Sumo Logic

Use Sumo Logic data in Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Security Posture: Detect, monitor and alert on settings of your SaaS application.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SaaS application.

How to configure the Sumo Logic connector

To access Sumo Logic, Cortex XSIAM requires the following information, which you will specify during the connection process.

• Admin Access ID: A unique alphanumeric string that identifies the access key pair — analogous to a user ID.
• Admin Access Key: The secret credential Cortex XSIAM uses to authenticate API requests — analogous to a password.
• Endpoint Region: The region where Sumo Logic hosts your data.

Task 1: Generate a Sumo Logic access key

1. Identify the Sumo Logic account you will use to generate the access key. Required permissions: You must generate the access key from the account designated as the Sumo Logic account owner — either the user who registered the account or a user later designated as owner.
2. Log in to Sumo Logic as the account owner.
3. Navigate to your preferences: click your profile icon in the upper-right corner and select <profile-icon> > Preferences.
4. Select the Personal Access Keys tab and click Add Access Key.
5. In the Add New Access Key window, enter a meaningful name for the key — for example, SaaS-Security-Integration.
6. Under Scopes, select the Custom option and select the following scopes:

Note: Sine the access key is generated from the account owner (highest privilege level), explicitly limit the key's permissions to the minimum required by Cortex XSIAM.

• Access Keys - View
• Access Keys - Manage
• Users And Roles - View
• Users And Roles - Manage
• Content admin
• Manage Library
• Run Log Search - View/Manage
• View Collectors
• View Security Settings
• View Account Status

1. Click Save. Sumo Logic generates the key and displays the Access ID and Access Key.
2. Copy the Access ID and Access Key and save them to a text file. Do not proceed until you have copied both values. You must provide them during onboarding.

---

Task 2: Identify your endpoint region

Use the following table to determine your region based on your Sumo Logic login URL:

URL	Region
api.au.sumologic.com	AU (Australia)
api.ca.sumologic.com	CA (Canada)
service.de.sumologic.com	DE (Germany)
service.eu.sumologic.com	EU (European Union)
service.fed.sumologic.com	FED (US Government)
service.in.sumologic.com	IN (India)
service.jp.sumologic.com	JP (Japan)
service.sumologic.com	US1 (United States)
service.us2.sumologic.com	US2 (United States)

---

Task 3: Connect Cortex XSIAM to Sumo Logic

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.
2. Click + Add new.
3. In the Add Data Sources or Integrations page, search for Sentry.
4. Under Recommended, hover over the new Sumo Logic and click Add Instance to launch the configuration wizard.
5. Under the Capabilities tab, Enter a Name for your application.
6. Select Security Posture under Default Capabilities.
7. Click Next.
8. Under Connection, enter your Admin Access ID, Admin Access Key, and Endpoint Region.
9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
10. A confirmation message indicates that Sumo Logic is successfully connected. Confirm the Summary details and click Save instance.