- })
-Manage Organizations for MSSPs - Cloud SIEM
-Learn how to manage organizational Cloud SIEM rules and rule tuning for MSSPs.
-Learn how to manage organizational Cloud SIEM rules and rule tuning for MSSPs.
-})
-1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.})
-1. Click **Push**. A **Pushing in progress** dialog is displayed.
-
-### Tips
-
-* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:})
-* When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:})
-
-### Limitations
-
-- If an item with the same name exists in the target organization, it will be replaced.
-- Once a push is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
-- If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](#view-history).
-- Push operations may take longer based on the volume of content being pushed.
-- Rule tuning expressions must be pushed separately from rules.
-- *Cloud SIEM Legacy Rule Type* is not supported for sync or push.
-
-## View history
-
-1. Click **View History** in the upper-right corner of the page. A query for push history displays:})
-1. Click the search button. })
})
-1. Investigate any push that failed and re-run the push if needed.
-
-## View push in the audit log
-
-You can view all content management push in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
-
-```sql
-_index=sumologic_audit_events
-| where eventname = "ContentSynced"
-```
-
-To see the results displayed the same as in [View History](#view-history), use the following query:
-
-```sql
-_index=sumologic_audit_events
-| where eventname = "ContentSynced"
-| orchestratorJob.id as job_sync_id
-| operator.email as user_email
-| parseDate(eventTime, "yyyy-MM-dd'T'HH:mm:ss.SSSXXX") as eventTimeInmilliseconds
-| values(resourceIdentity.name) as content, values(resourceIdentity.type) as content_type, min(eventTimeInmilliseconds) as content_sync_job_time_ms, values(status) as all_status by job_sync_id, user_email
-| if (contains(all_status, "Failed"), "Failed", "Success") as status
-| sort by content_sync_job_time_ms
-| formatDate(content_sync_job_time_ms, "yyyy-MM-dd") as content_sync_date
-| formatDate(content_sync_job_time_ms, "HH:mm:ss") as content_sync_time
-| fields content_sync_date, content_sync_time, job_sync_id, status, user_email, content_type, content
-```
-
-## FAQs
-
-* **What happens when an item with the same name already exists?**})
-1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.})
+1. Click **Push to Orgs**.
+1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.
1. Click **Push**. A **Pushing in progress** dialog is displayed.
### Tips
* If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:
+* When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:
* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
* **Scheduled Searches Connection**. Select **Include Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
* **Scheduled Reports**. Select **Include Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports.
@@ -55,21 +63,66 @@ To ensure that [Library](/docs/get-started/library) content is consistent across
- If an item with the same name exists in the target organization, it will be replaced.
- Once a push is initiated, it cannot be reversed. Administrators should carefully review their selections before updating.
-- If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules#view-history).
+- If errors occur during the push, administrators must manually re-attempt the failed push. To see failed pushes, use [View History](#view-history).
- Push operations may take longer based on the volume of content being pushed.
- Rule tuning expressions must be pushed separately from rules.
- *Cloud SIEM Legacy Rule Type* is not supported for sync or push.
-
-:::info
-To learn how to view history and view updates in the audit log, refer to [Manage Organizations for MSSPs - Cloud SIEM](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules).
-:::
+- For library content, breaching 15,000 cap (Items selected in one job X Child orgs targeted in one job) would fail the sync job.
+- The maximum runtime for jobs below 1200 requests (Items selected in one job X Child orgs targeted in one job) is less than or equal to 2 mins. Linear increase beyond 1200 request would take more runtime, for example, 15,201 would nearly take 30 mins.
+- For CSIEM rules and tuning expression (Rule or Tuning Exp × child-orgs):
+ - Expected runtime for less than or equal to 300 async calls is under 2 mins.
+ - Expected runtime for nearly 1500 async calls is 5-7 mins.
+ - Expected runtime for nearly 3000 async calls is 15 mins.
+ - Make sure you keep the Child orgs per job less than or equal to 3 when you push more than 250 rules for a faster runtime.
+ - Make sure you keep the rule or tuning expressions per job less than or equal to 500 for a faster runtime.
+
+
+## View history
+
+1. Click **View History** in the upper-right corner of the page. A query for push history displays:
+1. Click the search button.
+1. Investigate any push that failed and re-run the push if needed.
+
+## View push in the audit log
+
+You can view all content management push in the [Audit Event Index](/docs/manage/security/audit-indexes/audit-event-index/) by using the following query:
+
+```sql
+_index=sumologic_audit_events
+| where eventname = "ContentSynced"
+```
+
+To see the results displayed the same as in [View History](#view-history), use the following query:
+
+```sql
+_index=sumologic_audit_events
+| where eventname = "ContentSynced"
+| orchestratorJob.id as job_sync_id
+| operator.email as user_email
+| parseDate(eventTime, "yyyy-MM-dd'T'HH:mm:ss.SSSXXX") as eventTimeInmilliseconds
+| values(resourceIdentity.name) as content, values(resourceIdentity.type) as content_type, min(eventTimeInmilliseconds) as content_sync_job_time_ms, values(status) as all_status by job_sync_id, user_email
+| if (contains(all_status, "Failed"), "Failed", "Success") as status
+| sort by content_sync_job_time_ms
+| formatDate(content_sync_job_time_ms, "yyyy-MM-dd") as content_sync_date
+| formatDate(content_sync_job_time_ms, "HH:mm:ss") as content_sync_time
+| fields content_sync_date, content_sync_time, job_sync_id, status, user_email, content_type, content
+```
## FAQs
-* **What happens when a item with the same name already exists?**