Library

Administrator feature

The Library is an administrator feature. The Library has a significant impact on the way TeskaLabs LogMan.io works. Some users don't have access to the Library.

The Library holds items (files) that determine what you see when using TeskaLabs LogMan.io. The items in the Library determine, for example, your homepage, dashboards, reports, exports, parsing and correlation rules, and some SIEM functions.

TeskaLabs LogMan.io is delivered with pre-existing content. You can modify it according to your needs.

Warning

Changing items in the Library impacts how TeskaLabs LogMan.io and TeskaLabs SIEM work. If you are unsure about making changes in the Library, contact Support.

Navigating the Library

Locating items

To find an item, use the search bar, or click through the folders.

If you navigate to a folder in the Library and want to return to the search bar, click Library again.

Adding items to the Library

Creating items in a folder

You can create an item directly in certain folders. If adding an item is possible, you'll see a Create new item in (folder) button when you click on the folder.

1. To add an item, click Create new item in (folder).
2. Name the item, select the file extension from the dropdown, and click Create.
3. If the item doesn't appear immediately, refresh the page, and your item should appear in the library.

Adding an item by duplicating an existing item

1. Click on the item you want to duplicate.
2. Click on the ... button near the top.
3. Click Copy.
4. Rename the item, choose the file extension from the dropdown, and click Copy.
5. If the item doesn't appear immediately, refresh the page, and your item should appear in the library.

Editing an item in the Library

1. Click on the item you want to edit.
2. To edit the item, click Edit.
3. To save your changes, click Save, or exit the editor without saving by clicking Cancel.
4. If your edits don't display immediately, refresh the page, and your changes should be saved.

Removing an item from the Library

1. Click on the item you want to remove.
2. Click on the ... button near the top.
3. Click Remove and confirm Yes if your browser prompts.
4. If if the item doesn't disappear immediately, refresh the page, and the removed item should be gone.

Disabling items

You can temporarily disable an item. It stays in your library, but its effect on your system is paused.

To disable an item, click on the item and click Disable.

You can re-enable the file any time by clicking Enable.

Note

You can't read the contents of an item while it's disabled.

Library layers

Library items are stored in layers.

• Tenant layer (cyan): content visible only for a selected tenant.
• Global layer (purple): content visible for all tenants.
• Base layer (blue): pre-created content provided by TeskaLabs, visible for all tenants.

Layer is indicated at the content site-panel.

Item on a base layer can be overwritten by global or tenant layer. Item on a global layer can be overwritten by tenant layer.

Edit on a global / tenant layer

For some items, you can choose the target layer (global or tenant) where you want to save your changes. This option is available next to the Save button.

Restore back to base layer

Item on a global or tenant layer that overwrites the base layer can be restored, i.e., reverted back to the base layer. Simply click on Actions button and choose Restore.