Add Supportability section to README.md

README.md

@@ -2,16 +2,25 @@
 
 This app for Splunk connects to the Signal Sciences API in order to pull data into Splunk. 
 
-## Signal Sciences REST API Endpoints used
+## Supportability 
+
+As stated on the [splunk marketplace](https://splunkbase.splunk.com/app/3495), this app is not officially supported by Fastly support channels. 
+Any support requests are to be raised via GitHub issues and any response is to be considered best effort. 
 
-The latest version **only** supports using API Tokens. 
+If using on-premises agents it is highly recommended to use `waf-data-log` (https://docs.fastly.com/en/ngwaf/agent-config#agentcfg_waf-data-log) and to the logs to splunk using the appropriate log collection
+utilities (i.e using a [Forwarder](https://www.splunk.com/en_us/blog/learn/splunk-universal-forwarder.html)) that can be exported to an event collector (i.e [HEC](https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/UsetheHTTPEventCollector)).
 
-Information about API Tokens can be found at https://docs.signalsciences.net/developer/using-our-api/
+Because this TA relies on the upstream API availability for request/inspection data, sites with large amounts of traffic, considered mission critical or are inclusive of a immediate event notification window, a forward logging strategy of exporting real time inspection data from the agent itself is strongly recommended. 
 
-1. https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/sites/{{site}}/analytics/events
-2. https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/sites/{{site}}/feed/requests
-3. https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/activity
+If you have any questions regarding the appropriate logging strategy that is right for you, and how to get up and running, please email `support@fastly.com` to help find a solution that fits your requirements.
+
+## Signal Sciences REST API Endpoints used
 
+1. [Events](https://docs.fastly.com/signalsciences/api/#_corps__corpName__sites__siteName__analytics_events_get): https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/sites/{{site}}/analytics/events
+2. [Requests*](https://docs.fastly.com/signalsciences/api/#_corps__corpName__sites__siteName__feed_requests_get): https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/sites/{{site}}/feed/requests
+3. [Activity](https://docs.fastly.com/signalsciences/api/#_corps__corpName__activity_get): https://dashboard.signalsciences.net/api/v0/corps/{{corp}}/activity
+
+*The bulk collection endpoint (`/feed/requests`) aimed for client side collection, differs to the endpoint the NGWAF dashboard uses (`/requests`). If you notice discrepencies between the `totalCount` of events between the 2 endpoints for the same period of time, this is typically not a result of the TA itself, please contact support@fastly.com for further support in this instance.
 
 ## Where to get API Information?
 
@@ -25,10 +34,8 @@ You can also get the API Name for Dashboard Sites from the Manage Sites menu if
 
 
 ## Indexes
-
 The Technical Adapter does not create an index by default.
 
-
 ## Configuration 1.0.27 or higher
 
 Once the Splunk App has been installed you will need to configure the shared settings and then the Modular Data inputs.