
SumoLogic
Outline
Introduction
This document provides the step-by-step procedure to configure SumoLogic in SAFE.
SAFE integrates with SumoLogic and fetches the security misconfiguration of the SumoLogic account in SAFE.
Prerequisites
-
Access required in SAFE:
- SAFE Admin Access
-
Access required in SumoLogic:
- SumoLogic Admin
-
Required User Inputs:
- API Instance URL
- Access ID
- Access Key
- Asset Name in SAFE (optional)
-
Required Scope:
- Admin Access
Generate Connection Details
-
How to generate Access ID:
- Log in to your SumoLogic account as Admin.
- Click on the Profile icon at the bottom left corner.
- Click on Preferences.
-
Click on + Add Access Key.
- Enter the Access Key Name.
-
Click on the Create Key button.
-
- The system displays an Access ID and Access Key. Copy and save both parameters to use later while configuring SumoLogic in SAFE.
-
It is critical to regularly cycle or update the Access ID and Access Key in SAFE according to your corporate credential rotation policy.
-
How to get API Instance URL (Region Specific):
- Access the SumoLogic API endpoints catalog by visiting the official documentation here.
- Locate the section titled API Endpoints.
- Select the specific base API deployment target that corresponds to your host instance deployment region.
-
Copy and save this base API URL to use during endpoint declaration within the configuration console panel.
Configure SumoLogic in SAFE
- Log in to your SAFE account as Admin.
- Click on the Integrations option from the left navigation pane.
-
Scroll down to find the SumoLogic integration card or search for SumoLogic in the integration catalog panel filter bar.
- Hover over the SumoLogic integration card and click on the Configure button.
-
Populate the matching integration properties fields:
- API Instance URL
- Access ID
- Access Key
- Asset Name in SAFE: Provide a descriptive value to uniquely identity this system entity within your workspace list layout.
- Enter the Auto Sync Frequency parameters.
- Click on the Test Connection button.
-
Once connection validation is successful, click on the Save button.
-
Once configuration changes are successfully committed, click on the Sync Now button to run an initial on-demand sync cycle.
- Upon successful ingestion pipeline processing, the connection manager populates all matching assets along with their security misconfiguration issues. You can observe details under the integration metrics view tabs.
View Results
Navigate to the bottom sections of the module management console workspace to review metrics layout fields:
-
Finding View: This tab displays all the findings details pulled from SumoLogic.
-
Asset View: This tab displays all the assets pulled from SumoLogic.
To check sync status and errors for this integration, see Integration History.
Did this article help?
Let us know by leaving a star rating at the top of this article.
