fix/docs referencing PR 43 comments (#72)

CSVD · Sep 10, 2019 · 3173ff9 · 3173ff9
1 parent 889911b
commit 3173ff9
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 9 deletions.
diff --git a/docs/SC4S deployment.png b/docs/SC4S deployment.png
diff --git a/docs/gettingstarted.md b/docs/gettingstarted.md
@@ -45,7 +45,7 @@ services:
 ```bash
 wget https://raw.githubusercontent.com/splunk/splunk-connect-for-syslog/master/package/etc/context-local/splunk_index.csv
 ```
-* Edit splunk_index.csv review the index configuration and revise as required for sourcertypes utilized in your environment.
+* Edit splunk_index.csv review the index configuration and revise as required for sourcertypes utilized in your environment. For instance, add *cisco:asa,index,netfw* to splunk_index.csv for Cisco-ASA data source.
 
 ## Configure sources by source IP or host name
 * This step is required even if not used
@@ -66,6 +66,7 @@ docker stack deploy --compose-file docker-compose.yml sc4s
 
 Additional hosts can be deployed for syslog collection from additional network zones and locations
 
+![SC4S deployment diagram](SC4S%20deployment.png)
 
 ## Single Source Technology instance - Alpha
 

diff --git a/docs/sources.md b/docs/sources.md
@@ -30,7 +30,7 @@ MSG Parse: This filter parses message content
 ### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
-* Review and update the splunk_index.csv file and set the index as required.
+* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source.
 * Follow vendor configuration steps per Product Manual above ensure:
     * Log Level is 6 "Informational"
     * Protocol is TCP/IP
@@ -80,7 +80,7 @@ Verify timestamp, and host values match as expected
 ### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
-* Review and update the splunk_index.csv file and set the index as required.
+* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source.
 * IOS Follow vendor configuration steps per Product Manual above ensure:
     * Ensure a reliable NTP server is set and synced
     * Log Level is 6 "Informational"
@@ -151,7 +151,7 @@ MSG Parse: This filter parses message content
 ### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
-* Review and update the splunk_index.csv file and set the index as required.
+* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source.
 * Refer to the admin manual for specific details of configuration to send Reliable syslog using RFC 3195 format, a typical logging configuration will include the following features.
 
 ```
@@ -189,7 +189,7 @@ end
 
 ### Verification
 
-An active firewall will generate frequent events, in addition fortigate has the ability to test logging functionality using a build in command
+An active firewall will generate frequent events, in addition fortigate has the ability to test logging functionality using a built in command
 
 ```
 diag log test
@@ -431,15 +431,15 @@ MSG Parse: This filter parses message content
 ### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
-* Review and update the splunk_index.csv file and set the index as required.
+* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source.
 * Refer to the admin manual for specific details of configuration
     * Select TCP or SSL transport option
     * Select IETF Format
     * Ensure the format of the event is not customized
 
 ### Verification
 
-An active firewall will generate frequent events use the following search to validate events are present per source device
+An active firewall will generate frequent events. Use the following search to validate events are present per source device
 
 ```
 index=<asconfigured> sourcetype=pan:*| stats count by host
@@ -475,14 +475,14 @@ MSG Parse: This filter parses message content
 ### Setup and Configuration
 
 * Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
-* Review and update the splunk_index.csv file and set the index as required.
+* Review and update the splunk_index.csv file and set the index and sourcetype as required for the data source.
 * Refer to the Splunk TA documentation for the specific customer format required for proxy configuration
     * Select TCP or SSL transport option
     * Ensure the format of the event is customized per Splunk documentation
 
 ### Verification
 
-An active proxy will generate frequent events use the following search to validate events are present per source device
+An active proxy will generate frequent events. Use the following search to validate events are present per source device
 
 ```
 index=<asconfigured> sourcetype=bluecoat:proxysg:access:kv | stats count by host