})
+
+We're happy to announce enhancements to Cloud Infrastructure for AWS. These capabilities were [previously only available in a preview form](/release-notes-service/2024/05/13/apps/). They are now available for general use.
+
+You can now more easily configure sources on a simplified screen, allowing you to use existing sources or create new sources.
+
+})
+
+[Learn more](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/).
\ No newline at end of file
diff --git a/cid-redirects.json b/cid-redirects.json
index 964465abdb..634eb663b4 100644
--- a/cid-redirects.json
+++ b/cid-redirects.json
@@ -2646,9 +2646,9 @@
"/cid/19901": "/docs/metrics/metrics-operators/topk",
"/cid/19902": "/docs/metrics/metrics-operators/where",
"/cid/15631": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/citrix-cloud-source",
- "/cid/15634": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-gcp-source",
- "/cid/15632": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-azure-plugin-source",
- "/cid/15633": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-source",
+ "/cid/15634": "/docs/c2c/info/",
+ "/cid/15632": "/docs/c2c/info/",
+ "/cid/15633": "/docs/c2c/info/",
"/cid/14323": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/docusign-source",
"/cid/14324": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zendesk-source",
"/cid/14326": "/docs/integrations/global-intelligence/kubernetes-devops",
diff --git a/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws.md b/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws.md
index 2cfdb19f8f..3b1344e50c 100644
--- a/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws.md
+++ b/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws.md
@@ -120,7 +120,6 @@ This section describes prerequisites and guidelines for deploying Sumo Logic’s
### Prerequisites
-* **AWS Organizations**. You must be using [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html).
* **AWS data**. You must have access to data from the following AWS products, since Cloud Infrastructure Security for AWS uses data from these sources in its dashboards:
* [Amazon CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html)
* [Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html)
@@ -133,13 +132,14 @@ This section describes prerequisites and guidelines for deploying Sumo Logic’s
* View Collectors
* Manage Collectors
* Manage Content
+ * Manage Apps
* Security
* Create access keys
* Alerting
* View Monitors
* Manage Monitors
* **Sumo Logic Access ID and Key**. When you deploy the solution, you’ll need to supply a Sumo Logic [Access ID and Access Key](/docs/manage/security/access-keys/), which enable you to use Sumo Logic APIs. Make sure you have the role capabilities listed above before generating the Access ID and Key.
-* **AWS credentials**. To deploy the solution, you will need to log onto the [AWS Console](https://console.aws.amazon.com/console). For the CloudFormation template deployment, your AWS role must have the permissions described by [this JSON file](https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/AWSCISCFTemplatePermissions.json). As necessary, you may add JSON text to an existing or a new policy associated with an AWS IAM role as described in the [AWS documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.html). You can set this up during installation. For more information, see [Step 2: Check AWS role permission](#step-2-check-aws-role-permission).
+* **AWS credentials**. To deploy the solution, you will need to log onto the [AWS Console](https://console.aws.amazon.com/console). For the CloudFormation template deployment, your AWS role must have the permissions described by [this JSON file](https://sumologic-appdev-aws-sam-apps.s3.amazonaws.com/AWSCISCFTemplatePermissions.json). As necessary, you may add JSON text to an existing or a new policy associated with an AWS IAM role as described in the [AWS documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.html). You can set this up during installation. For more information, see [Create new source: Check AWS role permission](#create-new-source-check-aws-role-permission).
* **Monitors**. The Cloud Infrastructure Security for AWS solution comes with pre-packaged alerts in the form of Sumo Logic Monitors. To learn more about their capabilities, visit the [Monitors](/docs/alerts/monitors/) page.
### AWS regions supported
@@ -172,7 +172,7 @@ When you deploy the solution, consider the following.
#### Do you already have the required sources?
-When you deploy, you are given the option to create the Sumo Logic sources that the solution applications rely upon. If you have already configured those sources, you do not have to create new ones. You can just provide the URLs of the relevant Sumo Logic sources as part of the configuration.
+When you deploy, you are given the option to create the Sumo Logic sources that the solution applications rely upon. If you have already configured those sources, you do not have to create new ones. You can just provide the URLs of the relevant Sumo Logic sources as part of the configuration. See [Install Cloud Infrastructure Security for AWS](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#install-cloud-infrastructure-security-for-aws) below.
:::note
If you use existing sources rather than create new ones, it is not necessary to modify the existing metadata and source categories associated with the sources. The metadata that the solution depends on will be added to the sources at deployment time.
@@ -180,48 +180,115 @@ If you use existing sources rather than create new ones, it is not necessary to
#### Bucket considerations
-In the sections of the CloudFormation template that relate to creating Sumo Logic sources, you can specify an existing S3 bucket to store the logs that the source collects. If you don’t supply a bucket name, the template will create a new one. We recommend you use an existing bucket if possible.
+In the sections of the CloudFormation template that relate to creating Sumo Logic sources, you can specify an existing S3 bucket to store the logs that the source collects. If you don’t supply a bucket name, the template will create a new one. We recommend you use an existing bucket if possible. See [Create new source: Deploy AWS](#create-new-source-deploy-aws) below.
+
+#### Account or organization deployment
+
+You can deploy Cloud Infrastructure Security to a single account or all accounts in your AWS organization. See [Create new source: Deploy AWS](#create-new-source-deploy-aws) below.
+
+#### Multi-region enablement
+
+Cloud Infrastructure Security supports collecting data from multiple regions if you have any of the following services running in multiple regions in your AWS infrastructure. You can enable multiple regions when you perform the steps in the [Create new source: Deploy AWS](/docs/security/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/#create-new-source-deploy-aws) section below.
+
+##### GuardDuty
+
+While deploying, enter comma-separated values for regions in the following section:
+
+})
+
+##### SecurityHub
+
+While deploying, enter comma-separated values for regions in the following section:
+
+})
+
+##### CloudTrail
+
+On the AWS side, [configure CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html) to deliver log files from multiple regions to a single S3 bucket for a single account, and use that S3 bucket in the following section:
+
+})
+
+:::note
+If an S3 bucket is created by the Cloud Infrastructure Security solution, then make sure on the AWS side that it is a central bucket for CloudTrail logs for all regions from the AWS side.
+:::
+
+##### AWS Firewall Manager
+
+On the AWS side, [configure Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-s3.html) to deliver log files from multiple regions to a single S3 bucket for a single account, and use that S3 bucket in the following section:
+
+})
+
+:::note
+If the S3 bucket is created by the Cloud Infrastructure Security solution, then make sure on the AWS side that it is a central bucket for Network Firewall for all regions.
+:::
+
+##### AWS WAF
+
+Configure WAF in each region to send logs to [Kinesis data firehose destination](https://docs.aws.amazon.com/waf/latest/developerguide/logging-destinations.html), and from there, use the same [Sumo Logic’s Kinesis HTTP URL](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source/) in Firehose configuration to send logs to Sumo Logic.
+
+})
+
+})
+
+:::note
+If Sumo Logic’s Kinesis Firehose source is created by the Cloud Infrastructure Security solution, then make sure on the AWS side that the same Sumo Logic Kinesis HTTP URL is used while configuring the WAF Logging Kinesis destination.
+:::
+
+})
## Install Cloud Infrastructure Security for AWS
You can install Cloud Infrastructure Security for AWS from the App Catalog to use the pre-configured dashboards that provide visibility into your environment for real-time analysis of usage.
1. From the **App Catalog**, search for and select **Cloud Infrastructure Security for AWS**.
-1. Click **Install App**. The following screen is displayed. })
+1. Click **Install App**.
+1. For each of the data source types listed, select whether to use an existing source, create a new source, or do not collect data for that source type:
+ * **Use Existing Source**. Select this option if collection is already set up for that particular service and data is coming into Sumo Logic under a specific _sourceCategory. Select the _sourceCategory from the dropdown menu.})
+ * **Create New Source**. Select this option when you want to set up Sumo Logic collection for that particular service. Type the name you want to use for the source. })
+ * **Do Not Collect**. Select this option if you do not want to collect data from that particular service. If you choose this option, then collection for the service will not be set up and the corresponding dashboards in the Cloud Infrastructure Security solution will not contain data.
+1. Click **Next**.
-In the **Select Region** section, select the [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html#Concepts.RegionsAndAvailabilityZones.Regions) where you want to deploy the solution. For information about where your Sumo Logic data is stored in AWS, see [Where is My Data Stored?](/docs/get-started/faq/#where-is-my-data-stored)
- :::info
- This step is critical. If you do not select the correct region, you will deploy the solution in the wrong region.
- :::
+### Create new source: Select region
-})
+If you selected **Create New Source** for any source on the [**Configure Sources** screen](#install-cloud-infrastructure-security-for-aws), in the **Select Region** section select the [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html#Concepts.RegionsAndAvailabilityZones.Regions) where you want to deploy the solution.
+
+For information about where your Sumo Logic data is stored in AWS, see [Where is My Data Stored?](/docs/get-started/faq/#where-is-my-data-stored)
+
+To collect data from multiple regions, see [Multi-region enablement](#multi-region-enablement).
+
+:::info
+This step is critical. If you do not select the correct region, you will deploy the solution in the wrong region.
+:::
-### Step 2: Check AWS role permission
+
-In the **Check AWS Role Permission** section, you can ensure the user performing the installation has the proper permissions. Sumo Logic provides a CloudFormation template to perform a security policy check.
+### Create new source: Check AWS role permission
-})
+If you selected **Create New Source** for any source on the [**Configure Sources** screen](#install-cloud-infrastructure-security-for-aws), perform the steps below.
1. Follow the steps provided in the **Check AWS Role Permission** section of the screen:
1. Create and attach a policy to your user as described in the [AWS documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-and-attach-iam-policy.html).
- 1. Click the JSON file link and add to your policy the permissions contained in the file.
+ 1. Click the JSON file link and add to your policy the permissions contained in the file.
1. Click **Check AWS Role Permission**. This launches a CloudFormation Template that will verify your user has the correct permissions.
1. Sign in the [AWS Console](https://console.aws.amazon.com/console/). After you sign in, the following screen is displayed. })
-1. In **Stack Name**, enter a name for the stack. The stack name can include letters (A-Z and a-z), numbers (0-9), and dashes (-).
+1. In **Provide a stack name**, enter a name for the stack. The stack name can include letters (A-Z and a-z), numbers (0-9), and dashes (-).
1. Scroll down to the **Parameters** section.
-1. In **1. Sumo Logic Configuration**, you can accept the defaults. })
-1. A CloudFormation template screen is displayed. In **Stack Name**, enter a name for the stack. The stack name can include letters (A-Z and a-z), numbers (0-9), and dashes (-).})
+1. Under **Deploy AWS**, click the **Deploy AWS Security** button and select from the dropdown:
+ * **Deploy to single account**. Deploy the solution only to the account of the user installing the application.
+ * **Deploy to all accounts**. Deploy the solution to all accounts in your AWS organization. All users in the organization will have access to the application.
+1. Click **Next**. A CloudFormation template screen is displayed.
+ :::important
+ You can accept the defaults shown on this CloudFormation template screen. Fields have been autofilled based on your choices on the [**Configure Sources** screen](#install-cloud-infrastructure-security-for-aws). You only need to change values if any are missing or incorrect. Carefully review the values to ensure they are correct.
+ :::
+1. In **Stack Name**, enter a name for the stack. The stack name can include letters (A-Z and a-z), numbers (0-9), and dashes (-).
1. Scroll down to the **Parameters** section.
1. In **1. Sumo Logic Configuration**, you can accept the defaults. })
-1. In **2. AWS Organization configuration**, enter the following:
+1. In **2. AWS Organization configuration**, enter the following. (This step is required only if you are installing the solution to all accounts in your AWS organization.)
* **Security-tooling account ID**. Enter your Security Tooling account ID. This is used to set up the AWS CloudWatch, Lambda, Kinesis, S3 bucket, and SNS topic for collecting AWS GuardDuty, Security Hub, WAF, and Network Firewall data.
* **Log-archiving account ID**. Enter your log-archiving account ID. This is used to set up an S3 bucket and SNS topic for collecting the AWS CloudTrail data.
:::note
@@ -268,8 +341,8 @@ In this step, you perform the steps needed to deploy the Cloud Infrastructure Se
:::note
You can find the values for this dialog in the **Organizational structure** section of your [AWS accounts](https://console.aws.amazon.com/organizations/v2/home/accounts) page. Sign in to the AWS console, click on your profile in the top-right corner, select **Organization**, and in the left nav bar select **Policy management > AWS accounts**. You must have the correct permissions to view the account IDs. For more information about organizations, see [AWS documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_details.html).})
:::
-1. In **3. AWS Service configuration**, select **Yes** for each of the following sources you want to install for Sumo Logic, or **No** if you already have the source installed:
- * **Publish AWS GuardDuty data to Sumo**
+1. In **3. AWS Service configuration**, fields have been autofilled based on your choices on the [**Configure Sources** screen](#install-cloud-infrastructure-security-for-aws). You only need to change values if any are missing or incorrect. Carefully review the values to ensure they are correct.
+ * **Publish Amazon GuardDuty data to Sumo**
* **Publish AWS CloudTrail data to Sumo**
* **Publish AWS Security Hub data to Sumo**
* **Publish AWS WAF data to Sumo**
@@ -280,12 +353,14 @@ In this step, you perform the steps needed to deploy the Cloud Infrastructure Se
})
})
+ * **Sumo Logic HTTP logs source category name**. The source category name to be created. If you selected **No** in the previous field, provide an existing source category name from the Security Hub logs.
+ * **6.2 Security Hub Service Configuration**.
+ * **Security Hub Regions**. The regions from which Security Hub data should be sent. To enable multiple regions, enter regions in a comma-separated list. See [Multi-region enablement](#multi-region-enablement) above.
})
})
- })
+1. Under **Permissions**, in **IAM role - optional**, choose the IAM role for CloudFormation to use for all operations performed on the stack. The role must have permissions to set up the necessary Lambdas, S3 buckets, Kinesis streams, and other objects needed in the CloudFormation template, as well as access to the appropriate logs. If your AWS role does not have the necessary permissions, see [Create new source: Check AWS role permission](#create-new-source-check-aws-role-permission).
1. Under **Capabilities and transforms**, select the acknowledgement boxes.
1. Click **Create Stack**. The stack is created, and the solution is installed.
If any errors occur, see [Troubleshoot installation](#troubleshoot-installation).
-### Step 4: Start using the solution
+### Start using the solution
-After the solution is installed, a new step is displayed at the bottom of the **Deploy Cloud Infrastructure Security** screen.
+After the solution is installed, you can view its [monitors](#cloud-infrastructure-security-for-aws-monitors), [dashboards](#cloud-infrastructure-security-for-aws-dashboards), and saved searches.
-1. Click **Start Using Sumo**. })
-1. Select an option to start using the solution. })
+})
## Troubleshoot installation
@@ -449,6 +513,44 @@ To uninstall the Cloud Infrastructure Security solution:
1. Select the main stack you want to delete.
1. Select **Delete**.})
+## Cloud Infrastructure Security for AWS monitors
+
+Following are monitors included with the solution:
+
+* **Admin Privileges Granted**. Detects when administrative privileges are granted to a user or role. This is crucial for monitoring and controlling access to sensitive resources and ensuring that only authorized personnel have administrative capabilities.
+* **Amazon GuardDuty BruteForce finding**. Alerts on brute force attacks detected by Amazon GuardDuty. These attacks typically involve repeated attempts to gain unauthorized access to a system using various password combinations.
+* **Amazon GuardDuty InstanceCredentialExfiltration finding**. Triggers when GuardDuty detects potential exfiltration of instance credentials. This could indicate that an attacker is attempting to steal and use the credentials outside of the AWS environment.
+* **CloudTrail Changes**. Monitors changes in AWS CloudTrail configurations, which track API calls and activities in your AWS account. Changes to CloudTrail could indicate attempts to hide malicious activities.
+* **Config Changes**. Tracks changes to AWS Config settings. AWS Config monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.
+* **Critical GuardDuty Alerts**. Alerts on critical severity findings from Amazon GuardDuty. These findings typically indicate severe security threats that require immediate attention and remediation.
+* **EC2 instance accessed from malicious IP**. Alerts when an EC2 instance is accessed from an IP address identified as malicious by threat intelligence feeds. This could signify a potential breach or unauthorized access attempt.
+* **High Severity GuardDuty Alerts**. Triggers on high severity findings from Amazon GuardDuty, indicating significant security threats that need prompt investigation and action.
+* **Important GuardDuty Alerts**. Alerts on important severity findings from Amazon GuardDuty. These findings are notable and should be investigated to ensure they do not escalate into more severe issues.
+* **Landspeed Violations**. Detects landspeed violations, which generally refer to unusual and rapid movements of data or activities across different regions that could indicate data exfiltration or unauthorized operations.
+* **Low Severity GuardDuty Alerts**. Monitors low severity findings from Amazon GuardDuty. While these findings may not require immediate action, they should be reviewed to ensure they do not evolve into more significant threats.
+* **Medium Severity GuardDuty Alerts**. Alerts on medium severity findings from Amazon GuardDuty. These findings indicate moderate security threats that should be investigated and addressed appropriately.
+* **Root Account Login**. Triggers when there is a login to the AWS root account. Root account access should be highly restricted and monitored due to its unrestricted access to all resources in the account.
+
+## Cloud Infrastructure Security for AWS saved searches
+
+Following are saved searches included with the solution:
+
+* **Admin Privileges Granted**. Detects when administrative privileges are granted to a user or role, helping to monitor and control access to sensitive resources.
+* **Control Failure Findings Details by Severity**. Provides detailed information on control failures categorized by their severity levels, aiding in prioritizing remediation efforts.
+* **Creation of IAM Role**. Monitors the creation of new IAM roles, which can grant permissions to users, applications, or services within AWS.
+* **Deleted Resources Over Time**. Tracks resources that have been deleted over time, which can help in understanding changes to the environment and identifying potential issues.
+* **Exposed S3 Bucket Created**. Alerts when an S3 bucket is created with permissions that make it publicly accessible, which can lead to data leaks.
+* **Gateway Changes**. Monitors changes to internet gateways, NAT gateways, and other related configurations that can affect network traffic flow.
+* **IAM Policy Changes**. Tracks changes to IAM policies, which define permissions for users and roles, helping to ensure security policies are enforced properly.
+* **Least Common Out of Compliance Findings**. Identifies the least common compliance issues, which may highlight rare but potentially severe misconfigurations or vulnerabilities.
+* **Most Common Out of Compliance Findings**. Identifies the most frequent compliance issues, helping to prioritize common problems that need attention.
+* **Network ACL Changes**. Monitors changes to Network Access Control Lists (ACLs), which control inbound and outbound traffic at the subnet level.
+* **New Admins Added**. Alerts when new administrative users are added, ensuring that administrative access is appropriately monitored and controlled.
+* **Route Table Changes**. Tracks changes to route tables, which control the traffic routing in VPCs, ensuring network routes are configured as intended.
+* **S3 Bucket Changes**. Monitors changes to S3 bucket configurations, which can affect data security and accessibility.
+* **Security Group Changes**. Tracks changes to security groups, which act as virtual firewalls for controlling inbound and outbound traffic to AWS resources.
+* **VPC Changes**. Monitors changes to Virtual Private Cloud (VPC) settings, which can impact the overall network architecture and security.
+
## Cloud Infrastructure Security for AWS dashboards
import FilterDashboards from '../../reuse/filter-dashboards.md';
@@ -460,7 +562,7 @@ import FilterDashboards from '../../reuse/filter-dashboards.md';
To most efficiently use the solution to address security concerns, we recommend using the dashboards in the following workflow:
1. Look at the [Risk Overview](#risk-overview) dashboard to get an overall picture of the security posture of your environment. Pivot or browse to other dashboards to see details in each area.
1. Look at activity displayed in the [Active Threats](#active-threats-dashboards) dashboards to find issues that need immediate attention.
-1. View the [Security Control Failures](#security-control-failures-dashboards) dashboards to find areas that are identified as failing to meet compliance requirements, and therefore possibly pose a security risk.
+1. View the [Security Control Failures](#security-control-failures---aws-security-hub) dashboard to find areas that are identified as failing to meet compliance requirements, and therefore possibly pose a security risk.
1. Review the [Suspicious Activity](#suspicious-activity-dashboards) dashboards to uncover suspicious activity that may need investigation.
1. Pivot into the [Risk Overview](#risk-overview) dashboard for specific resources that have issues to see any related activity. Review the action plan presented at the bottom of the dashboard to work through the items identified as needing attention.
@@ -507,46 +609,12 @@ The **Cloud SIEM Insights Overview** dashboard runs advanced threat detection (C
})
-### Infrastructure Overview
-
-The **Infrastructure Overview** dashboard helps you identify all accounts, services, and resources within your cloud environment. It helps you get deep visibility into your cloud infrastructure to understand how many cloud resources are running and their configurations.
-
-:::note
-This dashboard is in [preview](/release-notes-service/2024/05/13/apps/). To see data in this dashboard, you must install the CloudQuery source in section 8.1 of the CloudFormation Template when you [deploy the solution](#step-3-deploy-aws). If you see only empty panels in the dashboard and would like to know more about the feature, reach out to your Sumo Logic Account Executive.
-:::
-
-})
-
-### Security Control Failures dashboards
-
-The Security Control Failures dashboards identify misconfigurations in your environment that may leave you vulnerable to attackers.
-
-#### Security Control Failures - AWS Security Hub
+### Security Control Failures - AWS Security Hub
The **Security Control Failures - AWS Security Hub** dashboard shows resources that need to be addressed because they are vulnerable as reported by AWS Security Hub. It shows findings by resource, trend, type, and category. By default, the `compliance_status` filter at the top of the dashboard is set to **FAILED** to show resources that fail compliance. Set the `risk.calculated_level` filter to **high** or **critical** to see the most important failures.
})
-#### Security Control Failures Overview
-
-The **Security Control Failures Overview** dashboard shows you misconfigurations in your environment that may leave you vulnerable to attackers. These checks are run natively by Sumo Logic to find blind spots in your AWS infrastructure.
-
-:::note
-This dashboard is in [preview](/release-notes-service/2024/05/13/apps/). To see data in this dashboard, you must install the CloudQuery source in section 8.1 of the CloudFormation Template when you [deploy the solution](#step-3-deploy-aws). If you see only empty panels in the dashboard and would like to know more about the feature, reach out to your Sumo Logic Account Executive.
-:::
-
-})
-
-#### Security Control Failures Investigation
-
-The **Security Control Failures Investigation** dashboard provides a detailed view for the [**Security Control Failures Overview**](#security-control-failures-overview) dashboard and helps you navigate and prioritize the most important misconfigurations in your environment.
-
-:::note
-This dashboard is in [preview](/release-notes-service/2024/05/13/apps/). To see data in this dashboard, you must install the CloudQuery source in section 8.1 of the CloudFormation Template when you [deploy the solution](#step-3-deploy-aws). If you see only empty panels in the dashboard and would like to know more about the feature, reach out to your Sumo Logic Account Executive.
-:::
-
-})
-
### Suspicious Activity dashboards
The Suspicious Activity dashboards show data on events identified by anomaly detection that indicate out-of-the ordinary patterns that may require attention. Review these dashboards to see activity identified in configurations, Identity and Access Management (IAM), networks, users, and on the Web. It prioritizes activity by z-score threshold, labeled `risk.calculated_level`, which measures how unusual it is.
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-azure-plugin-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-azure-plugin-source.md
deleted file mode 100644
index 1dec712f3c..0000000000
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/cloudquery-azure-plugin-source.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-id: cloudquery-azure-plugin-source
-title: CloudQuery Azure Plugin Source
-sidebar_label: CloudQuery
-keywords:
- - cloudquery
- - azure
-description: Learn how to collect inventory from the Azure APIs using CloudQuery SDK and send it to Sumo Logic.
----
-
-
-
-
-
-
-
-import CodeBlock from '@theme/CodeBlock';
-import ExampleJSON from '/files/c2c/cloudquery-azure-plugin/example.json';
-import MyComponentSource from '!!raw-loader!/files/c2c/cloudquery-azure-plugin/example.json';
-import useBaseUrl from '@docusaurus/useBaseUrl';
-
-}){kind=logo}
-}){kind=logo}
-
-You can use the CloudQuery integration to pull inventory from Azure APIs using CloudQuery SDK and send it to Sumo Logic.
-
-## About Vendor
-
-CloudQuery is an open source CSPM vendor that allows the customer to analyze different vendors (for example, AWS, GCP, Azure) to see possible vulnerabilities.
-
-## Data sources
-
-The Azure Cloud inventory has the following list of tables supported:
-https://hub.cloudquery.io/plugins/source/cloudquery/azure/v13.0.0/tables.
-
-Based on the services, we will collect data from the tables as mentioned above.
-
-## User configuration
-
-### JSON configuration
-
-Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See [Use JSON to configure Sources](/docs/send-data/use-json-configure-sources) for details.
-
-| Parameter | Type | Required | Description | Access |
-|:---|:---|:---|:---|:---|
-| config | JSON object | Yes | It contains the configuration parameter for the source. | |
-| schemaRef | JSON object | Yes | `{"type":"CloudQuery Azure Inventory"}` | Not modifiable |
-| sourceType | string | Yes | Use universal for CloudQuery Azure Inventory. | Not modifiable |
-
-
-### Configuration parameters
-
-| Parameter | Type | Required | Default | Description | Access |
-|:---|:---|:---|:---|:---|:---|
-| name | string | No | | Type the desired name of the Source. The name must be unique per Collector. This value is assigned to the metadata field `_source`. | Modifiable |
-| description | string | No | | Type a description of the Source. | Modifiable |
-| clientId | string | Yes | | It’s a unique identifier assigned to an application that is registered with Azure AD. | Modifiable |
-| clientSecret | string | Yes | | It’s a secure password that an application uses to authenticate with Azure services. | Modifiable |
-| tenantId | string | Yes | | It’s a unique identifier assigned that represents a specific instance of Azure AD. | Modifiable |
-| subscriptionId | array | No | | It’s a unique identifier that ties Azure services to an Azure account. | Modifiable |
-| services | array | Yes | | List of services for which the data has to be fetched. Available Options: compute, storage. | Modifiable |
-| pollingInterval | string | Yes | 12h | The time interval after the source will check for new data. | Modifiable |
-
-## Config JSON example
-
-:::note
-If the subscription ID is not specified, it will use all visible subscriptions.
-:::
-
-
-
-The CloudQuery GCP integration pulls inventory from various Google Cloud Platform (GCP) APIs via the CloudQuery GCP plugin, transforms it into the CloudQuery schema, and then sends it to Sumo Logic.
-
-## Data collected
-
-| Polling Interval | Data |
-| :--- | :--- |
-| 12 hours | [Data service table data](https://github.com/cloudquery/cloudquery/blob/plugins-source-gcp-v10.0.0/plugins/source/gcp/resources/plugin/tables.go) |
-
-## Setup
-
-### Prerequisites
-
-[Enable](https://cloud.google.com/endpoints/docs/openapi/enable-api) all the service APIs in the authenticated GCP account related with the services from which you want to fetch data via CloudQuery GCP plugin.
-
-### Vendor configuration
-
-To download the user credentials JSON file by using the gcloud CLI, refer to the [Google Cloud documentation](https://cloud.google.com/docs/authentication/application-default-credentials#personal).
-
-### Source configuration
-
-When you create a CloudQuery GCP source, you add it to a Hosted Collector. Before creating the source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector and Source](/docs/send-data/hosted-collectors/configure-hosted-collector).
-
-To configure a CloudQuery GCP Source:
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
-
-The CloudQuery integration is used to pull inventory from the AWS APIs and transform them into the CloudQuery schema and send it to Sumo Logic.
-
-## Data collected
-
-| Polling Interval | Data |
-| :--- | :--- |
-| 12 hours | [Data service table data](https://hub.cloudquery.io/plugins/source/cloudquery/aws/v22.19.2/docs) |
-
-## Setup
-
-### Vendor configuration
-
-**Account Level**. The integration must be configured with the Access Key ID and Secret Access Key. Refer to the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) for guidance to create the Access Key ID and Secret Access Key.
-
-**Organization Level**. The integration must be configured with the Access Key ID, Secret Access Key, Admin Role ARN, and Member Role Name. Refer to the [CloudQuery documentation](https://www.cloudquery.io/blog/deploying-cloudquery-into-aws-org) for guidance to create the Admin Role ARN and Member Role Name.
-
-### Source configuration
-
-When you create an CloudQuery source, you add it to a Hosted Collector. Before creating the source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector).
-
-To configure a CloudQuery Source:
-1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. Sources in the Cloud-to-Cloud Integration Framework need updates over time to maintain data collection.
-Provides a secure endpoint to receive data from CloudQuery.
-}){kind=logo}