Library¶
Administrator feature
The Library is an administrator feature. The Library has a significant impact on the way TeskaLabs LogMan.io works. Some users don't have access to the Library.
The Library holds items (files) that determine what you see when using TeskaLabs LogMan.io. The items in the Library determine, for example, your homepage, dashboards, reports, exports, parsing and correlation rules, and some SIEM functions.
TeskaLabs LogMan.io is delivered with pre-existing content. You can modify it according to your needs.
Warning
Changing items in the Library impacts how TeskaLabs LogMan.io and TeskaLabs SIEM work. If you are unsure about making changes in the Library, contact Support.
Navigating the Library¶
Locating items¶
To find an item, use the search bar, or click through the folders.
If you navigate to a folder in the Library and want to return to the search bar, click Library again.
Adding items to the Library¶
Creating items in a folder¶
You can create an item directly in certain folders. If adding an item is possible, you'll see a Create new item in (folder) button when you click on the folder.
- To add an item, click Create new item in (folder).
- Name the item, select the file extension from the dropdown, and click Create.
- If the item doesn't appear immediately, refresh the page, and your item should appear in the library.
Adding an item by duplicating an existing item¶
- Click on the item you want to duplicate.
- Click on the ... button near the top.
- Click Copy.
- Rename the item, choose the file extension from the dropdown, and click Copy.
- If the item doesn't appear immediately, refresh the page, and your item should appear in the library.
Editing an item in the Library¶
- Click on the item you want to edit.
- To edit the item, click Edit.
- To save your changes, click Save, or exit the editor without saving by clicking Cancel.
- If your edits don't display immediately, refresh the page, and your changes should be saved.
Removing an item from the Library¶
- Click on the item you want to remove.
- Click on the ... button near the top.
- Click Remove and confirm Yes if your browser prompts.
- If if the item doesn't disappear immediately, refresh the page, and the removed item should be gone.
Disabling items¶
You can temporarily disable an item. It stays in your library, but its effect on your system is paused.
To disable an item, click on the item and click Disable.
You can re-enable the file any time by clicking Enable.
Note
You can't read the contents of an item while it's disabled.
Library layers¶
Library items are stored in layers.
- Tenant layer (cyan): content visible only for a selected tenant.
- Global layer (purple): content visible for all tenants.
- Base layer (blue): pre-created content provided by TeskaLabs, visible for all tenants.
Layer is indicated at the content site-panel.
Item on a base layer can be overwritten by global or tenant layer. Item on a global layer can be overwritten by tenant layer.
Edit on a global / tenant layer¶
For some items, you can choose the target layer (global or tenant) where you want to save your changes. This option is available next to the Save button.
Restore back to base layer¶
Item on a global or tenant layer that overwrites the base layer can be restored, i.e., reverted back to the base layer. Simply click on Actions button and choose Restore.