You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps.md
+13-13Lines changed: 13 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -25,10 +25,10 @@ You must have the following [organization role capabilities](/docs/manage/users-
25
25
* View Organizations
26
26
* Create Organizations
27
27
* Manage Organizations
28
-
28
+
29
29
### Multi-insights list page in Cloud SIEM
30
30
31
-
If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations).
31
+
If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations).
32
32
33
33
<!-- After this article is no longer beta, show the following text:
34
34
This multi-insights list page (also known as a "federated" page) shows insights just as in a normal insights list page. When you click an insight on the page, you are automatically signed in to the child organization (if SSO is enabled for the child organization), and the insight's details open in the child organization's UI. You can also use the board view on the multi-insights page to move insights to different statuses.
@@ -38,20 +38,20 @@ To be able to see insights in child organizations, add child organizations that
38
38
39
39
## Manage content in organizations
40
40
41
-
MSSP administrators must ensure that the content of their child organizations is properly configured. To ensure that content is consistent across your organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
41
+
MSSP administrators must ensure that the content of their child organizations is properly configured. To ensure that content is consistent across your organizations, use the **Manage Content** tab to update content in target organizations with content from a source organization.
42
42
43
43
1.[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.<br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.
44
-
1. Select the **Manage Content** tab.
45
-
1. In the **Source** field, select the organization that will provide the source data to be updated in target organizations.
1. In the **Source** field, select the organization that will provide the source data to be updated in target organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-source-org.png')} alt="Manage Content tab" style={{border: '1px solid gray'}} width="500"/>
46
46
1. In the **Content** bar, select the type of content to update:
47
-
***Cloud SIEM Rules**. For more information about Cloud SIEM rules, see [Cloud SIEM Rules](/docs/cse/rules/).
48
-
***Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, see [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).
49
-
***Library**. For more information about Library items, see [Managing Your Sumo Logic Library](/docs/get-started/library/).
47
+
***Cloud SIEM Rules**. For more information about Cloud SIEM rules, see [Cloud SIEM Rules](/docs/cse/rules/).<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-cse-rules.png')} alt="Cloud SIEM rules" style={{border: '1px solid gray'}} width="600"/>
48
+
***Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, see [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-cse-rule-tuning.png')} alt="Cloud SIEM rule tuning expressions" style={{border: '1px solid gray'}} width="600"/>
49
+
***Library**. For more information about Library items, see [Managing Your Sumo Logic Library](/docs/get-started/library/).<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-library.png')} alt="Library items" style={{border: '1px solid gray'}} width="600"/><br/>
50
50
Items appear in **Library** only after they have been [shared with Administrator view access](/docs/manage/content-sharing/):<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-admin-view-access.png')} alt="Administrator view access" style={{border: '1px solid gray'}} width="600"/>
51
51
1. Select individual items to be updated, or all items.
1. On the **Update Selected Items** box, click **Destinations** to select the organizations to update the selected items to. You can update to all organizations, a single organization, or multiple organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2.png')} alt="Update Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
54
-
1. Click **Update**. An **Updating in progress** dialog is displayed.
54
+
1. Click **Update**. An **Updating in progress** dialog is displayed.
55
55
56
56
### Tips
57
57
@@ -63,15 +63,15 @@ MSSP administrators must ensure that the content of their child organizations is
63
63
### Limitations
64
64
65
65
* If an item with the same name exists in the target organization, it will be replaced.
66
-
* Once an update is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
66
+
* Once an update is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
67
67
* If errors occur during update, administrators must manually re-attempt failed updates. To see failed updates, use [View History](#view-history).
68
68
* Update operations may take longer based on the volume of content being updated.
69
69
* Rule tuning expressions must be updated separately from rules.
70
70
71
71
### View history
72
72
73
73
1. Click **View History** in the upper-right corner of the page. <br/>A query for update history displays:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query.png')} alt="View History query" style={{border: '1px solid gray'}} width="800"/>
74
-
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The update history displays. The success or failure of the update appears in the **status** column. The email of the individual who performed the update appears in the **user_email** column. The updated items appear in the **content** column.
74
+
1. Click the search button. <img src={useBaseUrl('img/manage/subscriptions/search-button.png')} alt="Search button" width="75"/> <br/>The update history displays. The success or failure of the update appears in the **status** column. The email of the individual who performed the update appears in the **user_email** column. The updated items appear in the **content** column.
75
75
1. Investigate any updates that failed and re-run the update if needed.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-view-history-query-results.png')} alt="View History query results" style={{border: '1px solid gray'}} width="800"/>
76
76
77
77
### View updates in the audit log
@@ -106,7 +106,7 @@ _index=sumologic_audit_events
106
106
***What if errors occur during updating?**<br/>Affected items will be skipped. Once the rest of the content is updated, you can review errors in [View History](#view-history) and retry.
107
107
***Can I roll back changes after an update operation?**<br/>No, rollback is not supported. After an update operation is initiated, changes cannot be reversed.
108
108
***How can I monitor update progress?**<br/>During an update, the system displays real-time status, including progress tracking, success or failure messages, and error logs.
109
-
***How can I view update history?**<br/>Click [**View History**](#view-history) in the upper-right corner of the page. A query for update history will display, showing the email of the individual who performed the update and the updated items.
109
+
***How can I view update history?**<br/>Click [**View History**](#view-history) in the upper-right corner of the page. A query for update history will display, showing the email of the individual who performed the update and the updated items.
110
110
***Who can I contact for additional questions or support?**<br/>Reach out to your Sumo Logic representative with any questions, issues, or feedback.
111
111
112
112
#### Rules updates
@@ -116,4 +116,4 @@ _index=sumologic_audit_events
116
116
#### Rule tuning expressions updates
117
117
118
118
***What happens if the source tuning expression contains Cloud SIEM rules?**<br/>If the **Include Linked Cloud SIEM Rules** option is selected, existing rules with the same name in the destination organization will be linked to match the source tuning expression.
119
-
***What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.
119
+
***What if no matching Cloud SIEM rules are found in the destination organization?**<br/>The update will complete with a warning, and missing rules will be logged in the audit log. You can update those rules separately and re-run the tuning expression update.
0 commit comments