Sumo Logic Cloud SIEM (v1.1.36)
Sumo Logic Cloud SIEM provides threat detection and incident response for modern IT environments. This content pack will allow you to apply automation to perform actual SOC analyst workflows. Using this content pack you will be able to fetch Incidents via Insights, update status of an Insight, add items to match list, add Threat Intel Indicators to Threat Intel Sources, and so on.
- Author
- Sumo Logic
- Support
- partner
- URL
- https://www.sumologic.com/solutions/cloud-siem-enterprise/
- Categories
- Analytics & SIEM
Incident fields (8)
- Sumo Logic Cloud SIEM Insight Entity
- Sumo Logic Cloud SIEM Insight Involved Entities
- Sumo Logic Cloud SIEM Insight Signals
- Sumo Logic Cloud SIEM Insight URL
- Sumo Logic Cloud SIEM Record Fields
- Sumo Logic Cloud SIEM Record Fields JSON
- Sumo Logic Cloud SIEM Signal Entity
- Sumo Logic Cloud SIEM Signal Records
Integrations (1)
- Sumo Logic Cloud SIEM
Layouts (2)
- Sumo Logic Insight
- Sumo Logic Signal
Scripts (2)
- SumoLogicCloseLinkSignalIncidents
- SumoLogicLinkSignalIncidents
README
The integration in this pack enables interactions with Sumo Logic Cloud SIEM. It can be used to fetch Incidents via Insights, update status of an Insight, add items to match list, search Entities/Signals/Insights/Threat Intel indicators, and more.
What does this pack do?
This pack enables you to run commands that:
- Fetch Incidents via Insights
- Search Entities, Signals, Insights and Threat Intel indicators
- Change status of Insight
- Get Insight comments
- Add items to match list
- Add Threat Intel Indicators to Threat Intel Sources
- Mirror IN and OUT Sumo Logic Insights and Signals to XSOAR incidents
Note: This pack replaces the legacy JASK pack. For further details about the migration from JASK, visit our reference docs.