SumoLogic

Cloud-based service for logs & metrics management.

Analytics & SIEM · Sumo Logic

Details

IDSumoLogic
ProviderFrancisco Partners
CategoryAnalytics & SIEM
From Version5.0.0
Supported ModulesAgentix XSIAM EDR Cortex Cloud Attack Surface Management Cloud Runtime Security Cloud Posture Security Exposure Management

README

Use the SumoLogic integration to search for and return SumoLogic records.

Configure SumoLogic on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for SumoLogic_copy.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • SumoLogic URL, in the format https://api.us2.sumologic.com/api/. This is region specific.
    • API Version
    • The access ID - can be created under "Settings"
    • The access key - can be created under "Settings"
    • Use system proxy settings
    • Trust any certificate (not secure)
    • Escape URLs (add a \\ prefix to = chars when the value queried is a URL. Default is false.)
    • Seconds to sleep between checking for results
    • Default limit for the number of records to retrieve
    • Fetch incidents
    • Incident type
    • Run this query to fetch new events as incidents
    • Timeframe for first fetch (in seconds)
    • Time between fetches (in seconds). The actual time will be the maximum between the selected value and the server configuration.
    • Default max total wait for results
    • Time Zone
    • Fetch aggregate records (instead of messages)
  4. Click Test to validate the URLs, token, and connection.
Note: in versions preceding 1.1.0, URL escaping was performed as default. The `Escape URLs` param allows disabling the escaping when necessary by setting it to `true`.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Search for SumoLogic records: search

1. Search for SumoLogic Records

Search SumoLogic for records that match the specified query.

Base Command

search

Input
Argument Name Description Required
query The search query to execute Required
from The ISO 8601 date of the time range to start the search (example - 2016-08-28T12:00:00). Can also be milliseconds since epoch. Required
to The ISO 8601 date of the time range to end the search (example - 2016-08-28T12:00:00). Can also be milliseconds since epoch. Required
limit Maximum number of results to return from query. Default is 100. The value specified overrides the default set in the limit parameter. Optional
offset Return results starting at this offset. should be int - by default is 0 Optional
timezone The time zone if from/to is not in milliseconds, default is UTC, See this (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) article for a list of time zone codes. Optional
maxTimeToWaitForResults Max amount of minutes to wait for search to end, default is 10 minutes Optional
headers A comma separated list of table headers that are displayed in order. For example, _blockid,_collector,_format. Optional
byReceiptTime Define as "true" to run the search using receipt time. By default, searches do not run by receipt time. Optional

 

Context Output
Path Type Description
Search.Messages unknown The array of raw message objects
Search.Records unknown The array of aggregate records

 

Command Example
!search query=_sourceCategory=macos/system from=2019-07-02T12:00:00 to=2019-07-04T16:00:00 using=SumoLogic_copy_instance_1 byReceiptTime=false limit=5
Context Example
{
    "Search": {
        "Messages": [
            {
                "_messageid": "-9223372036854375794",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745796",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255587000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:53:07 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.",
                "_size": "142",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "2",
                "_receipttime": "1562244826549",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375795",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745797",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255551000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:52:31 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics",
                "_size": "65",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "1",
                "_receipttime": "1562244789356",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375796",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745798",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255501000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:51:41 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.",
                "_size": "142",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "0",
                "_receipttime": "1562244754298",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854425618",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854750767",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562255066000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:44:26 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.apple.quicklook[57770]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook",
                "_size": "210",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "2",
                "_receipttime": "1562244306570",
                "_view": ""
            },
            {
                "_messageid": "-9223372036854375797",
                "_collectorid": "162683374",
                "_blockid": "-9223372036854745799",
                "_source": "macOS System",
                "_format": "t:cache:o:0:l:15:p:MMM dd HH:mm:ss",
                "_sourcename": "/private/var/log/system.log",
                "_sourcecategory": "macos/system",
                "_sourcehost": "TLVMAC30YCJG5H",
                "_messagetime": "1562254946000",
                "_sourceid": "753908607",
                "_raw": "Jul  4 15:42:26 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics",
                "_size": "65",
                "_collector": "TLVMAC30YCJG5H",
                "_messagecount": "1",
                "_receipttime": "1562244217085",
                "_view": ""
            }
        ]
    }
}
Human Readable Output

SumoLogic Search Messages

blockid collector collectorid format messagecount messageid messagetime raw receipttime size source sourcecategory sourcehost sourceid sourcename view
-9223372036854745796 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 2 -9223372036854375794 1562255587000 Jul 4 15:53:07 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. 1562244826549 142 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854745797 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 1 -9223372036854375795 1562255551000 Jul 4 15:52:31 TLVMAC30YCJG5H syslogd[46]: ASL Sender Statistics 1562244789356 65 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854745798 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 0 -9223372036854375796 1562255501000 Jul 4 15:51:41 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.mine.cnmaint): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. 1562244754298 142 macOS System macos/system TLVMAC30YCJG5H 753908607 /private/var/log/system.log  
-9223372036854750767 TLVMAC30YCJG5H 162683374 t:cache:0:l:15:p:MMM dd HH:mm:ss 2 -9223372036854425618 1562255066000 Jul 4 15:44:26 TLVMAC30YCJG5H com.apple.xpc.launchd[1] (com.apple.quicklook[57770]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): 

Configuration parameters

  • url — Sumo Logic URL (region specific), for example: https://api.us2.sumologic.com/api/ (required)
  • apiVersion — API Version (required)
  • accessID — Access ID - can be created in Sumo Logic under "Settings"
  • accessKey — Access key - can be created in Sumo Logic under "Settings"
  • credentialsAccess — Access ID - can be created in Sumo Logic under "Settings"
  • useproxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • escape_urls — Escape URLs
  • sleepBetweenChecks — Seconds to sleep between checking for results (required)
  • limit — Default maximum number of records to retrieve (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • fetchQuery — Run this query to fetch new events as incidents
  • firstFetch — Timeframe for first fetch (in seconds)
  • fetchDelay — Time between fetches (in seconds). The actual time will be the maximum between the selected value and the server configuration.
  • maxTimeout — Default max total wait for results (in milliseconds)
  • timeZone — Time zone of the collector to fetch from (see detailed description)
  • fetchRecords — Fetch aggregate records (instead of messages)

Commands (1)

  • search

    Search SumoLogic for records that match the specified query.

Source

SumoLogic.js SumoLogic.yml SumoLogic_description.md
Download History Raw 
Follow this guide to generate access keys: [https://help.sumologic.com/Manage/Security/Access_Keys](https://help.sumologic.com/Manage/Security/Access_Keys).
For the URL argument, take a look here: [https://help.sumologic.com/APIs/01Collector_Management_API/Sumo_Logic_Endpoints](https://help.sumologic.com/APIs/01Collector_Management_API/Sumo_Logic_Endpoints)
For a list of possible values for the **timeZone** parameter, refer to the **TZ database name** column in this [Wikipedia](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) article.