SumoLogic

Cloud-based service for logs & metrics management.

Analytics & SIEM · Sumo Logic

Details

IDSumoLogic
ProviderFrancisco Partners
CategoryAnalytics & SIEM
From Version5.0.0
Supported ModulesAgentix XSIAM EDR Cortex Cloud Attack Surface Management Cloud Runtime Security Cloud Posture Security Exposure Management

README

Use the SumoLogic integration to search for and return SumoLogic records.

Configure SumoLogic on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SumoLogic_copy.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • SumoLogic URL, in the format https://api.us2.sumologic.com/api/. This is region specific.
    • API Version
    • The access ID - can be created under "Settings"
    • The access key - can be created under "Settings"
    • Use system proxy settings
    • Trust any certificate (not secure)
    • Escape URLs (add a \\ prefix to = chars when the value queried is a URL. Default is false.)
    • Seconds to sleep between checking for results
    • Default limit for the number of records to retrieve
    • Fetch incidents
    • Incident type
    • Run this query to fetch new events as incidents
    • Timeframe for first fetch (in seconds)
    • Time between fetches (in seconds). The actual time will be the maximum between the selected value and the server configuration.
    • Default max total wait for results
    • Time Zone
    • Fetch aggregate records (instead of messages)
  4. Click Test to validate the URLs, token, and connection.
Note: in versions preceding 1.1.0, URL escaping was performed as default. The `Escape URLs` param allows disabling the escaping when necessary by setting it to `true`.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Search for SumoLogic records: search

1. Search for SumoLogic Records

Search SumoLogic for records that match the specified query.

Base Command

search

Input
Argument Name Description Required
query The search query to execute Required
from The ISO 8601 date of the time range to start the search (example - 2016-08-28T12:00:00). Can also be milliseconds since epoch. Required
to The ISO 8601 date of the time range to end the search (example - 2016-08-28T12:00:00). Can also be milliseconds since epoch. Required
limit Maximum number of results to return from query. Default is 100. The value specified overrides the default set in the limit parameter. Optional
offset Return results starting at this offset. should be int - by default is 0 Optional
timezone The time zone if from/to is not in milliseconds, default is UTC, See this (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) article for a list of time zone codes. Optional
maxTimeToWaitForResults Max amount of minutes to wait for search to end, default is 10 minutes Optional
headers A comma separated list of table headers that are displayed in order. For example, _blockid,_collector,_format. Optional
byReceiptTime Define as "true" to run the search using receipt time. By default, searches do not run by receipt time. Optional

 

Context Output
Path Type Description
Search.Messages unknown The array of raw message objects
Search.Records unknown The array of aggregate records

 

Command Example
!search query=_sourceCategory=macos/system from=2019-07-02T12:00:00 to=2019-07-04T16:00:00 using=SumoLogic_copy_instance_1 byReceiptTime=false limit=5
Context Example
{
    "Search": {
        "Messages": [
            {
                "_messageid": "-9223372036854375794",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745796",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255587000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:53:07 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.",
                "_size": "142",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "2",
                "_receipttime": "1562244826549",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375795",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745797",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255551000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:52:31 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics",
                "_size": "65",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "1",
                "_receipttime": "1562244789356",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375796",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745798",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255501000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:51:41 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.",
                "_size": "142",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "0",
                "_receipttime": "1562244754298",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854425618",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854750767",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255066000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:44:26 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.apple.quicklook[57770]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook",
                "_size": "210",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "2",
                "_receipttime": "1562244306570",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375797",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745799",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562254946000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:42:26 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics",
                "_size": "65",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "1",
                "_receipttime": "1562244217085",
                "_view": ""
            }
        ]
    }
}
Human Readable Output

SumoLogic Search Messages

blockid collector collectorid format messagecount messageid messagetime raw receipttime size source sourcecategory sourcehost sourceid sourcename view
-9223372036854745796 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 2 -9223372036854375794 1562255587000 Jul 4 15:53:07 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. 1562244826549 142 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854745797 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 1 -9223372036854375795 1562255551000 Jul 4 15:52:31 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics 1562244789356 65 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854745798 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 0 -9223372036854375796 1562255501000 Jul 4 15:51:41 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. 1562244754298 142 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854750767 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 2 -9223372036854425618 1562255066000 Jul 4 15:44:26 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.apple.quicklook[57770]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): 

Configuration parameters

  • url — Sumo Logic URL (region specific), for example: https://api.us2.sumologic.com/api/ (required)
  • apiVersion — API Version (required)
  • accessID — Access ID - can be created in Sumo Logic under "Settings"
  • accessKey — Access key - can be created in Sumo Logic under "Settings"
  • credentialsAccess — Access ID - can be created in Sumo Logic under "Settings"
  • useproxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • escape_urls — Escape URLs
  • sleepBetweenChecks — Seconds to sleep between checking for results (required)
  • limit — Default maximum number of records to retrieve (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • fetchQuery — Run this query to fetch new events as incidents
  • firstFetch — Timeframe for first fetch (in seconds)
  • fetchDelay — Time between fetches (in seconds). The actual time will be the maximum between the selected value and the server configuration.
  • maxTimeout — Default max total wait for results (in milliseconds)
  • timeZone — Time zone of the collector to fetch from (see detailed description)
  • fetchRecords — Fetch aggregate records (instead of messages)

Commands (1)

  • search

    Search SumoLogic for records that match the specified query.

Source

SumoLogic.js SumoLogic.yml SumoLogic_description.md
Download History Raw 
commonfields:
  id: SumoLogic
  version: -1
name: SumoLogic
display: SumoLogic
category: Analytics & SIEM
provider: Francisco Partners
description: Cloud-based service for logs & metrics management.
sectionorder:
- Connect
- Collect
configuration:
- display: 'Sumo Logic URL (region specific), for example: https://api.us2.sumologic.com/api/'
  name: url
  defaultvalue: https://api.us2.sumologic.com/api/
  type: 0
  required: true
  section: Connect
- display: API Version
  name: apiVersion
  defaultvalue: v1
  type: 0
  required: true
  section: Connect
- display: Access ID - can be created in Sumo Logic under "Settings"
  name: accessID
  defaultvalue: ""
  type: 0
  hidden: true
  required: false
  section: Connect
- display: Access key - can be created in Sumo Logic under "Settings"
  name: accessKey
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Access ID - can be created in Sumo Logic under "Settings"
  name: credentialsAccess
  type: 9
  displaypassword: Access key - can be created in Sumo Logic under "Settings"
  section: Connect
  required: false
- display: Use system proxy settings
  name: useproxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Escape URLs
  name: escape_urls
  defaultvalue: "false"
  type: 8
  additionalinfo: "Whether to add escaping before `=` chars in URLs. For further information, see the pack README"
  required: false
  section: Connect
- display: Seconds to sleep between checking for results
  name: sleepBetweenChecks
  defaultvalue: "3"
  type: 0
  required: true
  section: Connect
- display: Default maximum number of records to retrieve
  name: limit
  defaultvalue: "100"
  type: 0
  required: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Run this query to fetch new events as incidents
  section: Collect
  name: fetchQuery
  defaultvalue: ""
  type: 0
  required: false
- display: Timeframe for first fetch (in seconds)
  section: Collect
  name: firstFetch
  defaultvalue: "600"
  type: 0
  required: false
- display: Time between fetches (in seconds). The actual time will be the maximum between the selected value and the server configuration.
  name: fetchDelay
  defaultvalue: 60
  type: 0
  required: false
  section: Collect
- display: Default max total wait for results (in milliseconds)
  name: maxTimeout
  defaultvalue: "600"
  type: 0
  required: false
  section: Connect
- display: Time zone of the collector to fetch from (see detailed description)
  name: timeZone
  defaultvalue: UTC
  type: 0
  required: false
  section: Collect
- display: Fetch aggregate records (instead of messages)
  name: fetchRecords
  defaultvalue: "false"
  type: 8
  required: false
  section: Collect
script:
  script: ''
  type: javascript
  commands:
  - name: search
    arguments:
    - name: query
      required: true
      default: true
      description: The search query to execute.
    - name: from
      required: true
      description: 'The ISO 8601 date of the time range to start the search. For example: 2016-08-28T12:00:00. Can also be milliseconds since epoch.'
    - name: to
      required: true
      description: 'The ISO 8601 date of the time range to end the search. For example: 2016-08-28T12:00:00). Can also be milliseconds since epoch.'
    - name: limit
      description: Maximum number of results to return from the query. Default is 100. The value specified will override the default set in the "limit" parameter.
      defaultValue: "100"
    - name: offset
      description: Return results starting at this offset. should be int - by default is 0.
      defaultValue: "0"
    - name: timezone
      description: The time zone if from/to is not in milliseconds. Default is UTC. Please refer to the article at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for a list of time zone codes.
      defaultValue: UTC
    - name: maxTimeToWaitForResults
      description: Maximum amount of time (in minutes) to wait for the search to complete. Default is 10 minutes.
      defaultValue: "10"
    - name: headers
      description: 'A comma-separated list of table headers that are displayed in order. For example: "_blockid,_collector,_format".'
    - name: byReceiptTime
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If "true", the search is executed using receipt time. Default is "false".
      defaultValue: "false"
    - name: waitForSearchComplete
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If "true", the search will wait for the query to iterate over all messages before returning results. This is useful when working with aggregate records, as otherwise the query may return partial values.
      defaultValue: "false"
    outputs:
    - contextPath: Search.Messages
      description: The array of raw message objects.
    - contextPath: Search.Records
      description: The array of aggregate records.
    description: Search SumoLogic for records that match the specified query.
  isfetch: true
tests:
- No tests (auto formatted)
fromversion: 5.0.0