Enhance optimization rules documentation - #3152
Enhance optimization rules documentation#3152alexane-bougeardbebin-sekoia wants to merge 16 commits into
Conversation
Added details about platform-level optimization rules and their appropriate use cases.
Updated the Forwarder level section with improved documentation links and changed the heading from 'See also' to 'Related articles'.
|
Newest code from alexane-bougeardbebin-sekoia has been published to preview environment 🚀 Latest deployment was built on 2026-08-07 08:14:57 (4e90f837a6cd1381bc85b50d1706784a1b7379c1). |
| # Filter logs with Rsyslog or Syslog-ng | ||
|
|
||
| Rsyslog and Syslog-ng let you drop unwanted events at the forwarder level, before they reach Sekoia. Filtering here reduces both network bandwidth and the volume counted against your license allowance, making it more effective than platform-level optimization rules. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - A working Sekoia Forwarder deployment using Rsyslog or Syslog-ng. See [Sekoia Forwarder documentation](/integration/ingestion_methods/sekoiaio_forwarder.md) for setup instructions. |
There was a problem hiding this comment.
This is for Sekoia Forwarder or for a syslog-ng conf ?
I think we should have a doc only for Sekoia Forwarder and we should not speak for rsyslog/syslog-ng in the same page as the Sekoia Forwarder
Sekoia Forwarder is not using syslog-ng, only Rsyslog but it's inside the forwarder
There was a problem hiding this comment.
I warned @mchupeau-sk this morning that this article would probably be BS made with AI and that he needed to give me info on this in order to be able to do something correct. 😅
My goal in this article is to make sure the user can use it to create an optimization rule at the forwarder level. But our article mentions 2 methods: rsyslog/syslog-ng or endpoint. so I was thinking of creating articles to explain step by step how to do it. Endpoint already have its own, so this one should be about rsyslog/syslog. but TBH i'm very confused about it because I am not technical enough, so any help would be great
There was a problem hiding this comment.
As I understood the documentation this part is more for client if they want to configure a syslog-ng or a Rsyslog on their side.
A client must not touch the sekoia forwarder configuration and can't do it because it's a docker image. So for me this page is more for advance client who want to control everything.
There was a problem hiding this comment.
You cannot say A working Sekoia Forwarder deployment using Rsyslog or Syslog-ng. It's 3 different things
There was a problem hiding this comment.
Maybe it could be split in different part ?
- Optimization for rsyslog (where the rsyslog doc is)
- Optimization for syslog-ng (where the syslog-ng doc is)
- Optimiaztion for the Sekoia forwarder
rombernier
left a comment
rombernier
left a comment
There was a problem hiding this comment.
Nice doc, Thanks, I have made some comment :)
Thank you so much, @rombernier. I have answered your comment (and I will need some extra help here ;) ) |
Updated configuration method for platform-level rules to specify API only.
MekkiCS
left a comment
MekkiCS
left a comment
There was a problem hiding this comment.
Good structure ! I see that you tackled most asked questions by the partners as well!
Thank you @MekkiCS, which answers are missing according to you? |
| - SentinelOne Cloud Funnel 2.0: integration/categories/endpoint/sentinelone_cloudfunnel2.0.md | ||
| - Sekoia.io Endpoint Agent: integration/categories/endpoint/sekoiaio.md | ||
| - Sekoia Endpoint Agent: integration/categories/endpoint/sekoiaio.md | ||
| - Reduce event volume with the Endpoint Agent: integration/categories/endpoint/reduce_event_volume_endpoint_agent.md |
There was a problem hiding this comment.
For me it must not be in the list, maybe add a redirection from the Sekoia endpoint agent page
| - Third-party syslog services: integration/ingestion_methods/syslog/syslog_service.md | ||
| - Rsyslog: integration/ingestion_methods/syslog/rsyslog.md | ||
| - Syslog NG: integration/ingestion_methods/syslog/syslog-ng.md | ||
| - Filter logs with Rsyslog or Syslog-ng: xdr/features/collect/filter_logs_with_rsyslog_or_syslog_ng.md |
There was a problem hiding this comment.
It's not an ingestion method, imo it should be a subpart of Rsyslog / Syslog NG / Sekoia forwarder
|
I don't see any reference of |
6 participants
Added details about platform-level optimization rules and their appropriate use cases.