. It works with both Hosted and Installed Collectors._ -* **Use specific version numbers and dates.** Avoid "latest", "current", or "recent" without a specific value. AI tools reproduce whatever is on the page — vague references become stale citations. +* **Use specific version numbers and dates.** Avoid "latest", "current", or "recent" without a specific value. AI tools reproduce whatever is on the page. Vague references become stale citations. * **Add an "At a glance" section for long pages.** For pages over 800 words, add a brief summary section near the top with key facts as short bullet points. This is the most citation-friendly portion of a page for generative AI tools. @@ -1167,13 +1205,13 @@ If you need to use mouse actions to be specific, use: ## Videos -Throughout the docs, we embed tutorial videos on pages where they're relevant to the topic. The Training Team produces these videos. When you embed one they've provided — usually inside a `:::training` admonition — add the import once near the top of the file: +Throughout the docs, we embed tutorial videos on pages where they're relevant to the topic. The Training Team produces these videos. When you embed one they've provided (usually inside a `:::training` admonition), add the import once near the top of the file: ```md import Iframe from 'react-iframe'; ``` -Most Sumo Logic videos are hosted on Wistia. Don't make watching a video required to complete a task; the written steps must stand on their own. +Most Sumo Logic videos are hosted on Wistia. Do not make watching a video required to complete a task; the written steps must stand on their own. Paste the matching snippet into the body: diff --git a/docusaurus.config.js b/docusaurus.config.js index d572b0216a6..1834b6fe3d4 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -617,7 +617,7 @@ module.exports = { ], }, ], - copyright: `Copyright © ${new Date().getFullYear()} by Sumo Logic, Inc.`, + copyright: `© ${new Date().getFullYear()} Sumo Logic, Inc. SUMO and SUMO LOGIC are registered trademarks.`, }, }), }; From 6de8e56cfcbcc72376ee841a670e7f035a503532 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 18:32:32 -0700 Subject: [PATCH 10/14] DOCS-482 - Restrict scope to docs/contributing files and docusaurus.config.js --- docs/alerts/monitors/overview.md | 2 +- docs/alerts/monitors/use-playbooks-with-monitors.md | 4 ++-- docs/alerts/scheduled-searches/index.md | 2 +- .../webhook-connections/set-up-webhook-connections.md | 2 +- docs/api/about-apis/terraform-with-sumo-logic.md | 6 +++--- docs/contributing/style-guide.md | 2 +- .../get-started-with-cloud-siem/about-cse-insight-ui.md | 6 +++--- .../insight-generation-process.md | 2 +- .../match-lists-suppressed-lists/standard-match-lists.md | 2 +- .../about-signal-suppression.md | 2 +- docs/cse/troubleshoot/troubleshoot-mappers.md | 2 +- .../create-and-manage-orgs/manage-orgs-for-mssps.md | 2 +- docs/manage/security/access-keys.md | 2 +- .../metrics-queries/metric-query-error-messages.md | 2 +- .../deploy-use-aws-observability/deploy-with-terraform.md | 4 ++-- docs/observability/reliability-management-slo/index.md | 8 ++++---- .../integration-framework/about-integration-framework.md | 2 +- .../automation-service/playbooks/create-playbooks.md | 2 +- docs/reuse/account-credit.md | 2 +- .../build-search/keyword-search-expressions.md | 2 +- .../search-query-language/search-operators/sessionize.md | 2 +- .../transaction-analytics/transactionize-operator.md | 2 +- docs/security/additional-security-features/index.md | 2 +- .../amazon-aws/grant-access-aws-product.md | 4 ++-- docs/send-data/installed-collectors/index.md | 2 +- .../mapping-records-resources.md | 4 ++-- .../data-source-configurations/overview.md | 2 +- 27 files changed, 38 insertions(+), 38 deletions(-) diff --git a/docs/alerts/monitors/overview.md b/docs/alerts/monitors/overview.md index cfc29c2cf85..26f32bfa7dd 100644 --- a/docs/alerts/monitors/overview.md +++ b/docs/alerts/monitors/overview.md @@ -96,7 +96,7 @@ When a specific alerting condition is met, as defined on the monitor, an inciden ### Monitor -A Monitor creates an Alert. Using the options below, you're subscribing to an Alert's Monitor. +A _Monitor_ creates an _Alert_. Using the options below, you're subscribing to an _Alert's Monitor_. The monitor is the object that you configure within Sumo Logic that: * Checks for specific events of interest against a data source, based on your specified conditions. Events of interest are used in a general sense to denote an event that may be of interest to you. diff --git a/docs/alerts/monitors/use-playbooks-with-monitors.md b/docs/alerts/monitors/use-playbooks-with-monitors.md index 3dc37950f33..c12a8d0a862 100644 --- a/docs/alerts/monitors/use-playbooks-with-monitors.md +++ b/docs/alerts/monitors/use-playbooks-with-monitors.md @@ -7,7 +7,7 @@ description: Learn how to use Automation Service playbooks with monitors. import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe'; -This article describes how to configure automated playbooks in monitors. An automated playbook is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. +This article describes how to configure automated playbooks in monitors. An *automated playbook* is a [playbook in the Automation Service](/docs/platform-services/automation-service/playbooks), and is a predefined set of actions and conditional statements that run in an automated workflow to respond to an event. For example, suppose that a monitor detects suspicious behavior that could indicate a security problem. When the monitor sends the alert, it could also run an automated playbook to respond to the event. To add an automated playbook to a monitor, see [Add an automated playbook to a monitor](#add-an-automated-playbook-to-a-monitor) below. @@ -80,7 +80,7 @@ You can create a monitor that triggers an alert that in turn runs an automated p An anomaly monitor is triggered when unusual conditions are detected. Anomaly monitors leverage a machine learning model to detect anomalies and identify unusual patterns of activity. The output of the machine learning model are baselines for normal behavior, in the form of lower and upper thresholds, so that deviations from baselines signal unusual activity and trigger alerts. :::note -Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (Weekly seasonality detection is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) +Weekly seasonality detection is turned off by default to optimize performance. [Contact Sumo Logic Customer Support](https://support.sumologic.com/support/s/contactsupport) to activate it for specific monitors. (*Weekly seasonality detection* is the optimization of baseline calculations to account for the variations of data flow that can occur in a work week.) ::: :::training Micro Lesson diff --git a/docs/alerts/scheduled-searches/index.md b/docs/alerts/scheduled-searches/index.md index 1acea6fe789..7da367f25b1 100644 --- a/docs/alerts/scheduled-searches/index.md +++ b/docs/alerts/scheduled-searches/index.md @@ -6,7 +6,7 @@ description: Schedule log searches in Sumo Logic to run continuously and send al import useBaseUrl from '@docusaurus/useBaseUrl'; -A [Scheduled Search](/docs/alerts/scheduled-searches/schedule-search) is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack. +A _Scheduled Search_ is a standard [Log Search](/docs/search) that you save and execute to run on a schedule. Once configured, Scheduled Searches run continuously, making them a great tool for continuously monitoring your stack.
diff --git a/docs/alerts/webhook-connections/set-up-webhook-connections.md b/docs/alerts/webhook-connections/set-up-webhook-connections.md index 05301c45c25..82c536eb55b 100644 --- a/docs/alerts/webhook-connections/set-up-webhook-connections.md +++ b/docs/alerts/webhook-connections/set-up-webhook-connections.md @@ -11,7 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; To create a webhook connection, you need the View Connections and Manage Connections [role capabilities](/docs/manage/users-roles/roles/role-capabilities). Contact your org administrator for assistance. ::: -A webhook is an HTTP callback, which is an HTTP POST that occurs when something happens. Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. +A _webhook_ is an HTTP callback, which is an HTTP POST that occurs when something happens. Webhook connections allow you to send Sumo Logic alerts to third-party applications that accept incoming webhooks. For example, once you set up a webhook connection in Sumo Logic and create a scheduled search, you can send an alert from that scheduled search as a post to a Slack channel, or integrate with third-party systems. In addition to an alert, you can include a link directly to a search and even a few search results (depending on the third party tool you're connecting to). There is no limit to the number of webhooks you can send from Sumo Logic, but your third party might impose restrictions. In addition, the payload of a webhook may be restricted by Sumo Logic or the third party. diff --git a/docs/api/about-apis/terraform-with-sumo-logic.md b/docs/api/about-apis/terraform-with-sumo-logic.md index 1656c852e91..67e9d68c08d 100644 --- a/docs/api/about-apis/terraform-with-sumo-logic.md +++ b/docs/api/about-apis/terraform-with-sumo-logic.md @@ -210,7 +210,7 @@ Let's look at some examples: ### Terraform providers -A provider is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A *provider* is a Terraform module or plugin developed by a vendor that defines which vendor resources are available for Terraform to create and manage. For information about the Sumo Logic provider, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). Sumo Logic has an established Terraform provider plugin, as does AWS and other major cloud vendors. The Terraform script section defining the provider for resources defined by other parts of the script might look like this: @@ -238,7 +238,7 @@ terraform { ### Terraform resources -A resource is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). +A *resource* is an infrastructure element that can be defined and created from the available resources produced by the provider. For available resources, see the [Sumo Logic Provider documentation](https://registry.terraform.io/providers/SumoLogic/sumologic/latest/docs). A resource definition will look similar in form to the provider definition: @@ -352,7 +352,7 @@ data "httpclient_request" "enable_searchaudit_policy" { ### Terraform state files -After running Terraform, there is another file type you should be aware of. A state file is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. +After running Terraform, there is another file type you should be aware of. A *state file* is a configuration file generated by a Terraform installation that stores the current state of your managed infrastructure and configuration. This state is typically stored in a local file in your terraform working directory named `terraform.tfstate`. The state file is used by Terraform to track the current infrastructure state in order to properly process updates or deletes. The state file should be kept safe and secure (since it may contain sensitive data such as access keys and secrets) and is not meant to be edited directly, even though it is a simple human-readable JSON text file. An example state file might look like the screenshot below: diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index 89bc9565694..95379d2af58 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -22,7 +22,7 @@ Our docs are built with [Docusaurus](https://docusaurus.io/), a static site gene :::tip To create a new doc quickly, use a [template](/docs/contributing/templates). Copy the file, add your content, and submit a PR. The Docs Team reviews submissions, suggests edits, adds new content to the navigation, and answers your questions. -If you have Claude Code installed, this repo's `sumo-style` skill applies these conventions automatically when you draft or edit docs, so you do not need to invoke it manually. See AGENTS.md for details. +If you have Claude Code installed, this repo's `sumo-style` skill applies these conventions automatically when you draft or edit docs, so you do not need to invoke it manually. See [AGENTS.md](https://github.com/SumoLogic/sumologic-documentation/blob/main/AGENTS.md) for details. ::: ## Style references diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md index 1cd675cba70..4ff2e60a57b 100644 --- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md +++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md @@ -176,8 +176,8 @@ At the top of the insight details page, you’ll see a signal timeline that visu * **Anomaly**. Signals that were triggered by User and Entity Behavior Analytics (UEBA) rules. * **Threat intelligence**. Signals that were fired by threat intel rules. 1. **Show Related**. Click this link to show related signals in addition to attached signals. If you click the **Show Related** check box, the page updates and also displays any related signals or related insights. - * A related signal is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals. - * A related insight is an insight that a related signal is attached to. + * A *related signal* is a signal that isn’t part of the current insight (it’s not attached), but fired on the same entity as the current insight’s attached signals within 7 days of the current insight’s attached signals.  + * A *related insight* is an insight that a related signal is attached to. 1. **Sort options**. You can sort the signals list by Content Type, Event Time, Created Time, Name, or Severity. Note that you can further sort by ascending or descending value. 1. **Add Signals**. Click this option if you want to add a signal to the insight. You’ll be prompted with a list of signals that have the same entity as the current insight (if there are any), and are not already attached to another insight. A signal that you add to an insight manually is considered an attached signal. @@ -280,7 +280,7 @@ By default, this view shows the same entities that are displayed on the list vie * A **time frame** control, which controls what time frame to use when searching for and viewing relationships outside of the insight. In addition, the following can appear in the graph: -* **Detected entities**. Entities with a detected relationship will be connected with solid lines. A detected relationship is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). +* **Detected entities**. Entities with a *detected* relationship will be connected with solid lines. A *detected relationship* is when a relationship is detected between entities (for example, when an IP and hostname appear in a record together, but not necessarily in the insight being viewed). * **Threat indicators**. Any entity with a threat indicator will have an additional icon in the upper right. If the threat indicator is Malicious or Suspicious, the entity will be highlighted in red or yellow accordingly. For more information about threat indicators, see [View threat indicator labels in the Cloud SIEM UI](/docs/security/threat-intelligence/threat-indicators-in-cloud-siem/#view-threat-indicator-labels-in-the-cloud-siem-ui). * **Hover**. If you hover over an entity, it and all connections to it will be highlighted in blue. If its value is not fully visible by default, the full value will be displayed. diff --git a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md index 7f47abea845..5e16395834e 100644 --- a/docs/cse/get-started-with-cloud-siem/insight-generation-process.md +++ b/docs/cse/get-started-with-cloud-siem/insight-generation-process.md @@ -10,7 +10,7 @@ import Iframe from 'react-iframe';  This page explains Cloud SIEM's insight generation process.  -The concept of an entity is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). +The concept of an *entity* is central to the process Cloud SIEM uses to correlate signals and create insights. So, what is an entity? In Cloud SIEM, an entity is a actor, for example, a hostname, username, or MAC address encountered in an incoming message. For more information about entities and entity types, see [View and Manage Entities](/docs/cse/records-signals-entities-insights/view-manage-entities). :::training Micro Lesson Watch this micro lesson to learn how insights are created. diff --git a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md index 2ea8de72e7a..9ab694334b6 100644 --- a/docs/cse/match-lists-suppressed-lists/standard-match-lists.md +++ b/docs/cse/match-lists-suppressed-lists/standard-match-lists.md @@ -255,7 +255,7 @@ The following Cloud SIEM rules refer to this match list: **Description:** DNS domain names that are known business-related domains. This is intended to capture domains related to validated, expected, or critical business functions and may be used for allowlisting or filtering related uninteresting results from query result sets. -Domain matches against the `domain` field, not the FQDN (i.e. hostname or query), so `example.com` is a valid entry but `www.example.com` is not. +*Domain* matches against the `domain` field, not the FQDN (i.e. hostname or query), so *example.com* is a valid entry is but *www.example.com* is not. The following Cloud SIEM rules refer to this match list: * Bitsadmin to Uncommon TLD diff --git a/docs/cse/records-signals-entities-insights/about-signal-suppression.md b/docs/cse/records-signals-entities-insights/about-signal-suppression.md index 9dd174452bc..b61fcbcd121 100644 --- a/docs/cse/records-signals-entities-insights/about-signal-suppression.md +++ b/docs/cse/records-signals-entities-insights/about-signal-suppression.md @@ -13,7 +13,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; This topic describes the various ways that signals can get suppressed. -In Cloud SIEM, a suppressed signal is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. +In Cloud SIEM, a *suppressed signal* is a signal that Cloud SIEM's insight algorithm will exclude from the insight generation process. In other words, a suppressed signal does not contribute to or become a part of an insight. By default, signals are automatically suppressed for 72 hours. Signal suppression can occur for a variety of reasons, including [entity suppression](#suppress-by-entity), [network blocks](#suppress-by-network-block), [suppression lists](#suppress-by-indicator), and identifying [redundant signals](#automatic-suppression-of-redundant-signals) by our rules correlation engine. In all cases, signals will still be generated in the suppressed state. Depending on the reason, the field `suppressedReasons` will be populated in the `sec_signal` index. For example, this may include the signal ID of an identical signal that caused subsequent redundant signals to be suppressed, or it may contain the name of the network block with suppression enabled. diff --git a/docs/cse/troubleshoot/troubleshoot-mappers.md b/docs/cse/troubleshoot/troubleshoot-mappers.md index 13cd3683bc9..4fae6407f63 100644 --- a/docs/cse/troubleshoot/troubleshoot-mappers.md +++ b/docs/cse/troubleshoot/troubleshoot-mappers.md @@ -63,7 +63,7 @@ Incomplete records result when a record is created, but key information is not m ### A mapper does not exist for parsed events -Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a default pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. +Another common mapping issue occurs when a log successfully parses, is assigned mapping metadata (`vendor`, `product`, `event_id`), but there is no corresponding mapper for the `event_id`. In many cases a _default_ pattern mapper exists which serves as a catch-all, but if this is not present, any logs which do not match a pattern defined in the mapper input will not create a record. This assumes the data source for which the mapping is failing has a parser and mappers in place already. This applies to net-new data sources and parsers. diff --git a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md index 364ba8fc796..cb0865e386e 100644 --- a/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md +++ b/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md @@ -119,7 +119,7 @@ You can push the following: - If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](#view-history). - Push operations may take longer based on the volume of content being pushed. - Rule tuning expressions must be pushed separately from rules. -- Cloud SIEM Legacy Rule Type is not supported for sync or push. +- *Cloud SIEM Legacy Rule Type* is not supported for sync or push. - For library content, breaching 15,000 cap (Items selected in one job X Child orgs targeted in one job) would fail the sync job. - The maximum runtime for jobs below 1200 requests (Items selected in one job X Child orgs targeted in one job) is less than or equal to 2 mins. Linear increase beyond 1200 request would take more runtime, for example, 15,201 would nearly take 30 mins. - For CSIEM rules and tuning expression (Rule or Tuning Exp × child-orgs): diff --git a/docs/manage/security/access-keys.md b/docs/manage/security/access-keys.md index 68317f5e8ba..0750d2cdd47 100644 --- a/docs/manage/security/access-keys.md +++ b/docs/manage/security/access-keys.md @@ -56,7 +56,7 @@ Watch this micro lesson to learn how to create access keys. ### From the Personal Access Keys tab -A personal access key is a key that you can create to manage access for personal use. +A *personal access key* is a key that you can create to manage access for personal use. :::tip If you are an administrator who needs to create an access key for system use (such as for API scripts, third party integrations, or infrastructure as code), we recommend you create the access key on a [service account](#from-a-service-account). diff --git a/docs/metrics/metrics-queries/metric-query-error-messages.md b/docs/metrics/metrics-queries/metric-query-error-messages.md index 8646e98d362..ee6d1d6f795 100644 --- a/docs/metrics/metrics-queries/metric-query-error-messages.md +++ b/docs/metrics/metrics-queries/metric-query-error-messages.md @@ -46,7 +46,7 @@ Sumo Logic imposes limits on the input data for a query and the data output by t #### Input data limit -Input data is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. +*Input data* is the data that matches the selector, prior to aggregation. Sumo Logic evaluates the volume of input data in terms of the number of time series. For a single metrics query row, Sumo Logic limits the number of input time series to 1000 for non-aggregate queries. For aggregate queries (queries that have an aggregate operator like `avg` or `max`) the limit is at least 200,000 for time ranges within last 24 hours and 50,000 otherwise. diff --git a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md index 06dc69a971e..cbef317af84 100644 --- a/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md +++ b/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform.md @@ -1633,7 +1633,7 @@ This error can occur when cloudtrail is not enabled for EventBridge to capture ` #### Solution CloudTrail must be enabled for EventBridge to capture `CreateLoadBalancer` events, since these events are recorded and delivered through CloudTrail. -### Argument named `managed_apps` is not expected +### Argument named *managed_apps* is not expected #### Error Message ``` @@ -1645,7 +1645,7 @@ managed_apps = { #### Solution Refer to [this module in GitHub](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-integrations/tree/master/sumologic). -### Argument named `admin_mode` is not expected +### Argument named *admin_mode* is not expected #### Error Message ``` diff --git a/docs/observability/reliability-management-slo/index.md b/docs/observability/reliability-management-slo/index.md index b1efaa05ded..01105e8e7d9 100644 --- a/docs/observability/reliability-management-slo/index.md +++ b/docs/observability/reliability-management-slo/index.md @@ -42,11 +42,11 @@ To work with SLOs, you need the following Sumo Logic [role capabilities](/docs/m Reliability is essentially the uptime of systems and services. This includes the following concepts: -**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the SLI for a compliance period. +**Service-Level Objective (SLO)**. The software provider's performance promise made to end users. This goal defined by the _SLI_ for a _compliance period_. -**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the SLO — the quality promised to end users — is being met. +**Service-Level Indicator (SLI)**. Quantitative measurements of a system/service availability within a specific time period. These performance figures are used to determine that the _SLO_ — the quality promised to end users — is being met. -**Error Budget**. The tolerable amount/level of system unavailability in the compliance period. +**Error Budget**. The tolerable amount/level of system unavailability in the _compliance period_. **Compliance period**. The duration of time used to monitor and score your system/service availability. Breaking down your organization's quantitative success rate over consistent time periods is useful internally and can be communicated to customers that you're meeting your goals. See the following information for the max compliance period: @@ -70,7 +70,7 @@ Reliability is essentially the uptime of systems and services. This includes the As an example, let's say an ecommerce app considers its checkout service transactions to be successful (good) when completed in less than 500ms. A successful five-minute (5m) time window may be one in which the p99 of latency is less than 500ms. -The SLI can be defined as the percentage of successful 5m windows in a compliance period of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an error budget is 0.1% of these 5m windows in 30d. +The _SLI_ can be defined as the percentage of successful 5m windows in a _compliance period_ of 30 days (30d) or equal to 99.9% for any month. The number of unsuccessful (bad) transactions we allow as an _error budget_ is 0.1% of these 5m windows in 30d. The following chart shows our calculations and an example 5m window for the month of January where a number of requests were unsuccessful due to completions that were greater than 500ms: diff --git a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md index 2526fb78765..9277bc315d2 100644 --- a/docs/platform-services/automation-service/integration-framework/about-integration-framework.md +++ b/docs/platform-services/automation-service/integration-framework/about-integration-framework.md @@ -326,7 +326,7 @@ All available actions are: #### Scheduled action definitions -A Scheduled action represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. +A _Scheduled action_ represents a particular type of action when the execution is iterated until a specific exit condition is met. This type of action permits you to create loops in a playbook. YAML example: diff --git a/docs/platform-services/automation-service/playbooks/create-playbooks.md b/docs/platform-services/automation-service/playbooks/create-playbooks.md index c2887842b24..15cd846c74c 100644 --- a/docs/platform-services/automation-service/playbooks/create-playbooks.md +++ b/docs/platform-services/automation-service/playbooks/create-playbooks.md @@ -46,7 +46,7 @@ See [Add nodes to a playbook](/docs/platform-services/automation-service/playboo ## Add nodes to a playbook -You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A node is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. +You can add nodes to a playbook when you either create a new playbook, or edit an existing playbook. To add a node to a playbook, hover your mouse over an existing node, such as the **Start** node, and click on the **+** button that appears on the node. A *node* is a step in a playbook. Nodes run in the order they are placed in a playbook. When all nodes run without error, the playbook is considered to have executed successfully. See the following sections to learn how to add the following node types: * [**Action**](#add-an-action-node-to-a-playbook). Automatically take specific actions such as enriching data or taking containment steps. diff --git a/docs/reuse/account-credit.md b/docs/reuse/account-credit.md index fa4cbddedf8..0ed36c92235 100644 --- a/docs/reuse/account-credit.md +++ b/docs/reuse/account-credit.md @@ -1 +1 @@ -A credit is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. +A *credit* is a unit of measure that tracks use, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. This allows you to carefully manage your account. diff --git a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md index 34c597f1696..0f3786f8f80 100644 --- a/docs/search/get-started-with-search/build-search/keyword-search-expressions.md +++ b/docs/search/get-started-with-search/build-search/keyword-search-expressions.md @@ -4,7 +4,7 @@ title: Keyword Search Expressions description: The text that comes before the first pipe symbol in a query is called the keyword expression or scope. --- -A Keyword Search Expression defines the scope of data for the query. +A _Keyword Search Expression_ defines the scope of data for the query. Boolean logic and wildcards enable you to search for multiple terms, express logic about term distribution within messages, and specify partial terms with wildcards. The keyword expression can include [built-in metadata fields](../search-basics/built-in-metadata.md) such as `_collector`, `_sourceCategory`, `_sourceName`, and `_sourceHost` as well as custom log metadata fields. diff --git a/docs/search/search-query-language/search-operators/sessionize.md b/docs/search/search-query-language/search-operators/sessionize.md index 5e200bd1a8b..ae2eafcf791 100644 --- a/docs/search/search-query-language/search-operators/sessionize.md +++ b/docs/search/search-query-language/search-operators/sessionize.md @@ -25,7 +25,7 @@ Queries using `sessionize` cannot be added to a Dashboard. `sessionize ("") as (), ("") as ()` -Where anchor pattern is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). +Where *anchor pattern* is like a parse anchor expression, except that it can include variables from previous expressions (using `$variableName`). ## Rules diff --git a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md index ce3819f0ce3..4ca6957e287 100644 --- a/docs/search/search-query-language/transaction-analytics/transactionize-operator.md +++ b/docs/search/search-query-language/transaction-analytics/transactionize-operator.md @@ -5,7 +5,7 @@ title: Transactionize Operator import useBaseUrl from '@docusaurus/useBaseUrl'; -The Transactionize operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. +The _Transactionize_ operator groups log messages that match on any fields you specify. The groups created from the specified fields become the **transactions**. Unlike other "group by" operators, where the logs in a group must match on all defined fields, `transactionize` just needs one field to match in order to assign logs to the same group. diff --git a/docs/security/additional-security-features/index.md b/docs/security/additional-security-features/index.md index 65e4ced008a..d32b600932e 100644 --- a/docs/security/additional-security-features/index.md +++ b/docs/security/additional-security-features/index.md @@ -5,7 +5,7 @@ title: Logs for Security import useBaseUrl from '@docusaurus/useBaseUrl'; -Logs for Security is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. +*Logs for Security* is Sumo Logic's full set of features that leverage logs for security use cases. First, you collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Then, you analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries. :::training Sumo Logic Academy diff --git a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md index 21cd6ff34e6..88f4efb33bd 100644 --- a/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md +++ b/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product.md @@ -88,8 +88,8 @@ Before generating the template, the source’s configuration must have the AWS-s 1. **Account ID**. Enter the following Sumo Logic ID: `926226587429`. 1. In the **Options** section, checkmark the **Require external ID for better security**.  1. **External ID**. The External ID is formed from your Sumo Logic region identifier and your Sumo Logic account identifier in this format: *SumoDeployment:SumoAccountId*, where: - * *SumoDeployment* is a placeholder for your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. - * *SumoAccountId* is a placeholder for the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. + * *SumoDeployment* is your Sumo Logic deployment entered in lowercase, such as au, ca, ch, de, esc, eu, fed, jp, kr, us1, or us2. To find your deployment, see Sumo Logic Endpoints by Deployment and Firewall Security. + * *SumoAccountId* is the Organization ID shown on your **Account Overview** in the Sumo Logic UI. You can access it by going to the [**Account Overview**](/docs/manage/manage-subscription/sumo-logic-credits-accounts/#account-overview) page. 1. **Require MFA**. Don’t select this option; it is not supported. 1. Click **Next: Permissions**.
AWS IAM 'Create role' interface specifying trusted entities and accounts, highlighting fields for Account ID and External ID 1. Click **Create policy**. The **Create policy** page opens in a separate window. diff --git a/docs/send-data/installed-collectors/index.md b/docs/send-data/installed-collectors/index.md index 7d485f6353c..d9f4959f4c0 100644 --- a/docs/send-data/installed-collectors/index.md +++ b/docs/send-data/installed-collectors/index.md @@ -8,7 +8,7 @@ keywords: import useBaseUrl from '@docusaurus/useBaseUrl'; -Our Installed Collector is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. +Our *Installed Collector* is installed and operates on your local environment, as opposed to our Hosted Collector, which resides on the Sumo Logic service infrastructure. After installing a Collector, the next step involves adding Sources. These Sources serve as endpoints that the Collector connects to, facilitating the retrieval and transmission of data to the Sumo Logic service. In this section, we'll introduce the following concepts: diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md index 981f62af300..5f82a24ee1f 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/mapping-records-resources.md @@ -14,7 +14,7 @@ OpenTelemetry has a [rich data model](https://github.com/open-telemetry/opentele * **Instrumentation Scope**. Additional information about the scope of data. For example, instrumentation library name. * **Record**. Refers to a specific entry of data, such as a Log, Span, or Metric. :::note -For logs, this is usually called a Record; for traces, it's usually called a Span; and for metrics, a Datapoint (or sample, if Prometheus is used). In this documentation, we'll use Record for all of these. +For logs, this is usually called a _Record_; for traces, it's usually called a _Span_; and for metrics, a _Datapoint_ (or _sample_, if Prometheus is used). In this documentation, we'll use _Record_ for all of these. ::: Each Record has its own set of attributes, which may include key/value pairs that are specific to the context of the Record. Logs, in particular, can also include attributes in the body of the Record. Some Record types may follow certain conventions for signal types, such as [trace](https://github.com/open-telemetry/semantic-conventions), [metrics](https://github.com/open-telemetry/semantic-conventions), or [logs](https://github.com/open-telemetry/semantic-conventions). @@ -27,7 +27,7 @@ Looking from the OpenTelemetry standpoint, [Fields](/docs/manage/fields) are a g All **Resource-level** attributes are stored as fields, and any attributes that do not match a defined field will be skipped. You can check the list of ignored fields using the [dropped fields view](/docs/manage/fields/#view-dropped-fields). When a log contains attributes at the **Record-level**, they are stored as JSON, and if there is a body, it will be stored under the `log` key. :::info -If your log record has any **Record-level** attributes, Sumo will interpret this as a structured log, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as unstructured and display the body. **Resource-level** attributes are interpreted as fields. +If your log record has any **Record-level** attributes, Sumo will interpret this as a _structured log_, and display it in JSON. If the log does not have any **Record-level** attributes, Sumo will treat it as _unstructured_ and display the body. **Resource-level** attributes are interpreted as fields. ::: ## Example: Log with both Resource-level and Record-level attributes diff --git a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md index d910194ae89..54c905e7b55 100644 --- a/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md +++ b/docs/send-data/opentelemetry-collector/data-source-configurations/overview.md @@ -13,7 +13,7 @@ After you complete source configuration on the Sumo Logic OpenTelemetry (OTel) C ## Data Sources -Data sources (or Source in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. +_Data sources_ (or _Source_ in Sumo Logic) refers to a specific application/infrastructure component from which the collector can collect telemetry (i.e., logs, metrics, and traces). The sources include all configuration components, including protocols, receivers, processors, and exporters required to collect telemetry data from a given source. MySQL, Nginx, Kafka, Cassandra, and JMX are all examples of sources from where Sumo Logic collector can collect and send data. Sources are components that generate data that is then collected by receivers. A source can be thought of as the originating point for data that is being ingested into the Sumo Logic OTel collector. Sources are responsible for collecting and formatting data, and then passing it along to the appropriate receiver. From 49b10f418cdacf0fdab797e3400ea1ed09e7d323 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 18:35:20 -0700 Subject: [PATCH 11/14] DOCS-482 - Replace aka with also known as in style guide Emphasis section --- docs/contributing/style-guide.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index 95379d2af58..a1d9845bf24 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -413,9 +413,9 @@ Never underline text. ```markdown -Emphasis, aka italics, with *asterisks* or _underscores_. +Emphasis, also known as italics, with *asterisks* or _underscores_. -Strong emphasis, aka bold, with two **asterisks** or __underscores__. +Strong emphasis, also known as bold, with two **asterisks** or __underscores__. Combined emphasis with **asterisks and _underscores_**. @@ -425,9 +425,9 @@ Strikethrough uses two tildes. ~~Scratch this.~~ -Emphasis, aka italics, with *asterisks* or _underscores_. +Emphasis, also known as italics, with *asterisks* or _underscores_. -Strong emphasis, aka bold, with two **asterisks** or __underscores__. +Strong emphasis, also known as bold, with two **asterisks** or __underscores__. Combined emphasis with **asterisks and _underscores_**. From fabab3762de9faba6340aac2ba51933b04a95d18 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 19:10:34 -0700 Subject: [PATCH 12/14] DOCS-482 - Convert glossary/word list entries to singular, streamline cross-references, and update style guide punctuation & time sections --- docs/contributing/glossary.md | 36 +++++++++++++++++--------------- docs/contributing/style-guide.md | 25 ++++++++++++++++++---- docs/contributing/word-list.md | 18 +++++++--------- 3 files changed, 48 insertions(+), 31 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index d8d055a5a62..4b2cc0e5f10 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -19,7 +19,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## A -**[Absolute expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting a specific time range of a search. For example, 04/01/2026 20:32:00 to 04/01/2026 20:35:00 will run the search from April 1, 2026 at 8:32 PM until April 1, 2026 at 8:35 PM. +**[Absolute expression](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting a specific time range of a search. For example, 04/01/2026 20:32:00 to 04/01/2026 20:35:00 will run the search from April 1, 2026 at 8:32 PM until April 1, 2026 at 8:35 PM. **[Access key](/docs/manage/security/access-keys)**. A key, generated by Sumo Logic, that you use to securely register new collectors and to access Sumo Logic APIs. @@ -37,7 +37,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Analyst](/docs/get-started/onboarding-checklists#onboarding-checklist-for-analysts)**. A Sumo Logic user role for non-administrators who primarily search logs, build dashboards, investigate data, and monitor their environment. Analyst capabilities are determined by the roles and permissions assigned to them. -**[Apps](/docs/integrations)**. Sumo Logic apps (short for applications) deliver out-of-the-box dashboards, reports, saved searches, and field extraction for popular data sources, such as AWS, Windows, Apache, and many more. When a customer installs an app in Sumo Logic, preconfigured searches and dashboards are customized with the customer's source configurations and populated in a folder. Customers then can monitor their system's behavior visually using the dashboards. +**[App](/docs/integrations)**. Sumo Logic apps (short for applications) deliver out-of-the-box dashboards, reports, saved searches, and field extraction for popular data sources, such as AWS, Windows, Apache, and many more. When a customer installs an app in Sumo Logic, preconfigured searches and dashboards are customized with the customer's source configurations and populated in a folder. Customers then can monitor their system's behavior visually using the dashboards. **[Audit Index](/docs/manage/security/audit-indexes/audit-index)**. A Sumo Logic index that stores event logs about internal account activities such as account management, throttling, and scheduled searches. Administrators must enable the Audit Index before it can be queried using `_index=sumologic_audit`. @@ -119,7 +119,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Ephemeral](/docs/send-data/installed-collectors/collector-installation-reference/set-collector-as-ephemeral)**. Refers to data sources, such as containers, that are created and destroyed as appropriate, resulting in a high volume log data or metrics. In Sumo Logic, you can set a collector to be ephemeral. Sumo Logic deletes an ephemeral collector automatically after it has been offline for 12 hours. -**[Endpoints](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several pods that are assigned depending on the geographic location and the date an account is created. Sumo Logic redirects your browser to the correct login URL and also redirects collectors to the correct endpoint. However, if you're using an API you'll need to manually direct requests to the correct API endpoint; API calls are not redirected to another endpoint. +**[Endpoint](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several pods that are assigned depending on the geographic location and the date an account is created. Sumo Logic redirects your browser to the correct login URL and also redirects collectors to the correct endpoint. However, if you're using an API you'll need to manually direct requests to the correct API endpoint; API calls are not redirected to another endpoint. **[Enrichment](/docs/cse/integrations/enrichments-and-indicators)**. In Cloud SIEM, addition of data to records that provides more information for analysis of security incidents. @@ -132,11 +132,11 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Favorite](/docs/get-started/library)**. The Favorites tab displays searches and dashboards that you refer to frequently, or content that you want to keep handy. In the Library, on the Personal and Org tabs, you can "favorite" content to make it appear on the Favorites tab. Just click the star icon for your saved search, dashboard, installed app, or folder, and it will be saved to the Favorites tab for easy access. You can also favorite saved searches from the Search page, and favorite from the **Dashboards** page. -**[Fields](/docs/manage/fields)**. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields. +**[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. -**[`fields` operator](/docs/search/search-query-language/search-operators/fields)**. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest. +**[Field](/docs/manage/fields)**. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields. -**[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. +**[`fields` operator](/docs/search/search-query-language/search-operators/fields)**. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest. **[Fingerprint](/docs/send-data/installed-collectors/configuration/#fingerprint)**. A fingerprint consists of the first 2048 bytes of a file and is used by installed collectors to track what data has been collected. @@ -160,13 +160,13 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## H -**[Hash rules](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. +**[Hash rule](/docs/send-data/collection/processing-rules/hash-rules)**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. -**[Health Events](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. +**[Health Event](/docs/manage/health-events)**. System events that Sumo Logic generates automatically when it detects an issue with a Collector or Source, or when a usage threshold is exceeded for Lookup Tables, Partitions, Fields, or Field Extraction Rules. Health Events give administrators visibility into collection health and help investigate data ingestion errors and warnings. **[Host Metrics](/docs/integrations/hosts-operating-systems/host-metrics)**. The Sumo Logic app for Host Metrics allows you to collect local host metrics and display them using predefined search queries and dashboards. The app provides dashboards to display analysis of local host metrics for the CPU, disk, memory, network, and TCP. -**[Hosted collectors](/docs/send-data/hosted-collectors)**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. +**[Hosted collector](/docs/send-data/hosted-collectors)**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. ## I @@ -190,7 +190,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Keyword Search Expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions)**. The portion of a log search query that precedes the first pipe symbol. Defines the scope of data for the query using Boolean logic, wildcards, and metadata fields such as `_sourceCategory` and `_collector`. -**[Kubernetes Views](/docs/observability/kubernetes/monitoring)**. Allows you to intuitively filter on four hierarchical components of your Kubernetes system to focus your search on nodes, deployments, services, or namespaces. Kubernetes Views make it easier to traverse your Kubernetes hierarchy to monitor specific components, identify problems, discover root problems, and take progressive action. +**[Kubernetes view](/docs/observability/kubernetes/monitoring)**. Allows you to intuitively filter on four hierarchical components of your Kubernetes system to focus your search on nodes, deployments, services, or namespaces. Kubernetes Views make it easier to traverse your Kubernetes hierarchy to monitor specific components, identify problems, discover root problems, and take progressive action. ## L @@ -234,7 +234,9 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Metric rules editor](/docs/metrics/metric-rules-editor)**. A page in the Sumo Logic web app for creating metric rules. -**[Metric rules](/docs/metrics/metric-rules-editor)**. A Sumo Logic feature that allows you to tag metrics with data derived from the metric identifier. Then, you can use those tags in metric queries. +**[Metric rules editor](/docs/metrics/metric-rules-editor)**. A page in the Sumo Logic web app for creating metric rules. + +**[Metric rule](/docs/metrics/metric-rules-editor)**. A Sumo Logic feature that allows you to tag metrics with data derived from the metric identifier. Then, you can use those tags in metric queries. **[Metric throttling](/docs/metrics/manage-metric-volume/metric-throttling)**. A Sumo Logic feature that throttles your metric sources when you exceed your DPM burst limit. Your ingestion is slowed down until the rate of ingestion is within the allowable contracted limits. @@ -287,13 +289,13 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Partition](/docs/manage/partitions)**. Sumo Logic allows you to filter a subset of the messages in an index into a partition. Partitioning messages in an index improves search query performance, as the total number of messages that need to be searched is reduced. Once messages are routed to a partition, you can limit your search to those messages using the partition name in a search query. -**[Pinned searches](/docs/get-started/library)**. The pinned search feature allows you to start a search, then “pin” it, so it will continue running in the background independent of the browser session. Then, you can close the Search tab or log out and find your results later in the Library on the Recent tab in a folder named Pinned Searches. +**[Pinned search](/docs/get-started/library)**. The pinned search feature allows you to start a search, then “pin” it, so it will continue running in the background independent of the browser session. Then, you can close the Search tab or log out and find your results later in the Library on the Recent tab in a folder named Pinned Searches. **[Platform Optimization Agent](/docs/search/mobot)**. One of the specialized agents that powers [Mobot](/docs/search/mobot). The Platform Optimization Agent answers how-to questions about Sumo Logic, helps troubleshoot issues, and helps users get more from the platform, drawing on official Sumo Logic documentation. Formerly called the Knowledge Agent. **[Playbook](/docs/platform-services/automation-service/playbooks)**. In the Automation Service, a predefined set of actions and conditional statements that run as an automated workflow in response to a security event or incident. Playbooks can run automatically without user intervention or in interactive mode, where a user must authorize specific actions. -**[Processing rules](/docs/send-data/collection/processing-rules)**. A Sumo Logic feature you can use to filter or forward log data ingested by Sumo Logic from a Sumo Logic source. You can use processing rules to include or exclude messages, and to mask or hash sensitive information in logs. You can also forward matching messages to external destinations, including AWS S3. +**[Processing rule](/docs/send-data/collection/processing-rules)**. A Sumo Logic feature you can use to filter or forward log data ingested by Sumo Logic from a Sumo Logic source. You can use processing rules to include or exclude messages, and to mask or hash sensitive information in logs. You can also forward matching messages to external destinations, including AWS S3. **[Prometheus](/docs/send-data/collect-from-other-data-sources/collect-prometheus-metrics/)**. A metric format in which a time series is uniquely identified by its metric name and a set of labels in key-value pairs format. Sumo Logic’s [HTTP source](/docs/send-data/hosted-collectors/http-source) and [Streaming Metric source](/docs/send-data/installed-collectors/sources/streaming-metrics-source) support Prometheus metrics. Sumo Logic’s [Kubernetes solution](/docs/observability/kubernetes) also collects Prometheus metrics. @@ -321,13 +323,13 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Related signal](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a signal that isn't part of the current insight (not attached), but fired on the same entity as the current insight's attached signals within 7 days of those signals. -**[Relative expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m. +**[Relative expression](/docs/search/get-started-with-search/search-basics/time-range-expressions)**. Used in time range expressions, when setting the non-absolute time limits of a search. For example, -1d, -1d -12h, -12h -60m. **[Role](/docs/manage/users-roles/roles/)**. In Sumo Logic role-based access control (RBAC), you grant users access to data and to Sumo Logic functions using roles. You assign role capabilities and a role search filter to a role, and assign one or more roles to a user. **[Role search filter](/docs/manage/users-roles/roles/construct-search-filter-for-role)**. A search filter for a role defines what log data a user with that role can access. You can define a search filter using keywords, wildcards, and selected Sumo Logic metadata fields and logical operators. -**[Rollup tables](/docs/metrics/manage-metric-volume/metric-ingestion-and-storage)**. Metric data is stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data is retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months. +**[Rollup table](/docs/metrics/manage-metric-volume/metric-ingestion-and-storage)**. Metric data is stored in Sumo Logic as raw data points, and aggregated over one minute and one hour resolutions. The one minute and one hour aggregated metrics are referred to as rollup tables. Raw data is retained for 7 days, one-minute rollups for 30 days and one-hour rollups for 13 months. **[Rule](/docs/cse/rules/about-cse-rules)**. In Cloud SIEM, a set of logic that fires on incoming records and creates signals when its conditions are met. Cloud SIEM includes six rule types: **Match** (fires on a single record match), **Threshold** (fires when a record matches a minimum number of times in a time window), **Chain** (fires on combinations of event types over a time window), **Aggregation** (fires when aggregation conditions are met), **First Seen** (fires when an entity exhibits a behavior for the first time), and **Outlier** (fires when entity behavior deviates from its established baseline). @@ -353,9 +355,9 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[SOC Analyst Agent](/docs/cse/get-started-with-cloud-siem/soc-analyst-agent)**. An AI-powered Cloud SIEM feature that automatically investigates security insights, delivers evidence-backed verdicts (malicious, suspicious, or benign), and surfaces key findings from triggered signals to help security analysts triage faster and reduce false-positive noise. -**[Sources](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. +**[Source](/docs/send-data)**. Sources are configured on Sumo Logic collectors and collect customer data. -**[Subqueries](/docs/search/subqueries)**. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query. +**[Subquery](/docs/search/subqueries)**. Subqueries allow you to filter and evaluate conditions for a log query when you may not be sure of the exact filter or condition criteria but you can write a short query to set them for you. Subqueries use one query to pass results back to another query to narrow down or evaluate the set of messages that are searched in that query. **[Support account](/docs/manage/security/enable-support-account)**. A support account is a special Sumo Logic user account that you can enable so that Sumo Logic support personnel can access your Sumo Logic org. Typically, you enable your support account for a limited period of time, just long enough to allow Sumo Logic support to diagnose a problem or answer a question. diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index a1d9845bf24..3ff622d28f0 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -362,10 +362,10 @@ Avoid less common contractions, like “should’ve”, or “it’ll”. ## Dates +For dates in prose, we use American-style English (for example, `June 5` not `5 June`). + * Use the month’s full name (September). If space is a concern, use 3-letter abbreviations (Sep). -* Avoid writing dates numerically (7-25-17) and ordinal indicators (1st, 2nd, 3rd, 4th). Use the 12-hour clock unless the user has specified otherwise, followed by am or pm in lowercase letters without a space. -* When including a time zone, append the time zone’s abbreviation after the “am” or “pm”, separated by a space. -* To show a time range, use an en dash and include the “am” or “pm” after both times. +* Avoid writing dates numerically (7-25-17) and ordinal indicators (1st, 2nd, 3rd, 4th). :::note The notation used in the UI time range editor is an exception to some of these rules. @@ -1033,9 +1033,12 @@ When a feature becomes Generally Available (GA), remove all Preview-related labe ## Punctuation -Punctuation is placed outside of quotation marks, British English style. This keeps a quoted command, field value, or error string accurate. Trailing punctuation is not mistaken for part of it. For everything else (dates, times, spelling), we use American English style. +### Ampersands + +Do not use the ampersand symbol (`&`). Spell out as "and". ### Colons + Colons are used to introduce lists or to separate titles from subtitles. Only include the colon if the introduction isn’t a complete sentence. ### Commas @@ -1062,6 +1065,9 @@ Use ellipses for truncation. Don’t use ellipses for placeholders or trailing o In the UI, avoid periods for single sentences on their own. Whenever there are two or more sentences, use periods at the end of each sentence. Separate sentences by one space, not two. +### Quotation marks + +Punctuation is placed outside of quotation marks, U.K.-style English (for example, `"Hello",`, not `"Hello,"`). This keeps a quoted command, field value, or error string accurate, so that trailing punctuation is not mistaken for part of it. For everything else (dates, times, spelling), we use American-style English. ## Release notes @@ -1165,6 +1171,17 @@ Generative Engine Optimization improves the likelihood that AI-powered search to * **Use specific version numbers and dates.** Avoid "latest", "current", or "recent" without a specific value. AI tools reproduce whatever is on the page. Vague references become stale citations. * **Add an "At a glance" section for long pages.** For pages over 800 words, add a brief summary section near the top with key facts as short bullet points. This is the most citation-friendly portion of a page for generative AI tools. +## Time + +When writing about time, use American-style English, which uses the 12-hour clock, not military time. So you'd write `1:00pm`, not `13:00`. + +* Use the 12-hour clock unless the user has specified otherwise, followed by am or pm in lowercase letters without a space. +* When including a time zone, append the time zone’s abbreviation after the “am” or “pm”, separated by a space. +* To show a time range, use an en dash and include the “am” or “pm” after both times. + +:::note +The notation used in the UI time range editor is an exception to some of these rules. +::: ## UI elements diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 875b09bda12..9852eaf92f6 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -9,17 +9,15 @@ This word list gives the preferred spelling, capitalization, and punctuation for ## A -**Acronyms**. An acronym uses the first initials of a word or phrase, for brevity. Our industry is full of them, and they can get confusing if their usage isn't clear. Acronyms should be capitalized, if not used directly in a query, etc. Unless the usage is clear from the context, for the first usage, spell out the phrase, then present the acronym in parenthesis. For example: Secure Shell (SSH). +**Acronym**. See [Acronyms](/docs/contributing/style-guide/#acronyms) in the style guide. **Aggregates tab**. When referring to the Aggregates tab (where aggregate search results are displayed) the term Aggregates is capitalized. **Aka**. Don't use. Write out "also known as" instead. -**Ampersand (&)**. Don't use for "and". Spell out. - **Anomaly Detection**. Always capitalize. -**Apps**. When referring to a Sumo Logic app, do not capitalize. No need to spell out application. +**App**. When referring to a Sumo Logic app, do not capitalize. No need to spell out application. **Autocomplete**. One word, not two. The Sumo Logic feature is called Search autocomplete. @@ -69,7 +67,7 @@ This word list gives the preferred spelling, capitalization, and punctuation for **En dash**. Use the en dash (–) only for numeric and date ranges. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. -**Exclamation points !**. Use exclamation points only in warnings and greetings. Let your text convey the enthusiasm or importance of the statement. Don't make the reader wait until the exclamation point to find out the text is significant. +**Exclamation point (!)**. See [Exclamation points](/docs/contributing/style-guide/#exclamation-points) in the style guide. ## G @@ -83,13 +81,13 @@ This word list gives the preferred spelling, capitalization, and punctuation for ## H -**Hash rules**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. +**Hash rule**. Hash rules replace a message with a unique, randomly-generated code to protect sensitive or proprietary information. You may want to hash unique identifiers, such as credit card numbers or user names. By hashing this type of data, you can still track it, even though it's fully hidden. **Hibachi**. Project for content sharing and collaboration. Includes a new app catalog and app installation flow and a new library design. **Home Page**. Persistent tab, which services the Jiro and Hibachi projects by helping users get started and discover content more easily. -**Hosted collectors**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. +**Hosted collector**. Hosted collectors do not require installation or registration, nor do hosted collectors have physical requirements, since they're hosted by Sumo Logic in AWS. ## I @@ -135,7 +133,7 @@ This word list gives the preferred spelling, capitalization, and punctuation for ## O -**Operators**. When referring to a search operator in prose, capitalize the operator's name only if it begins a sentence. When the operator name is the subject of a heading or an entry (such as in the Glossary), write it lowercase in backticks: `` `where` operator ``, `` `parse` operator ``. +**Operators**. See [Operators](/docs/contributing/style-guide/#operators) in the style guide. **Org** / **Organization**. Use “org” instead of “organization”, as it sounds more conversational and is the term more commonly used by our customers. @@ -195,7 +193,7 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc ## T -**Tabs**. When you name a tab in Sumo Logic, bold the tab's name, match its on-screen capitalization, and keep the word "tab" lowercase and outside the bold. (Examples: **Welcome** tab, **Search** tab, **Status** tab.) See **UI labels**, below. +**Tab**. When you name a tab in Sumo Logic, bold the tab's name, match its on-screen capitalization, and keep the word "tab" lowercase and outside the bold. (Examples: **Welcome** tab, **Search** tab, **Status** tab.) See **UI labels**, below. **Text box**. Use text box, not field. A field is a special part of a query. @@ -218,7 +216,7 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc ## U -**UI labels**. When you name a UI element or page as it appears on screen, bold the label and match its on-screen capitalization: the **Search** page, the **Scheduled Views** page, on the **Aggregates** tab, select **Add to Dashboard**. Bold only the label; the generic word after it ("page", "tab", "button", "menu", "dialog", "field") stays lowercase and outside the bold. When you mean the underlying feature or concept rather than the on-screen control, use lowercase and no bold: "a scheduled view is a pre-aggregated index of your data", "run a search". See the style guide's [Bold](/docs/contributing/style-guide/#bold) and [Capitalization](/docs/contributing/style-guide/#capitalization) sections. +**UI labels**. See [Bold](/docs/contributing/style-guide/#bold) and [Capitalization](/docs/contributing/style-guide/#capitalization) in the style guide. ## W From 674ad39893c2635e78b9f135b73aabcf1ea17d09 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 19:15:38 -0700 Subject: [PATCH 13/14] DOCS-482 - Add time range en-dash reference and examples to style guide time section --- docs/contributing/style-guide.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/docs/contributing/style-guide.md b/docs/contributing/style-guide.md index 3ff622d28f0..b71ae549719 100644 --- a/docs/contributing/style-guide.md +++ b/docs/contributing/style-guide.md @@ -1049,7 +1049,7 @@ We use the Oxford (serial) comma. For example, use "I had eggs, toast, and orang Try not to use em dashes (the long dash) as they read as generic AI output. Rewrite instead: use a period or semicolon to split two independent clauses, a colon to introduce something, or commas or parentheses for a brief aside. -Use the en dash (–) only for numeric and date ranges, with no space on either side: `9–17`, `2023–2024`. See [Numbers](#numbers) and [Dates](#dates). +Use the en dash (–) only for numeric, date, and time ranges, with no space on either side: `9–17`, `2023–2024`. See [Numbers](#numbers), [Dates](#dates), and [Time](#time). Use the hyphen (-) for compound modifiers, such as `drop-down menu` or `read-only field`. @@ -1173,11 +1173,9 @@ Generative Engine Optimization improves the likelihood that AI-powered search to ## Time -When writing about time, use American-style English, which uses the 12-hour clock, not military time. So you'd write `1:00pm`, not `13:00`. - -* Use the 12-hour clock unless the user has specified otherwise, followed by am or pm in lowercase letters without a space. -* When including a time zone, append the time zone’s abbreviation after the “am” or “pm”, separated by a space. -* To show a time range, use an en dash and include the “am” or “pm” after both times. +* Use the 12-hour clock unless specified otherwise, followed by am or pm in lowercase letters without a space (for example, you'd write `1:00pm`, not `13:00`). +* When including a time zone, append the time zone’s abbreviation after the “am” or “pm”, separated by a space (for example, `1:00pm EST`). +* To show a time range, use an en dash and include the “am” or “pm” after both times (for example, `1:00pm–3:00pm`). :::note The notation used in the UI time range editor is an exception to some of these rules. From ed2e6a75dceaf2c24e12b6a92d3673484121fcc1 Mon Sep 17 00:00:00 2001 From: Kim Pohas Date: Tue, 22 Sep 2026 19:32:51 -0700 Subject: [PATCH 14/14] minor fixes --- docs/contributing/glossary.md | 48 ++++++++++++++++------------------ docs/contributing/word-list.md | 16 ++++++------ 2 files changed, 31 insertions(+), 33 deletions(-) diff --git a/docs/contributing/glossary.md b/docs/contributing/glossary.md index 4b2cc0e5f10..527676c0c2b 100644 --- a/docs/contributing/glossary.md +++ b/docs/contributing/glossary.md @@ -67,20 +67,20 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo [**Cloud SOAR**](/docs/cloud-soar). A security orchestration, automation, and response platform that helps security teams streamline incident response. Cloud SOAR automates repetitive tasks, orchestrates workflows across security tools, and tracks the full incident lifecycle. -**[Cloud-to-Cloud Integration Framework](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework)**. A fully-managed collection system that collects logs and events directly from SaaS and cloud platforms such as Salesforce, Microsoft 365, and Okta. The framework handles authentication, scheduling, and state tracking automatically. Also referred to as C2C. - -**[Credit](/docs/manage/manage-subscription/sumo-logic-credits-accounts)**. A unit of measure that tracks account usage, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. - - +**[Cloud-to-Cloud Integration Framework](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework)**. A fully-managed collection system that collects logs and events directly from SaaS and cloud platforms such as Salesforce, Microsoft 365, and Okta. The framework handles authentication, scheduling, and state tracking automatically. Also referred to as C2C. + **[Collector](/docs/send-data/choose-collector-source)**. Sumo Logic collectors are lightweight applications that allow you to connect your environment to Sumo Logic in order to collect message data. There are two types of collectors. Installed collectors are configured on machines in your deployment for sources such as Local File, Remote File, Syslog, Local Windows Event Logs, Remote Windows Event Logs, and Script. Hosted collectors require no installation, and are used to collect data from various services like Amazon S3 or over HTTP and Syslog. **[Content administrator](/docs/manage/content-sharing/admin-mode)**. In the Sumo Logic Library, you can choose **View as Content Administrator** to enter Admin mode, so you can manage content for your organization. In Admin mode you can migrate content from one location to another, and highlight important content in the **Admin Recommended** folder. **[Content sharing](/docs/manage/content-sharing)**. A Sumo Logic feature that allows you to share searches, dashboards, and folders with a user, a role, or combinations of the two. +**[Credit](/docs/manage/manage-subscription/sumo-logic-credits-accounts)**. A unit of measure that tracks account usage, whether data ingested (GB), storage, or metrics, throughout a contract period. Credits can be used as needed for your desired purpose. + @@ -102,7 +102,7 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Detected relationship](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a relationship detected between entities that appear together in a record, such as an IP address and hostname in the same log message, even if they are not part of the insight currently being viewed. Displayed as solid lines in the entity graph. - @@ -117,14 +117,14 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## E -**[Ephemeral](/docs/send-data/installed-collectors/collector-installation-reference/set-collector-as-ephemeral)**. Refers to data sources, such as containers, that are created and destroyed as appropriate, resulting in a high volume log data or metrics. In Sumo Logic, you can set a collector to be ephemeral. Sumo Logic deletes an ephemeral collector automatically after it has been offline for 12 hours. - **[Endpoint](/docs/api/about-apis/getting-started/#sumo-logic-endpoints-by-deployment-and-firewall-security)**. Sumo Logic has several pods that are assigned depending on the geographic location and the date an account is created. Sumo Logic redirects your browser to the correct login URL and also redirects collectors to the correct endpoint. However, if you're using an API you'll need to manually direct requests to the correct API endpoint; API calls are not redirected to another endpoint. **[Enrichment](/docs/cse/integrations/enrichments-and-indicators)**. In Cloud SIEM, addition of data to records that provides more information for analysis of security incidents. **[Entity](/docs/cse/records-signals-entities-insights/view-manage-entities)**. In Cloud SIEM, a unique actor encountered in incoming messages, such as a user, IP address, or host. +**[Ephemeral](/docs/send-data/installed-collectors/collector-installation-reference/set-collector-as-ephemeral)**. Refers to data sources, such as containers, that are created and destroyed as appropriate, resulting in a high volume log data or metrics. In Sumo Logic, you can set a collector to be ephemeral. Sumo Logic deletes an ephemeral collector automatically after it has been offline for 12 hours. + **[Exclude rule](/docs/send-data/collection/processing-rules/include-and-exclude-rules)**. Exclude rules are a type of processing rule that specifies log messages that you do not want to send to Sumo Logic, think of it as an "allowlist" filter. @@ -132,10 +132,10 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Favorite](/docs/get-started/library)**. The Favorites tab displays searches and dashboards that you refer to frequently, or content that you want to keep handy. In the Library, on the Personal and Org tabs, you can "favorite" content to make it appear on the Favorites tab. Just click the star icon for your saved search, dashboard, installed app, or folder, and it will be saved to the Favorites tab for easy access. You can also favorite saved searches from the Search page, and favorite from the **Dashboards** page. -**[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. - **[Field](/docs/manage/fields)**. Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as log metadata fields. +**[Field extraction rule](/docs/manage/field-extractions)**. Field extraction can be set up as rules that parse out fields as log messages are ingested. This means that instead of running a query to parse out fields, that work is done automatically so when it's time to run a search the fields are already available in results. + **[`fields` operator](/docs/search/search-query-language/search-operators/fields)**. A search operator that selects which fields to include or exclude from query results. Use allowlist mode to keep only specified fields, or denylist mode to drop specified fields and return the rest. **[Fingerprint](/docs/send-data/installed-collectors/configuration/#fingerprint)**. A fingerprint consists of the first 2048 bytes of a file and is used by installed collectors to track what data has been collected. @@ -179,11 +179,11 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, a group of signals clustered around a single entity that are generated when an entity’s Activity Score exceeds a threshold. -**[Installed collector](/docs/send-data/installed-collectors)**. Installed collectors are deployed in your environment, either on a local machine, a machine in your organization, or even an Amazon Machine Image (AMI). Installed collectors require a software download and installation. Upgrades to collector software are released regularly by Sumo Logic. - **[Installation token](/docs/manage/security/installation-tokens)**. Installation tokens are assigned to your organization and are used to register installed collectors to your Sumo Logic account. They do not expire and can only be used to register installed collectors. You can deactivate, reactivate, or delete tokens at any time. -**[Intrinsic tags](/docs/metrics/introduction/metric-formats#carbon-20)**. In Carbon 2.0-formatted metrics, intrinsic tags are the one or more space-separated key-value pairs that uniquely identify what is being measured. Intrinsic tags are also referred to as dimensions. +**[Installed collector](/docs/send-data/installed-collectors)**. Installed collectors are deployed in your environment, either on a local machine, a machine in your organization, or even an Amazon Machine Image (AMI). Installed collectors require a software download and installation. Upgrades to collector software are released regularly by Sumo Logic. + +**[Intrinsic tag](/docs/metrics/introduction/metric-formats#carbon-20)**. In Carbon 2.0-formatted metrics, intrinsic tags are the one or more space-separated key-value pairs that uniquely identify what is being measured. Intrinsic tags are also referred to as dimensions. ## K @@ -228,23 +228,21 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Messages tab](/docs/search/get-started-with-search/search-page/set-messages-tab-preferences)**. When you run a search query, messages display in the Messages tab in the lower half of the browser window of the Search page. -**[Metadata](/docs/send-data/data-enrichment)**. Data about other data. If the logs and metrics you ingest have associated metadata, you can leverage it for more targeted log searches and metric queries. Metadata for metrics includes both intrinsic tags and meta tags. - **[Meta tags](/docs/metrics/introduction/metric-formats#carbon-20)**. In Carbon 2.0-formatted metrics, meta tags are the key-value pairs for a metric that provide additional, but not identifying information about the thing being measured. A meta tag is a piece of metadata that might be useful in querying your metrics. -**[Metric rules editor](/docs/metrics/metric-rules-editor)**. A page in the Sumo Logic web app for creating metric rules. - -**[Metric rules editor](/docs/metrics/metric-rules-editor)**. A page in the Sumo Logic web app for creating metric rules. +**[Metadata](/docs/send-data/data-enrichment)**. Data about other data. If the logs and metrics you ingest have associated metadata, you can leverage it for more targeted log searches and metric queries. Metadata for metrics includes both intrinsic tags and meta tags. **[Metric rule](/docs/metrics/metric-rules-editor)**. A Sumo Logic feature that allows you to tag metrics with data derived from the metric identifier. Then, you can use those tags in metric queries. -**[Metric throttling](/docs/metrics/manage-metric-volume/metric-throttling)**. A Sumo Logic feature that throttles your metric sources when you exceed your DPM burst limit. Your ingestion is slowed down until the rate of ingestion is within the allowable contracted limits. +**[Metric rules editor](/docs/metrics/metric-rules-editor)**. A page in the Sumo Logic web app for creating metric rules. -**[Metrics transformation rules](/docs/metrics/metrics-transformation-rules)**. Metrics transformation rules allow you control how long raw metrics are retained. You can also aggregate metrics at collection time and specify a separate retention period for the aggregated metrics. +**[Metric throttling](/docs/metrics/manage-metric-volume/metric-throttling)**. A Sumo Logic feature that throttles your metric sources when you exceed your DPM burst limit. Your ingestion is slowed down until the rate of ingestion is within the allowable contracted limits. **[Metric volume index](/docs/manage/ingestion-volume/data-volume-index/metrics-data-volume-index)**. A Sumo Logic index to which Sumo Logic writes messages with information about the volume of metrics you are ingesting. - @@ -311,12 +309,12 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo ## R -**[Receipt time](/docs/search/get-started-with-search/build-search/use-receipt-time)**. You can display search results in the order that the collector received the messages in milliseconds. - **[RBAC](/docs/manage/users-roles/roles/role-based-access-control/)**. Sumo Logic supports Role-Based Access Control (RBAC) to allow administrators to customize system access. With RBAC, administrators create roles for groups of users who perform various job functions. Users are not assigned permissions directly, but inherit permissions through roles (or even through a single role). Role assignments can grant users permissions to access some data sets, or can restrict users from accessing types of data. **[Real User Monitoring (RUM)](/docs/apm/real-user-monitoring)**. A Sumo Logic APM capability that captures end-to-end user transactions directly in the browser using OpenTelemetry instrumentation. RUM records performance timings, rendering events, errors, and user cohort data so you can understand the quality of your web application experience. +**[Receipt time](/docs/search/get-started-with-search/build-search/use-receipt-time)**. You can display search results in the order that the collector received the messages in milliseconds. + **[Record](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, a collection of normalized data created from a message. **[Related insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui)**. In Cloud SIEM, an insight that a related signal is attached to. @@ -347,9 +345,9 @@ For general DevOps and security industry terms, see our [DevOps and Security Glo **[Search autocomplete](/docs/search/get-started-with-search/search-basics/search-autocomplete)**. On the Search page of the Sumo Logic user interface, the search autocomplete dropdown dialog offers suggestions to make query writing easier. Suggestions include simple logic that offers common default queries, keywords, metadata terms, and search operators. The autocomplete dialog also includes links to Help topics for more information. -**[Searchable time](/docs/search/get-started-with-search/build-search/use-searchable-time)**. You can display search results in the order in which logs become available for search after being received by the Sumo Logic system. +**[Search template](/docs/search/get-started-with-search/build-search/search-templates)**. Search templates simplify searches for users by providing easy to select input choices. You can have search templates replace any text in a query, including fields, keywords, and arguments to operators. -**[Search templates](/docs/search/get-started-with-search/build-search/search-templates)**. Search templates simplify searches for users by providing easy to select input choices. You can have search templates replace any text in a query, including fields, keywords, and arguments to operators. +**[Searchable time](/docs/search/get-started-with-search/build-search/use-searchable-time)**. You can display search results in the order in which logs become available for search after being received by the Sumo Logic system. **[Signal](/docs/cse/records-signals-entities-insights/view-records-signal)**. In Cloud SIEM, an indicator of an event of interest that fires when rule conditions are met. diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 9852eaf92f6..29be5cb6558 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -61,10 +61,10 @@ This word list gives the preferred spelling, capitalization, and punctuation for **E.g., i.e., and etc.** Don't use these abbreviations. Use "for example" instead of "e.g.", "that is" instead of "i.e.", and avoid "etc." by listing items explicitly or using "such as." See [Abbreviations](/docs/contributing/style-guide/#abbreviations) in the style guide. -**Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. - **Em dash**. Avoid em dashes (—). See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. +**Email**. Email is one word, lowercase. Do not use a hyphen, such as "e-mail". Do not capitalize if it is not at the beginning of a sentence. + **En dash**. Use the en dash (–) only for numeric and date ranges. See [Dashes](/docs/contributing/style-guide/#dashes) in the style guide. **Exclamation point (!)**. See [Exclamation points](/docs/contributing/style-guide/#exclamation-points) in the style guide. @@ -74,10 +74,10 @@ This word list gives the preferred spelling, capitalization, and punctuation for **GB and Gbit**. GB is the acronym for gigabytes. Gbit or Gb is the acronym for gigabits. Make sure to capitalize correctly. Don't use a space between the acronym and the number. (Example: 10GB or 15Gbit.) -**Geolocation**. Geolocation is one word. It is not capitalized unless used at the beginning of a sentence. - **Geo lookup operator**. Geo lookup is two words. +**Geolocation**. Geolocation is one word. It is not capitalized unless used at the beginning of a sentence. + ## H @@ -199,20 +199,20 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Third party**. Hyphenate as an adjective, not as a noun. For example, "We use third-party scripts" is hyphenated. But "Scripts are written by a third party" is not hyphenated. -**Timeline**. Timeline is one word, not two. - **Time range**. Time range is two words, not one. **Time series.** Time series is two words, not one. **Time slice**. Time slice is two words, not one. +**Time zone**. Time zone is two words, not one. + +**Timeline**. Timeline is one word, not two. + **Timeout / time out**. Use "timeout" as a noun or adjective in computing contexts. Use "time out" as a verb. Don't use "time-out." **Timestamp**. Timestamp is one word. -**Time zone**. Time zone is two words, not one. - ## U