Manage Organizations for MSSPs - Library Content (GA)

blog-service/2025-03-07-manage.md

@@ -10,9 +10,7 @@ hide_table_of_contents: true
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-
-
-We are excited to announce a new **Content Management** tab that allows MSSP administrators the ability to conveniently push updates to multiple child organizations at once. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps/).
+We are excited to announce a new **Content Management** tab that allows MSSP administrators the ability to conveniently push updates to multiple child organizations at once. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules/).
 
 :::note
 This feature is in Beta. To participate, contact your Sumo Logic account executive or our Support Team.

blog-service/2025-06-27-manage.md

@@ -10,7 +10,7 @@ hide_table_of_contents: true
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-We are excited to announce the ability to manage library content on the new **Manage Content** tab. Now MSSP administrators can conveniently push content in the **Library** folder to multiple child organizations at once, including dashboards, saved searches, and scheduled searches. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps/).
+We are excited to announce the ability to manage library content on the new **Manage Content** tab. Now MSSP administrators can conveniently push content in the **Library** folder to multiple child organizations at once, including dashboards, saved searches, and scheduled searches. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules/).
 
 :::note
 This feature is in Beta. To participate, contact your Sumo Logic account executive or our Support Team.

blog-service/2025-10-24-manage.md

@@ -0,0 +1,12 @@
+---
+title: Manage Organizations for MSSPs - Library Content
+image: https://help.sumologic.com/img/reuse/rss-image.jpg
+keywords:
+  - manage
+  - mssps
+hide_table_of_contents: true    
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+We're excited to announce the ability to manage your **Library** content across your Enterprise multi-orgs and MSSP (typically a parent organization with multiple child organizations). This lets you to save, share, and manage log searches, dashboards, apps, and other Sumo Logic content for launching searches and dashboards with a single click. [Learn more](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules).

cid-redirects.json

@@ -1869,7 +1869,7 @@
   "/cid/1082": "/docs/metrics/introduction/get-started-metrics",
   "/cid/10820": "/docs/manage/manage-subscription/create-and-manage-orgs/create-manage-orgs",
   "/cid/10821": "/docs/search/get-started-with-search/search-page/change-time-range-in-histogram",
-  "/cid/108221": "/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps",
+  "/cid/108221": "/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules",
   "/cid/1083": "/docs/manage/users-roles/roles/role-based-access-control",
   "/cid/1084": "/docs/metrics/manage-metric-volume/disabled-metrics-sources",
   "/cid/1085": "/docs/send-data/installed-collectors/macos",
@@ -4539,5 +4539,6 @@
   "/Search/Search-Query-Language/Parse-Operators": "/docs/search/search-query-language/parse-operators",
   "/docs/search/get-started-with-search-language/parsing-operators": "/docs/search/search-query-language/parse-operators",
   "/docs/get-started/training-certification-faq-new": "/docs/get-started/training-certification-faq",
-  "/docs/manage/scheduled-views/pausing-inactive-scheduled-views": "/docs/manage/scheduled-views/pause-disable-scheduled-views"
+  "/docs/manage/scheduled-views/pausing-inactive-scheduled-views": "/docs/manage/scheduled-views/pause-disable-scheduled-views",
+  "/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps": "/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules"
 }

docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md

@@ -82,9 +82,8 @@ This multi-insights list page (also known as a "federated" page) shows insights
 
 To be able to see insights in child organizations, [add child organizations](/docs/manage/manage-subscription/create-and-manage-orgs/create-manage-orgs) that use Cloud SIEM. Then when the parent organization user goes to their Cloud SIEM insights list page, all the child organizations' insights appear in the list.
 
-<!--
-For more information, see [Multi-insights list page in Cloud SIEM](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps/#multi-insights-list-page-in-cloud-siem).
--->
+
+For more information, see [Multi-insights list page in Cloud SIEM](/docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules/#multi-insights-list-page-in-cloud-siem).
 
 ## Insight details page
 

docs/manage/manage-subscription/create-and-manage-orgs/index.md

@@ -50,15 +50,9 @@ In this section, we'll introduce the following concepts:
 <div className="box smallbox card">
   <div className="container">
   <a href={useBaseUrl('docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules')}><img src={useBaseUrl('img/icons/operations/manage.png')} alt="icon" width="40"/><h4>Manage Organizations for MSSPs - Cloud SIEM</h4></a>
-  <p>Learn how to manage organizational Cloud SIEM rules and rule tuning for MSSPs.</p>
-  </div>
-</div>
-<!-- <div className="box smallbox card">
-  <div className="container">
-  <a href={useBaseUrl('docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps')}><img src={useBaseUrl('img/icons/operations/manage.png')} alt="icon" width="40"/><h4>Manage Orgs for MSSPs</h4></a>
   <p>Learn how to manage organizations for Managed Security Service Providers (MSSPs).</p>
   </div>
-</div> -->
+</div>
 </div>
 
 ## View a child org, child credits usage, and baseline

docs/manage/manage-subscription/create-and-manage-orgs/manage-orgs-for-mssps-csiem-rules.md

@@ -1,12 +1,12 @@
 ---
 id: manage-orgs-for-mssps-csiem-rules
-title: Manage Organizations for MSSPs - Cloud SIEM
-sidebar_label: Manage Orgs for MSSPs - Cloud SIEM
-description: Learn how to manage organizational Cloud SIEM rules and rule tuning for Managed Security Service Providers (MSSPs).
+title: Manage Organizations for MSSPs
+sidebar_label: Manage Orgs for MSSPs
+description: Learn how to manage organizational Cloud SIEM rules, rule tuning expressions, and organizational library content for Managed Security Service Providers (MSSPs).
 ---
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This article describes how to manage Cloud SIEM rules and rule tuning expressions in organizations for Managed Security Service Providers (MSSPs). MSSP administrators must ensure that the content of their child organizations is properly configured. MSSPs often consist of a parent organization with child organizations that use [Cloud SIEM](/docs/cse/).
+This article describes how to manage Cloud SIEM rules, rule tuning expressions, and organizational library content for Managed Security Service Providers (MSSPs). MSSP administrators must ensure that the content of their child organizations is properly configured. MSSPs often consist of a parent organization with child organizations that use [Cloud SIEM](/docs/cse/).
 
 ## Considerations
 
@@ -23,11 +23,9 @@ You must have the following [organization role capabilities](/docs/manage/users-
 
 If you are logged in to a parent organization with child organizations that also use Cloud SIEM, the insights list page in Cloud SIEM allows you to [view insights in child organizations](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#view-insights-in-child-organizations). 
 
-<!-- After this article is no longer beta, show the following text:
 This multi-insights list page (also known as a "federated" page) shows insights just as in a normal insights list page. When you click an insight on the page, you are automatically signed in to the child organization (if SSO is enabled for the child organization), and the insight's details open in the child organization's UI. You can also use the board view on the multi-insights page to move insights to different statuses.
 
 To be able to see insights in child organizations, add child organizations that use Cloud SIEM. Then when the parent organization user goes to their Cloud SIEM insights list page, all the child organizations' insights appear in the list.
--->
 
 ## Manage Cloud SIEM rules
 
@@ -36,22 +34,30 @@ To ensure that content is consistent across child organizations, use the **Manag
 You can push the following:
 * Cloud SIEM [rules](/docs/cse/rules/)
 * Cloud SIEM [rule tuning expressions](/docs/cse/rules/rule-tuning-expressions/)
+* [Library](/docs/get-started/library)
 
 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Organizations**. You can also click the **Go To...** menu at the top of the screen and select **Organizations**.<br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Administration > Organizations**.
 1. Select the **Manage Content** tab.
 1. In the **Source Org** field, select the organization that will provide the source data to be pushed in other organizations.
 1. In the **Content** bar, select the content to be pushed:
    * **Cloud SIEM Rules**. For more information about Cloud SIEM rules, refer to [Cloud SIEM Rules](/docs/cse/rules/).
    * **Cloud SIEM Rule Tuning**. For more information about Cloud SIEM rule tuning expressions, refer to [Rule Tuning Expressions](/docs/cse/rules/rule-tuning-expressions/).
+   * **Library**. For more information about Library items, refer to [Managing Your Sumo Logic Library](/docs/get-started/library).
 1. Select individual items to be pushed, or all items.
 1. Click **Push to Orgs**.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-csiem.png')} alt="Push Selected Items button" style={{border: '1px solid gray'}} width="800"/>
-1. On the **Push Selected Items** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
+1. On the **Push Selected Content** box, navigate to the **Destinations** section to select the organizations to push the selected items to. You can push to all organizations, a single child organization, or multiple child organizations.<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-selected-items-2-csiem.png')} alt="Push Selected Items dialog" style={{border: '1px solid gray'}} width="400"/>
 1. Click **Push**. A **Pushing in progress** dialog is displayed.
 
 ### Tips
 
 * If you select **All Child Organizations**, you can then select organizations to exclude, allowing you to push to all organizations except those you select:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-selected-organizations.png')} alt="Selected organizations" style={{border: '1px solid gray'}} width="300"/>
 * When you push rule tuning expressions, select **Include Associated Cloud SIEM Rules** to push all the Cloud SIEM rules that the expressions are used on:<br/><img src={useBaseUrl('img/manage/subscriptions/mssp-orgs-sync-associated-rules.png')} alt="Include Associated Cloud SIEM Rules checkbox" style={{border: '1px solid gray'}} width="200"/>
+* Selected Library items are added to the [Admin Recommended](/docs/manage/content-sharing/admin-mode/#move-important-content-to-admin-recommended) folder. Additionally, you can only select the Library contents in Source Organization under the Admin Recommended folder.
+* **Scheduled Searches Connection**. Select **Include Connection** to create the scheduled searches in the target organizations if they don't already exist there. Select **Ignore Connection** only if you want to turn the added scheduled searches into saved searches.
+* **Scheduled Reports**. Select **Include Scheduled Reports** to create the scheduled reports in the target organizations if they don't already exist there. Select **Ignore Scheduled Reports** only if you want to turn the added scheduled reports into saved reports. 
+   :::note
+   Both **Scheduled Searches Connection** and **Scheduled Reports** will be available only when you select a library *folder*.
+   :::
 
 ### Limitations
 
@@ -61,6 +67,15 @@ You can push the following:
 - Push operations may take longer based on the volume of content being pushed.
 - Rule tuning expressions must be pushed separately from rules.
 - *Cloud SIEM Legacy Rule Type* is not supported for sync or push.
+- For library content, breaching 15,000 cap (Items selected in one job X Child orgs targeted in one job) would fail the sync job.
+- The maximum runtime for jobs below 1200 requests (Items selected in one job X Child orgs targeted in one job) is less than or equal to 2 mins. Linear increase beyond 1200 request would take more runtime, for example, 15,201 would nearly take 30 mins.
+- For CSIEM rules and tuning expression (Rule or Tuning Exp × child-orgs):
+   - Expected runtime for less than or equal to 300 async calls is under 2 mins. 
+   - Expected runtime for nearly 1500 async calls is 5-7 mins.
+   - Expected runtime for nearly 3000 async calls is 15 mins.
+   - Make sure you keep the Child orgs per job less than or equal to 3 when you push more than 250 rules for a faster runtime.
+   - Make sure you keep the rule or tuning expressions per job less than or equal to 500 for a faster runtime
+
 
 ## View history