SumoLogicSEC
Freeing the analyst with autonomous decisions.
Analytics & SIEM · Sumo Logic Cloud SIEM
Configuration parameters
api_endpoint— Sumo Logic API Endpoint (required)instance_endpoint— Sumo Logic Instance EndpointisFetch— Fetch incidentsincidentType— Incident typeaccess_id— Access ID (required)access_key— Access Key (required)incidentFetchInterval— Incidents Fetch Intervalmax_fetch— Fetch Limitfetch_query— Override default fetch queryfirst_fetch— First fetch timepull_signals— Pull associated Sumo Logic Signals as Incidentsmirror_direction— Incident Mirroring Directionclose_incident— Close Mirrored XSOAR Incidentclose_insight— Close Mirrored Sumo Logic Insightrecord_summary_fields— Override Record Summary Fields
Commands (14)
-
sumologic-sec-entity-get-detailsGet entity details for a specific entity ID.
-
sumologic-sec-entity-searchSearch entities using the available filters.
-
sumologic-sec-insight-add-commentAdd a comment for a specific Insight ID (Users can post and update comments on the Sumo Logic Cloud SIEM portal for any Insight ID).
-
sumologic-sec-insight-get-commentsGet comments for a specific Insight ID (Users can post and update comments on the Sumo Logic Cloud SIEM portal for any Insight ID).
-
sumologic-sec-insight-get-detailsGet Insight details for a specific Insight ID.
-
sumologic-sec-insight-searchSearch insights using available filters.
-
sumologic-sec-insight-set-statusChange the status of an Insight.
-
sumologic-sec-match-list-getGet match lists.
-
sumologic-sec-match-list-updateAdd an item to a match list.
-
sumologic-sec-signal-get-detailsGet Signal details for a specific Signal ID. Signal details command references signals in Sumo Logic Cloud SIEM which are created when records exhibit suspicious properties and mate with patterns or other detection logic.
-
sumologic-sec-signal-searchSearch signals using available filters.
-
sumologic-sec-threat-intel-get-sourcesGet Threat Intel Sources.
-
sumologic-sec-threat-intel-search-indicatorsSearch Threat Intel Indicators.
-
sumologic-sec-threat-intel-update-sourceAdd a Threat Intel Indicator to an Threat Intel Source.