> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sumo-logic/sumo-logic.md).

# Sumo Logic

Use Sumo Logic data in Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

* Security Posture: Detect, monitor and alert on settings of your SaaS application.
  * saas-posture-config-remediation: Help remediate the misconfigured security settings of your SaaS application.

### How to configure the Sumo Logic connector <a href="#how-to-configure-the-aha-connector" id="how-to-configure-the-aha-connector"></a>

To access Sumo Logic, Cortex XSIAM requires the following information, which you will specify during the connection process.

* **Admin Access ID**: A unique alphanumeric string that identifies the access key pair — analogous to a user ID.
* **Admin Access Key**: The secret credential Cortex XSIAM uses to authenticate API requests — analogous to a password.
* **Endpoint Region**: The region where Sumo Logic hosts your data.

#### Task 1: Generate a Sumo Logic access key

1. Identify the Sumo Logic account you will use to generate the access key.\
   Required permissions: You must generate the access key from the account designated as the Sumo Logic account owner — either the user who registered the account or a user later designated as owner.
2. Log in to Sumo Logic as the account owner.
3. Navigate to your preferences: click your profile icon in the upper-right corner and select **\<profile-icon> > Preferences**.
4. Select the Personal Access Keys tab and click Add Access Key.
5. In the Add New Access Key window, enter a meaningful name for the key — for example, SaaS-Security-Integration.
6. Under Scopes, select the Custom option and select the following scopes:

**Note**: Sine the access key is generated from the account owner (highest privilege level), explicitly limit the key's permissions to the minimum required by Cortex XSIAM.

* Access Keys - View
* Access Keys - Manage
* Users And Roles - View
* Users And Roles - Manage
* Content admin
* Manage Library
* Run Log Search - View/Manage
* View Collectors
* View Security Settings
* View Account Status

7. Click **Save**. Sumo Logic generates the key and displays the Access ID and Access Key.
8. Copy the Access ID and Access Key and save them to a text file. Do not proceed until you have copied both values. You must provide them during onboarding.

***

#### Task 2: Identify your endpoint region

Use the following table to determine your region based on your Sumo Logic login URL:

| URL                       | Region              |
| ------------------------- | ------------------- |
| api.au.sumologic.com      | AU (Australia)      |
| api.ca.sumologic.com      | CA (Canada)         |
| service.de.sumologic.com  | DE (Germany)        |
| service.eu.sumologic.com  | EU (European Union) |
| service.fed.sumologic.com | FED (US Government) |
| service.in.sumologic.com  | IN (India)          |
| service.jp.sumologic.com  | JP (Japan)          |
| service.sumologic.com     | US1 (United States) |
| service.us2.sumologic.com | US2 (United States) |

***

#### Task 3: Connect Cortex XSIAM to Sumo Logic

1. In Cortex XSIAM, navigate to **Settings** → **Data Sources & Integrations**.
2. Click **+ Add new**.
3. In the **Add Data Sources or Integrations** page, search for Sentry.
4. Under **Recommended**, hover over the new Sumo Logic and click **Add Instance** to launch the configuration wizard.
5. Under the **Capabilities** tab, Enter a Name for your application.
6. Select Security Posture under **Default Capabilities**.
7. Click **Next**.
8. Under **Connection**, enter your Admin Access ID, Admin Access Key, and Endpoint Region.
9. Under **Configuration** tab, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
10. A confirmation message indicates that Sumo Logic is successfully connected. Confirm the Summary details and click **Save instance**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sumo-logic/sumo-logic.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.