From 72fd5a87d6cd404b64eb96d0c011ac2f0384dde2 Mon Sep 17 00:00:00 2001 From: Maxime Lamothe-Brassard Date: Wed, 23 Sep 2026 17:29:52 -0700 Subject: [PATCH 1/2] docs(sublime): fix the audit log adapter options and example config - api_key was described as an Okta key. - Document the optional base_url and its North America default. - Use the sublime platform, which already extracts the event type and time; the previous json example mapped the sensor hostname to a user.email field that audit events do not have. - Note that the adapter does not backfill history, and add troubleshooting for the sensor-identity and cloud-sensor cases. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../adapters/types/sublime-security.md | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/docs/2-sensors-deployment/adapters/types/sublime-security.md b/docs/2-sensors-deployment/adapters/types/sublime-security.md index b5e5fa604..5e4ded46d 100644 --- a/docs/2-sensors-deployment/adapters/types/sublime-security.md +++ b/docs/2-sensors-deployment/adapters/types/sublime-security.md @@ -6,11 +6,16 @@ Audit logs from Sublime can be ingested cloud-to-cloud via the API. +The adapter polls the [audit log API](https://docs.sublime.security/reference/listeventsinauditlog) every 30 seconds. It ships audit events created after the adapter starts; the existing audit history is not backfilled. + ### Adapter-specific Options Adapter Type: `sublime` -- `api_key`: your Okta API key/token +- `api_key`: your Sublime Security API key. +- `base_url` (optional): the base URL of your Sublime Security API. Defaults to `https://platform.sublime.security` (North America). If your Sublime Security instance is hosted in a different region, or is self-hosted, set this to the API base URL of that instance. + +Use `sublime` as the `client_options.platform`. LimaCharlie then takes the event type from each audit event's `type` field and the event time from its `created_at` field, so no `mapping` is needed. ### CLI Deployment @@ -27,9 +32,11 @@ client_options.hostname=$SENSOR_NAME \ api_key=$API_KEY ``` +Add `base_url=$BASE_URL` if your instance is not on the default North America API. + ### Infrastructure as Code Deployment -```python +```yaml # For cloud sensor deployment, store credentials as hive secrets: # api_key: "hive://secret/sublime-api-key" @@ -37,20 +44,22 @@ api_key=$API_KEY sensor_type: "sublime" sublime: api_key: "hive://secret/sublime-api-key" + # base_url: "https://platform.sublime.security" # optional, defaults to North America client_options: identity: oid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" installation_key: "YOUR_LC_INSTALLATION_KEY_SUBLIME" hostname: "sublime-security-adapter" - platform: "json" + platform: "sublime" sensor_seed_key: "sublime-audit-sensor" - mapping: - sensor_hostname_path: "user.email" - event_type_path: "type" - event_time_path: "created_at" - indexing: [] ``` +### Troubleshooting + +- The adapter identifies itself to LimaCharlie by its `sensor_seed_key` and installation key. If you run the same Sublime Security integration both as a cloud sensor and as a binary adapter with a different `sensor_seed_key`, they show up as two separate sensors, and each sensor's timeline only shows the events that adapter shipped. +- Deleting a sensor does not stop its adapter. A cloud sensor that is still configured reconnects and re-enrolls; remove or disable the cloud sensor configuration to stop it. +- If you use the `json` platform instead of `sublime`, set `mapping.event_type_path: "type"` and `mapping.event_time_path: "created_at"` so events get the audit event type and the time the audited action happened. + ## API Doc See the official [documentation](https://docs.sublime.security/reference/authentication). From abb7d0a980ef2bac4158274985173b014cb2930d Mon Sep 17 00:00:00 2001 From: Maxime Lamothe-Brassard Date: Wed, 23 Sep 2026 17:44:53 -0700 Subject: [PATCH 2/2] docs(sublime): note that events created while the adapter is stopped are not shipped Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/2-sensors-deployment/adapters/types/sublime-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/2-sensors-deployment/adapters/types/sublime-security.md b/docs/2-sensors-deployment/adapters/types/sublime-security.md index 5e4ded46d..9027b21fc 100644 --- a/docs/2-sensors-deployment/adapters/types/sublime-security.md +++ b/docs/2-sensors-deployment/adapters/types/sublime-security.md @@ -6,7 +6,7 @@ Audit logs from Sublime can be ingested cloud-to-cloud via the API. -The adapter polls the [audit log API](https://docs.sublime.security/reference/listeventsinauditlog) every 30 seconds. It ships audit events created after the adapter starts; the existing audit history is not backfilled. +The adapter polls the [audit log API](https://docs.sublime.security/reference/listeventsinauditlog) every 30 seconds. It ships audit events created after the adapter starts; the existing audit history is not backfilled. The adapter does not persist its position, so audit events created while it is stopped or restarting are not shipped either. ### Adapter-specific Options