Sumo Logic v1.1.1

About the connector

Sumo Logic is a cloud-based log management and analytics service that leverages machine-generated big data to deliver real-time IT insights.

This document provides information about the Sumo Logic connector, which facilitates automated interactions with a Sumo Logic server using FortiSOAR™ playbooks. Add the ProtectWise connector as a step in FortiSOAR™ playbooks and perform automated operations, such as creating a search job on Sumo Logic, and retrieving the current status of a search job.

Version information

Connector Version: 1.1.1

Authored By: Community

Certified: No

Release Notes for version 1.1.1

Following enhancements have been made in the Sumo Logic connector in version 1.1.1:

• Fixed the Search Job related functions/actions to use cookies as per Sumo Logic API reference document.

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:

yum install cyops-connector-sumo-logic

Prerequisites to configuring the connector

• You must have the URL of Sumo Logic server to which you will connect and perform automated operations and the API ID and Key configured for your account for accessing the Sumo Logic API
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Sumo Logic server.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR, on the Connectors page, click the Sumo Logic connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from version 4.10.0 onwards:

operation: Create Search Job

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "link": {
        "rel": "",
        "href": ""
    }
}

operation: Get Search Job Status

Input parameters

Output

The output contains the following populated JSON schema:

{
    "state": "",
    "histogramBuckets": [
        {
            "startTimestamp": "",
            "length": "",
            "count": ""
        }
    ],
    "messageCount": "",
    "recordCount": "",
    "pendingWarnings": [],
    "pendingErrors": [],
    "usageDetails": ""
}

operation: Get Messages Founded by Search Job

Input parameters

Output

The output contains the following populated JSON schema:

{
    "fields": [
        {
            "name": "",
            "fieldType": "",
            "keyField": ""
        }
    ],
    "messages": [
        {
            "map": {
                "_collector": "",
                "eventtime": "",
                "type": "",
                "eventsource": "",
                "_messageid": "",
                "_size": "",
                "accountid": "",
                "category_string": "",
                "event_type": "",
                "action": "",
                "awsaccountid": "",
                "eventversion": "",
                "groupid": "",
                "_sourceid": "",
                "cidr_block": "",
                "requestid": "",
                "_source": "",
                "eventtype": "",
                "from_port": "",
                "eventid": "",
                "_raw": "",
                "_collectorid": "",
                "useragent": "",
                "_sourcehost": "",
                "eventname": "",
                "accesskeyid": "",
                "egress": "",
                "computer": "",
                "logon_id": "",
                "msg_summary": "",
                "account_name": "",
                "_format": "",
                "arn": "",
                "_blockid": "",
                "sourceipaddress": "",
                "account_domain": "",
                "_messagetime": "",
                "to_port": "",
                "_messagecount": "",
                "principalid": "",
                "recipientaccountid": "",
                "_sourcename": "",
                "event_id": "",
                "_view": "",
                "_receipttime": "",
                "_sourcecategory": "",
                "category": "",
                "responseelements": "",
                "awsregion": "",
                "username": ""
            }
        }
    ]
}

operation: Get Records Founded by Search Job

Input parameters

Output

The output contains the following populated JSON schema:

{
    "fields": [
        {
            "name": "",
            "fieldType": "",
            "keyField": ""
        }
    ],
    "records": [
        {
            "map": {
                "_count": "",
                "_sourcecategory": ""
            }
        }
    ]
}

operation: Delete Search Job

Input parameters

Output

The output contains the following populated JSON schema:

{
    "id": ""
}

Included playbooks

The Sample - Sumo Logic - 1.1.1 playbook collection comes bundled with the Sumo Logic connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Sumo Logic connector.

• Create Search Job
• Delete Search Job
• Get Messages Founded by Search Job
• Get Records Founded by Search Job
• Get Search Job Status

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.