SUMO-288112 | Apoorv | Add. monitors and update the app doc for PCI Complaince for AWS CloudTrail

[Apoorvkudesia-sumologic]

Purpose of this pull request

This pull request updates PCI Complaince for AWS CloudTrail doc and adds new monitors

Select the type of change

• Minor Changes - Typos, formatting, slight revisions
• Update Content - Revisions, updating sections
• New Content - New features, sections, pages, tutorials
• Site and Tools - .clabot, version updates, maintenance, dependencies, new packages for the site (Docusaurus, Gatsby, React, etc.)

Ticket (if applicable)

[Copilot]

Pull request overview

Updates the PCI Compliance for AWS CloudTrail integration documentation to include example CloudTrail data and to document monitor creation and lifecycle actions for the app.

Changes:

• Added sample CloudTrail log message and a sample Sumo query for console login failures.
• Added a “Create monitors” section with an alerts table for PCI Compliance for AWS CloudTrail.
• Added upgrade/downgrade and uninstall sections using shared reusable MDX components.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[amee-sumo]

Approving. This adds sample log messages, sample queries, a 7-alert monitors table, and the standard Upgrade/Downgrade + Uninstalling sections to the PCI Compliance for AWS CloudTrail app doc. Structure and placement follow the v2 app-doc template, reuse imports resolve, there are no duplicate headings, and the alert conditions/operator formatting match the repo convention.

I pushed one follow-up commit (0f7eacf) with two small refinements:

• Changed alert descriptions from "This alert fires" to "This alert is triggered".
• Lowercased "for" in the alerts subsection heading to match the app name ("PCI Compliance for AWS CloudTrail").

One item to verify before merge: the 7 alert names still use capital "For" (PCI Compliance For AWS CloudTrail - ...). Please confirm these exactly match the shipped monitor names; if the monitors use lowercase "for", update the names to match.

Also worth tidying: the PR body has no "type of change" checkbox selected and no ticket in the body (title references SUMO-288112).

— via Claude Code