diff --git a/docs/cse/administration/create-custom-threat-intel-source.md b/docs/cse/administration/create-custom-threat-intel-source.md index 101f0bb7fd..966963ef43 100644 --- a/docs/cse/administration/create-custom-threat-intel-source.md +++ b/docs/cse/administration/create-custom-threat-intel-source.md @@ -7,10 +7,6 @@ description: Learn how to manage custom threat intelligence sources in Cloud SIE import useBaseUrl from '@docusaurus/useBaseUrl'; -:::info -**You can no longer add custom threat intelligence sources in Cloud SIEM**. To create new sources, use the Sumo Logic threat intelligence framework. For more information, see [About Sumo Logic Threat Intelligence](/docs/security/threat-intelligence/about-threat-intelligence). [Contact Support](https://support.sumologic.com/support/s/) if you still need to create custom sources in Cloud SIEM. -::: - Prior to the introduction of [Sumo Logic Threat Intelligence](/docs/security/threat-intelligence), administrators created their own custom threat intelligence sources, which they manually populated as opposed to using an automatic feed. This article has information about managing these custom threat intelligence sources in Cloud SIEM. Previously, administrators created custom threat intelligence sources interactively from the Cloud SIEM UI by uploading a .csv file, or using Cloud SIEM APIs. They populated the sources with IP addresses, domains, URLs, email addresses, and file hashes. diff --git a/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md b/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md index 18210c4723..685f5fa9b9 100644 --- a/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md +++ b/docs/security/threat-intelligence/threat-indicators-in-cloud-siem.md @@ -10,7 +10,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; Threat intelligence indicators can be used in Cloud SIEM to find possible threat activity. :::note -Previously, Cloud SIEM administrators could add [custom threat intelligence sources](/docs/cse/administration/create-custom-threat-intel-source/) in Cloud SIEM. **You can no longer add custom threat intelligence sources in Cloud SIEM**. To add new sources, [ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators) using the Sumo Logic threat intelligence framework. [Contact Support](https://support.sumologic.com/support/s/) if you still need to create custom sources in Cloud SIEM. +**You can no longer add custom threat intelligence sources in Cloud SIEM**. To add new sources, [ingest threat intelligence indicators](/docs/security/threat-intelligence/about-threat-intelligence/#ingest-threat-intelligence-indicators) using the Sumo Logic threat intelligence framework. ::: ## hasThreatMatch Cloud SIEM rules language function