Enhance SIEM integration template descriptions

[kdejoyce]

Updated SIEM integration templates with detailed descriptions

[github-actions]

Auto-Fix Summary

0 issues fixed, 3 skipped across 1 files

Skipped (needs manual review)	Reason

| docs/threatmanager/3.2/administration/configuration/integrations/siem.md:23 — Dale: passive-voice | 'This field is blank and turned off by default' describes UI state, not an action; rewriting risks awkwardness and changing meaning. |
| docs/threatmanager/3.2/administration/configuration/integrations/siem.md:48 — Dale: passive-voice | 'All template variables are case-insensitive and wrapped in % delimiters' describes a property/state; converting to active would force an imperative that changes the descriptive intent. |
| docs/threatmanager/3.2/administration/configuration/integrations/siem.md:9 — Dale: undefined-acronyms | SIEM is a well-known security-industry standard acronym for the security-analyst audience; the rule excludes well-known IT standards. |

Ask @claude on this PR if you'd like an explanation of any fix.

[kdejoyce]

@claude fix all issues

[github-actions]

Fix complete:

• Apply editorial suggestions in docs/threatmanager/3.2/administration/configuration/integrations/siem.md
• Verify changes
• Commit and push

Summary — applied all four editorial suggestions from the review:

• Structure — Aligned the template sub-bullets (CEF, ISO CEF, Raw CEF, etc.) to 4-space indentation so they match the sibling Type sub-list (UDP/TCP). Nested :::note and the code block were re-indented to match, and stray trailing whitespace was removed.
• Clarity (Raw CEF) — Replaced the undefined term "framing" with "already prepends its own date and host header."
• Clarity (Custom template) — Changed "customer-specific format" to "custom format" for consistency with the template name and the rest of the page.
• Completeness (Notification template) — Stated the positive use case: "used for basic connectivity tests or generic status notifications rather than forwarding threat details."

Note on the Auto-Fix Summary items: The 3 skipped Dale/Vale items (two passive-voice, one undefined-acronym) were intentionally left as-is. They describe UI state/properties rather than actions, and SIEM is a well-known security-industry acronym excluded by the rule — so no changes were needed there.

[github-actions]

Fix complete:

• Apply editorial suggestions in docs/threatmanager/3.2/administration/configuration/integrations/siem.md
• Verify changes
• Commit and push

Summary — all four editorial suggestions from the review were applied:

• Structure — Aligned the template sub-bullets to 4-space indentation so they match the Type sub-list (UDP/TCP) under the same parent. Nested content (the note block and the Notification format string) now aligns under its bullet text.
• Clarity (Raw CEF) — Replaced the undefined term "framing" with a plain description: "use when your syslog transport or collector already prepends its own date and host header."
• Clarity (Custom template) — Changed "customer-specific format" to "custom format" for consistency with the "Custom template" name and the rest of the page.
• Completeness (Notification template) — Added the positive use case: "used for basic connectivity tests or generic status notifications rather than forwarding threat details."

[github-actions]

Documentation PR Review

Editorial Review

docs/threatmanager/3.2/administration/configuration/integrations/siem.md

This change rewrites the Template dropdown list, expanding it from three entries to seven and adding a clear one-line description of each format. Overall the new content is a strong improvement: the CEF and LEEF acronyms are expanded on first use, the templates are grouped logically (CEF variants → LEEF → Custom → Notification), and the :::note about the single custom template is correctly nested under the Custom template bullet. A few minor items:

• Clarity — Lines 31, 33: The CEF and LEEF acronyms are expanded ("Common Event Format", "Log Event Extended Format"), but ISO 8601 and rsyslog are used without a brief gloss. Since these two templates differ from plain CEF only by their timestamp format, a newer reader deciding between them may not know what distinguishes "an ISO 8601 timestamp" from "an rsyslog-compatible timestamp." The (no colon separator in the date) note on line 33 helps for rsyslog; consider a similarly concrete cue for ISO 8601. Suggested fix: "ISO CEF template – Common Event Format, with an ISO 8601 timestamp prefix (for example, 2026-03-03T14:30:00Z)".

• Completeness — Line 30: The CEF template entry describes the format ("with a standard syslog date/host prefix") but, unlike the Raw CEF template entry, gives no cue about when to choose it. Because Raw CEF is explicitly the "no date/host prefix" option, a reader may be unsure whether plain CEF is the safe default. Suggested fix: add a short usage cue, e.g. "use this default when your collector does not add its own date and host header," to mirror the guidance already given for Raw CEF.

• Structure — Line 43: The %SYSLOG_DATE%|%HOST%|... code block is now indented to sit under the Notification template bullet (line 41), which correctly ties the example to the template it illustrates. Confirm in the build preview that the 8-space indent renders the code block inside the list item rather than breaking the list — the surrounding bullets use 4-space indentation, so the deeper indent is intentional but worth a visual check. No text change needed.

Summary

3 editorial suggestions across 1 file (2 minor clarity/completeness, 1 render check). The rewrite is a clear net improvement over the previous three-entry list. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

0 issues fixed, 2 skipped across 1 files

Skipped (needs manual review)	Reason

| docs/threatmanager/3.2/administration/configuration/integrations/siem.md:177 — Dale: passive-voice | 'SIEM notifications are now configured.' is passive, but it is a standard status-confirmation sentence; the active rewrite ('You have now configured SIEM notifications.') shifts from describing the resulting state to the user's action, a meaning nuance, so skipped to preserve intent. |
| docs/threatmanager/3.2/administration/configuration/integrations/siem.md:116 — Dale: undefined-acronyms | 'NTM' is used once in an internal-value note immediately followed by 'internal to Threat Manager'; expanding it is ambiguous given it is a product short form and the exact intended expansion in context is unclear, so skipped. |

Ask @claude on this PR if you'd like an explanation of any fix.