DOCS-1869 - GEO fixes for the Page Backlog report

blog-service/2026-08-03-manage.md

@@ -9,4 +9,4 @@ keywords:
 hide_table_of_contents: true
 ---
 
-We're excited to announce that mid-subscription upgrades no longer reset burn rates on your existing credits. When you purchase additional credits at a different rate, Sumo Logic now tracks them as a separate credit block, so your original credits continue burning at their original rate instead of being repriced. [Learn more](/docs/manage/manage-subscription/sumo-logic-flex-accounts/#credit-blocks).
+We're excited to announce that mid-subscription upgrades no longer reset burn rates on your existing credits. When you purchase additional credits at a different rate, Sumo Logic now tracks them as a separate credit block, so your original credits continue burning at their original rate instead of being repriced. [Learn more](/docs/manage/manage-subscription/sumo-logic-flex-accounts/#what-are-credit-blocks).

docs/cloud-soar/introduction.md

@@ -2,11 +2,16 @@
 id: introduction
 title: Introduction to Cloud SOAR
 sidebar_label: Introduction
+keywords:
+  - Cloud SOAR
+  - SOAR
+  - incident response
+  - security automation
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This article provides an introduction to Cloud SOAR for analysts and administrators. 
+Cloud SOAR is Sumo Logic's Security Orchestration, Automation, and Response solution, which helps SOC analysts and administrators orchestrate and automate incident response using playbooks, dashboards, and case management. This article provides an introduction to Cloud SOAR for analysts and administrators. 
 
 If you are unsure whether you are an analyst or administrator, you can view your role in **Preferences** (see [Onboarding Checklists](/docs/get-started/onboarding-checklists/)).
 
@@ -97,7 +102,7 @@ In this section, you’ll get to know the different parts of the Cloud SOAR UI.
 
 ### Case management
 
-#### Cloud SOAR case management
+#### What is Cloud SOAR case management?
 
 Case management is like project management, but the project you’re working on is a cybersecurity threat. Case management helps set priorities, assign tasks, and communicate information across different teams.
 
@@ -113,7 +118,7 @@ When you log in to Cloud SOAR, you can use these main pages to get a sense of wh
 
 Since Cloud SOAR integrates with hundreds of technologies, you can also interact with multiple ticketing and case management systems. The API-based communication between technologies is bidirectional, meaning Cloud SOAR can both receive and send information, at any time.
 
-#### Threat Investigation with Cloud SOAR
+#### What is threat investigation in Cloud SOAR?
 
 One major component of case management is threat investigation.
 
@@ -295,7 +300,7 @@ You can use KPI reports to aggregate incidents that satisfy certain conditions.
 
 You can get creative with filters and create any kind of report you like.
 
-#### Best practices for dashboards and reports
+#### What are the best practices for dashboards and reports?
 
 There are several considerations when designing a dashboard or report. Here are a few best practices:
 * **Above the fold**. In print newspapers, the most important articles are placed "above the fold," which means the top half of the front page. When designing a dashboard or report, place the most important information at the top, so people will see it right away without needing to scroll.
@@ -324,7 +329,7 @@ Broadly speaking, Security Orchestration, Automation, and Response (SOAR) is a c
 
 Administrators configure these and other settings to help SOC analysts automate and orchestrate many processes that are a routine part of responding to security incidents. Playbook automation offloads many tedious and repetitive tasks from the SOC team, reducing response time and allowing SOC analysts to focus on other mission-critical tasks. Dashboards and reports help distribute knowledge to different teams to work together to orchestrate their response in a timely, synchronized manner. RBAC ensures that only authorized members of your SOC team can perform certain actions.
 
-#### The incident response cycle
+#### What is the incident response cycle?
 
 As a Cloud SOAR administrator, your task is to set up RBAC controls, configure settings, create templates, and use APIs. Your ultimate goal is to enable Cloud SOAR to automate and orchestrate many parts of the incident response cycle. The more tasks you can automate with Cloud SOAR, the more time the SOC analysts on your team can devote to other activities like threat hunting.
 
@@ -344,7 +349,7 @@ Let’s say one of the employees at your company accidentally downloaded some ma
 
 Many of these tasks, from identifying malware to restoring the system, can be automated through APIs and other integrations. All of these steps can be bundled together in a playbook. We could create a playbook called “Malware Detected” in Cloud SOAR. Then, instead of remembering to do each of these tasks individually, we can click “Execute” on the playbook, and all the tasks will be done automatically. We can even use Cloud SOAR to export a report after the incident is closed, and use that report to jumpstart the lessons learned discussion.
 
-#### Exploring Cloud SOAR settings for administrators
+#### What settings can Cloud SOAR administrators configure?
 
 Cloud SOAR administrators have privileged access to the Settings and Automation sections of the Cloud SOAR UI.
 
@@ -387,7 +392,7 @@ See:
 * [Incident labels](/docs/cloud-soar/settings/#incident-labels)
 * [Triage](/docs/cloud-soar/settings/#triage)
 
-#### Exploring Cloud SOAR Automations
+#### What automation features are available to Cloud SOAR administrators?
 
 In addition to settings, Cloud SOAR administrators have privileged access to the Automation section of the platform. For more information, see [Cloud SOAR Automation](/docs/cloud-soar/automation/). 
 
@@ -662,6 +667,48 @@ Let's create a custom automation rule. This rule will pull information from Clou
 1. Leave the other fields as their defaults, then click **Save**. 
 1. As a best practice, you can enable and test the new rule, but then disable it, since it can disrupt your environment. Continue testing your rule until their behavior is expected before deciding to enable it.
 
+## FAQ
+
+### What is Cloud SOAR?
+
+Cloud SOAR is Sumo Logic's Security Orchestration, Automation, and Response solution. It helps SOC analysts orchestrate and automate incident response with playbooks, and gives administrators role-based access controls, dashboards, and automation settings to configure it for their organization.
+
+### How is Cloud SOAR different from Cloud SIEM?
+
+Cloud SIEM focuses on the investigation phase of the security pipeline, while Cloud SOAR focuses on the response phase. You can use them together: investigate an insight in Cloud SIEM, then use the Actions button to send the information to Cloud SOAR to orchestrate the response.
+
+### What are playbooks in Cloud SOAR?
+
+Playbooks are automated or partially automated workflows made up of nodes, such as actions, conditions, and notifications, that respond to an incident. Cloud SOAR includes hundreds of prebuilt playbooks in App Central, and you can also build custom playbooks.
+
+### What cloud logging strategy should you use?
+
+Centralize logs from all your cloud, hybrid, and on-premises sources into one platform so you can query and visualize them together. Sumo Logic's security pipeline takes it further: ingested logs feed threat intelligence and Cloud SIEM, and Cloud SOAR then automates your response to the insights that pipeline surfaces.
+
+### How do you secure your cloud infrastructure?
+
+Combine centralized log collection, threat intelligence, and automated response. Sumo Logic's Log Analytics Platform ingests and correlates your cloud infrastructure logs, Cloud SIEM investigates the resulting insights, and Cloud SOAR automates the response with playbooks so your SOC team can contain, eradicate, and recover from incidents faster.
+
+### What should you monitor in your cloud environment?
+
+At minimum, monitor authentication events, network traffic, and infrastructure configuration changes, since this data is what Cloud SIEM's rules and Cloud SOAR's playbooks most commonly act on to generate and respond to insights.
+
+### What's the difference between CloudOps, DevOps, and SRE?
+
+CloudOps focuses on the day-to-day operation and monitoring of cloud infrastructure. DevOps focuses on collaboration between development and operations teams to ship software faster. SRE (Site Reliability Engineering) applies software engineering practices to keep systems reliable at scale. Sumo Logic's platform, including Cloud SIEM and Cloud SOAR, supports all three by centralizing the logs, metrics, and security events each of these teams needs.
+
+### How do you find trusted log analytics solutions for cloud-native infrastructure?
+
+Look for a log analytics platform that ingests data from cloud-native sources, like Kubernetes and container orchestration platforms, correlates it with threat intelligence, and integrates with a response tool. Sumo Logic's Log Analytics Platform, paired with Cloud SIEM and Cloud SOAR, provides that full pipeline for cloud-native environments.
+
+### What cloud native logging solutions are available for developers and DevOps teams?
+
+Sumo Logic offers cloud-native logging through hosted collectors, Kubernetes and container observability integrations, and OpenTelemetry support, giving developers and DevOps teams a single platform to collect, search, and visualize logs without managing their own logging infrastructure.
+
+### What's the difference between SIEM, EDR, XDR, and SOAR?
+
+SIEM (Security Information and Event Management) collects and correlates security data into insights. EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) focus on detecting threats on endpoints or across multiple security layers. SOAR (Security Orchestration, Automation, and Response) automates the response once a threat is detected. In a modern SOC workflow, Sumo Logic's Cloud SIEM handles the SIEM-style investigation, while Cloud SOAR handles the SOAR automation layer.
+
 ## Additional resources
 
 * Blogs: 

docs/cse/administration/custom-inventory-sources.md

@@ -3,28 +3,33 @@ id: custom-inventory-sources
 title: Configure a Custom Inventory Source
 sidebar_label: Custom Inventory Source
 description: Learn how to extract inventory data from your data sources
+keywords:
+  - Cloud SIEM inventory
+  - inventory data
+  - custom inventory source
+  - webhook
 ---
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This topic explains how you can extract inventory data from logs in Sumo Logic and send it to Cloud SIEM. If you want to leverage inventory data from a system or service that isn’t supported by a Sumo Logic Source inventory source, you can follow the instructions in this topic. This procedure assumes that you already ingest log data that contains inventory data.
+You can extract inventory data from logs already ingested in Sumo Logic and send it to Cloud SIEM using a scheduled search and a webhook, even if the source isn't a supported Sumo Logic inventory source. This topic explains how, and assumes that you already ingest log data that contains inventory data.
 
 Cloud SIEM uses *inventory data* (information about hosts and users in your environment) to provide context to signals. Inventory data can also be used in entity groups to set attributes on entities (users, hosts, and so on). Those attributes can be later used in detection rule definitions, to adjust the severity of signals (using criticality), and for further context in signals.
 
 Sumo Logic provides a number of Sources you can use to ingest inventory data from services such as Microsoft Azure AD, Carbon Black, and AWS EC2. For more information, see [Inventory Sources and Data](/docs/cse/administration/inventory-sources-and-data).
 
 
-## How it works
+## How does a custom inventory source work?
 
 In the steps below, you’ll configure a Sumo Logic [scheduled search](/docs/alerts/scheduled-searches) that returns inventory data that’s been ingested by your inventory source. You configure a Webhook connection as the alert type for the scheduled search. The webhook’s payload is inventory data, and its destination is an HTTP Source that you’ve set up to receive the data.
 
 
 ## Before you start
 
-Identify your source of inventory data and review the [Cloud SIEM inventory schema](#cloud-siem-inventory-schema) below. The schema identifies the attributes supported for the two different Cloud SIEM inventory types: user and computer. For each attribute in the user or host schema, identify the field from your inventory source that maps to the schema attribute. You’ll use this mapping when you set up a Webhook in [Step 2](#step-2-create-a-webhook-connection) below.
+Identify your source of inventory data and review the [Cloud SIEM inventory schema](#what-is-the-cloud-siem-inventory-schema) below. The schema identifies the attributes supported for the two different Cloud SIEM inventory types: user and computer. For each attribute in the user or host schema, identify the field from your inventory source that maps to the schema attribute. You’ll use this mapping when you set up a Webhook in [Step 2](#step-2-create-a-webhook-connection) below.
 
 
-## Limitations
+## What are the limitations of this method?
 
 This approach uses Scheduled Searches, which are limited to 100 unique rows of data each time they trigger. This means that if you have more than 100 inventory items, only the first 100 will be sent using this method.
 
@@ -62,7 +67,7 @@ In this step, you create a webhook that points to the HTTP source.
 
 ## Step 3: Create search query
 
-In this step, you create a log query that extracts inventory-related fields from your inventory source. Refer to [Cloud SIEM inventory schema](#cloud-siem-inventory-schema) for the inventory attributes that are supported for host and user objects.
+In this step, you create a log query that extracts inventory-related fields from your inventory source. Refer to [Cloud SIEM inventory schema](#what-is-the-cloud-siem-inventory-schema) for the inventory attributes that are supported for host and user objects.
 
 
 ## Step 4: Create a Scheduled Search
@@ -81,7 +86,7 @@ In this step, you schedule the search you created above to send results to the W
     8. **Alert Type**. Select Webhook,  and pick the one you created that goes to the HTTP Endpoint. Check **Send a separate alert for each search result**.
     9. **Location to save to**. Choose a folder location for the search. <br/><img src={useBaseUrl('img/cse/save-item-4.png')} alt="Refreshed Save Item dialog" style={{border: '1px solid gray'}} width="450"/>
 
-## Cloud SIEM inventory schema
+## What is the Cloud SIEM inventory schema?
 
 This section defines the attributes in the Cloud SIEM inventory schema for hosts and users. Note that the same attributes can be used for either host or user inventory data.
 
@@ -266,4 +271,26 @@ _sourceCategory="security/jamf" and _collector="Jamf"
 * The `source` key is an arbitrary string that identifies the source of the inventory data.
 * The `customInventory` key identifies the payload as custom inventory data. You must include this in your webhook payload.
 * The `type` key specifies what type of inventory data the webhook sends. Set the value to _user_ or _computer_. You must include this in your webhook payload.
-:::
+:::
+
+## FAQ
+
+### Why would you create a custom inventory source?
+
+Create a custom inventory source when you want to use inventory data (information about hosts and users) from a system or service that isn't already supported by a Sumo Logic inventory source, so Cloud SIEM can use it for context in signals and entity groups.
+
+### How much inventory data can you send with this method?
+
+Scheduled searches are limited to 100 unique rows of data each time they trigger. If you have more than 100 inventory items, only the first 100 are sent using this method.
+
+### What inventory types does Cloud SIEM support?
+
+Cloud SIEM supports two inventory types: user and computer (host). Each has its own set of supported attributes that you map from your inventory source's fields.
+
+### Do you need to modify existing metadata to use a custom inventory source?
+
+No. Setting up a custom inventory source only requires an HTTP Source, a webhook connection, and a scheduled search — you don't need to change the metadata or source categories on your existing sources.
+
+### Can you use a custom inventory source to set entity criticality?
+
+Yes. Attributes ingested through a custom inventory source can be used in entity groups to set attributes on entities, which you can then use in detection rule definitions and to adjust signal severity through criticality.