Sumo Logic

The Sumo Logic connector enables seamless integration with Sumo Logic's analytics platform, allowing users to automate actions and gain valuable insights from log data.

Sumo Logic is a cloud-native, machine data analytics platform delivering real-time continuous intelligence across the entire application lifecycle and stack. This connector enables Swimlane Turbine users to integrate Sumo Logic's powerful analytics and insights directly into their security workflows. By leveraging this integration, users can automate the addition and removal of tags to insights, manage search jobs, retrieve messages and records, and update insight statuses and assignees. This enhances incident response capabilities, streamlines threat hunting, and provides actionable intelligence for security operations.

Prerequisites

Before integrating Sumo Logic with Swimlane Turbine, ensure you have the following:

HTTP Basic Authentication with the following parameters:

URL: Endpoint for Sumo Logic API access

Access ID: Unique identifier for Sumo Logic API authentication

Access Key: Secret key for authenticating API requests

Capabilities

This connector provides the following capabilities:

Add Tag to Insight

Create Search Job

Delete Search Job

Get an Insight

Get Insights

Get Messages found by Search Job

Get Records found by Search Job

Get Search Job Status

Remove Tag from Insight

Update Insight Assignee

Update Insight Status

Insert or Update a Lookup Table Row

Notes

Documentation:

Sumo Logic CSE API: https://api.sumologic.com/docs/sec/

Sumo Logic Search API: https://help.sumologic.com/docs/api/search-job/

Sumo Logic Reference API: https://api.au.sumologic.com/docs/#operation/truncateTable

Additional Documentation

Sumo Logic Connector Documentation

Sumo Logic API Documentation

Sumo Logic Authentication Guide

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Access ID	string	Required
password	Access Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add Tag to Insight

Adds a specified tag to an existing Sumo Logic insight identified by its unique ID.

Endpoint

URL: api/sec/v1/insights/{{id}}/tags

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Add Tag to Insight action
tagName	string	Optional	Name of the resource

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"tagName":"Example Name"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.readableId	string	Response data
data.name	string	Response data
data.description	string	Response data
data.timestamp	string	Response data
data.source	string	Response data
data.assignedTo	string	Response data
data.teamAssignedTo	string	Response data
data.created	string	Response data
data.closed	string	Response data
data.closedBy	string	Response data
data.severity	string	Response data
data.confidence	number	Response data
data.assignee	object	Response data
data.assignee.username	string	Response data
data.assignee.displayName	string	Response data
data.status	object	Response data
data.status.name	string	Response data
data.status.displayName	string	Response data
data.resolution	string	Response data
data.subResolution	string	Response data
data.entity	object	Response data

Output Example

{"data":{"id":"12345678-1234-1234-1234-123456789abc","readableId":"string","name":"Example Name","description":"string","timestamp":"2024-01-01T00:00:00Z","source":"string","assignedTo":"string","teamAssignedTo":"string","created":"2024-01-01T00:00:00Z","closed":"string","closedBy":"string","severity":"string","confidence":123,"assignee":{"username":"Example Name","displayName":"Example Name"},"status":{"name":"Example Name","displayName":"Example Name"}}}

Create Search Job

Initiates a new search job in Sumo Logic using specified query parameters and time frame.

Endpoint

URL: api/v1/search/jobs

Method: POST

Input

Argument Name	Type	Required	Description
query	string	Optional	Parameter for Create Search Job
from	string	Optional	Parameter for Create Search Job
to	string	Optional	Parameter for Create Search Job
timeZone	string	Optional	Parameter for Create Search Job
byReceiptTime	boolean	Optional	Time value
autoParsingMode	string	Optional	Parameter for Create Search Job

Input Example

{"json_body":{"query":"| count _sourceCategory","from":"2019-05-03T12:00:00","to":"2019-05-03T12:05:00","timeZone":"IST","byReceiptTime":true,"autoParsingMode":"AutoParse"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
link	object	Output field: link
link.rel	string	Output field: link.rel
link.href	string	Output field: link.href

Output Example

{"id":"3EAC1BE90CF82845","link":{"rel":"self","href":"https://api.sumologic.com/api/v1/search/jobs/3EAC1BE90CF82845"}}

Delete Search Job

Removes a specified search job from Sumo Logic using the unique job identifier provided in path parameters.

Endpoint

URL: api/v1/search/jobs/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Delete Search Job action

Input Example

{"path_parameters":{"id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier

Output Example

{"id":"4E710FA73030FCBE"}

Get an Insight

Retrieve a specific insight from Sumo Logic using the provided ID and optional summary fields.

Endpoint

URL: api/sec/v1/insights/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get an Insight action
parameters.recordSummaryFields	array	Required	A list of fields to aggregate from the records of each Insight into a summarized list directly on the Insight object of the response.
parameters.exclude	array	Optional	A comma-separated list of subfields to be excluded from the response.

Input Example

{"parameters":{"recordSummaryFields":[""],"exclude":[""]},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.readableId	string	Response data
data.name	string	Response data
data.description	string	Response data
data.timestamp	string	Response data
data.source	string	Response data
data.assignedTo	string	Response data
data.teamAssignedTo	string	Response data
data.created	string	Response data
data.closed	string	Response data
data.closedBy	string	Response data
data.severity	string	Response data
data.confidence	number	Response data
data.assignee	object	Response data
data.assignee.username	string	Response data
data.assignee.displayName	string	Response data
data.status	object	Response data
data.status.name	string	Response data
data.status.displayName	string	Response data
data.resolution	string	Response data
data.subResolution	string	Response data
data.entity	object	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 29 Jan 2024 16:08:07 GMT","Content-Type":"application/json","Content-Length":"123","Connection":"keep-alive","Set-Cookie":"AWSALB=OMpD6EKOCBj7WwupPIzaBUgz6ixM7oNx9hN/dwiwCK0qRmXVNCxxad1735q11PlBJFudHlw9x...","Expires":"Thu, 01 Jan 1970 00:00:00 GMT","Strict-Transport-Security":"max-age=15552000","X-XSS-Protection":"1; mode=block","X-Frame-Options":"DENY","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"data":{"id":"string","reada...

Get Insights

Retrieve insights from Sumo Logic using specified summary fields to tailor the output data.

Endpoint

URL: api/sec/v1/insights/all

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Get Insights action
parameters.nextPageToken	string	Optional	Parameters for the Get Insights action
parameters.recordSummaryFields	array	Required	Parameters for the Get Insights action
parameters.expand	array	Optional	Parameters for the Get Insights action

Input Example

{"parameters":{"q":"string","nextPageToken":"string","recordSummaryFields":["string"],"expand":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.nextPageToken	string	Response data
data.objects	array	Response data
data.objects.id	string	Response data
data.objects.readableId	string	Response data
data.objects.name	string	Response data
data.objects.description	string	Response data
data.objects.timestamp	string	Response data
data.objects.source	string	Response data
data.objects.assignedTo	string	Response data
data.objects.teamAssignedTo	string	Response data
data.objects.created	string	Response data
data.objects.closed	string	Response data
data.objects.closedBy	string	Response data
data.objects.severity	string	Response data
data.objects.confidence	number	Response data
data.objects.assignee	object	Response data
data.objects.assignee.username	string	Response data
data.objects.assignee.displayName	string	Response data
data.objects.status	object	Response data
data.objects.status.name	string	Response data
data.objects.status.displayName	string	Response data
data.objects.resolution	string	Response data

Output Example

{"data":{"nextPageToken":"string","objects":[{}]}}

Get Messages found by Search Job

Retrieve messages from a Sumo Logic search job using the searchJobId, with options to specify offset and limit.

Endpoint

URL: api/v1/search/jobs/{{searchJobId}}/messages

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.searchJobId	string	Required	Parameters for the Get Messages found by Search Job action
parameters.offset	number	Required	Parameters for the Get Messages found by Search Job action
parameters.limit	number	Required	Parameters for the Get Messages found by Search Job action

Input Example

{"parameters":{"offset":0,"limit":10},"path_parameters":{"searchJobId":"37589506F194FC80"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fields	array	Output field: fields
fields.name	string	Name of the resource
fields.fieldType	string	Type of the resource
fields.keyField	boolean	Output field: fields.keyField
messages	array	Response message
messages.map	object	Response message
messages.map._count	string	Response message
messages.map._sourcecategory	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fields":[{},{}],"messages":[{}]}}

Get Records found by Search Job

Retrieve the number of records produced by a Sumo Logic search job, including details on aggregation, using the searchJobId, offset, and limit.

Endpoint

URL: api/v1/search/jobs/{{searchJobId}}/records

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.searchJobId	string	Required	Parameters for the Get Records found by Search Job action
parameters.offset	number	Required	Parameters for the Get Records found by Search Job action
parameters.limit	number	Required	Parameters for the Get Records found by Search Job action

Input Example

{"parameters":{"offset":0,"limit":10},"path_parameters":{"searchJobId":"37589506F194FC80"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
fields	array	Output field: fields
fields.name	string	Name of the resource
fields.fieldType	string	Type of the resource
fields.keyField	boolean	Output field: fields.keyField
records	array	Output field: records
records.map	object	Output field: records.map
records.map._count	string	Count value
records.map._sourcecategory	string	Output field: records.map._sourcecategory

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"fields":[{},{}],"records":[{}]}}

Get Search Job Status

Obtain the current status of a search job in Sumo Logic using the provided searchJobId.

Endpoint

URL: api/v1/search/jobs/{{searchJobId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.searchJobId	string	Required	Parameters for the Get Search Job Status action

Input Example

{"path_parameters":{"searchJobId":"37589506F194FC80"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
state	string	Output field: state
messageCount	number	Response message
histogramBuckets	array	Output field: histogramBuckets
histogramBuckets.length	number	Output field: histogramBuckets.length
histogramBuckets.count	number	Count value
histogramBuckets.startTimestamp	number	Output field: histogramBuckets.startTimestamp
pendingErrors	array	Error message if any
pendingErrors.file_name	string	Name of the resource
pendingErrors.file	string	Error message if any
pendingWarnings	array	Output field: pendingWarnings
pendingWarnings.file_name	string	Name of the resource
pendingWarnings.file	string	Output field: pendingWarnings.file
recordCount	number	Count value

Output Example

{"state":"DONE GATHERING RESULTS","messageCount":90,"histogramBuckets":[{"length":60000,"count":1,"startTimestamp":1359404820000},{"length":60000,"count":1,"startTimestamp":1359405480000},{"length":60000,"count":1,"startTimestamp":1359404340000}],"pendingErrors":[],"pendingWarnings":[],"recordCount":1}

Insert or Update a Lookup Table Row

Insert or update a row in a Sumo Logic lookup table; a new row is added if the primary key is unique.

Endpoint

URL: /api/v1/lookupTables/{{id}}/row

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Identifier of the lookup table.
row	array	Optional	A list of all the field identifiers and their corresponding values.
row.columnName	string	Required	Name of the column of the table.
row.columnValue	string	Required	Value of the specified column.

Input Example

{"json_body":{"row":[{"columnName":"user_id","columnValue":"user1"}]},"path_parameters":{"id":"0000000001C41EE4"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{},"reason":"OK"}

Remove Tag from Insight

Removes a specified tag from an insight in Sumo Logic using the insight's ID and the tag name.

Endpoint

URL: api/sec/v1/insights/{{id}}/tags/{{tagName}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Remove Tag from Insight action
path_parameters.tagName	string	Required	Parameters for the Remove Tag from Insight action

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc","tagName":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.readableId	string	Response data
data.name	string	Response data
data.description	string	Response data
data.timestamp	string	Response data
data.source	string	Response data
data.assignedTo	string	Response data
data.teamAssignedTo	string	Response data
data.created	string	Response data
data.closed	string	Response data
data.closedBy	string	Response data
data.severity	string	Response data
data.confidence	number	Response data
data.assignee	object	Response data
data.assignee.username	string	Response data
data.assignee.displayName	string	Response data
data.status	object	Response data
data.status.name	string	Response data
data.status.displayName	string	Response data
data.resolution	string	Response data
data.subResolution	string	Response data
data.entity	object	Response data

Output Example

{"data":{"id":"string","readableId":"string","name":"string","description":"string","timestamp":"2023-07-20T06:25:22Z","source":"ALGORITHM","assignedTo":"string","teamAssignedTo":"string","created":"2023-07-20T06:25:22Z","closed":"2023-07-20T06:25:22Z","closedBy":"string","severity":"CRITICAL","confidence":0,"assignee":{"username":"string","displayName":"string"},"status":{"name":"string","displayName":"string"}}}

Update Insight Assignee

Updates the assignee for a specific insight in Sumo Logic using the insight's ID and the new assignee details.

Endpoint

URL: api/sec/v1/insights/{{id}}/assignee

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Update Insight Assignee action
assignee	object	Optional	Parameter for Update Insight Assignee
assignee.type	string	Required	Type of the resource
assignee.value	string	Required	Value for the parameter

Input Example

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"assignee":{"type":"string","value":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.readableId	string	Response data
data.name	string	Response data
data.description	string	Response data
data.timestamp	string	Response data
data.source	string	Response data
data.assignedTo	string	Response data
data.teamAssignedTo	string	Response data
data.created	string	Response data
data.closed	string	Response data
data.closedBy	string	Response data
data.severity	string	Response data
data.confidence	number	Response data
data.assignee	object	Response data
data.assignee.username	string	Response data
data.assignee.displayName	string	Response data
data.status	object	Response data
data.status.name	string	Response data
data.status.displayName	string	Response data
data.resolution	string	Response data
data.subResolution	string	Response data
data.entity	object	Response data

Output Example

Update Insight Status

Updates the status of a specified insight in Sumo Logic using the provided insight ID.

Endpoint

URL: api/sec/v1/insights/{{id}}/status

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Id of status to be updated.
status	string	Optional	The status to update this Insight to. Default values are "new", "inprogress", and "closed", but custom statuses can also be created in the UI.
resolution	string	Optional	The resolution reason for closing this Insight.

Input Example

{"json_body":{"status":"new","resolution":"reason"},"path_parameters":{"id":"xyzstr1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.readableId	string	Response data
data.name	string	Response data
data.description	string	Response data
data.timestamp	string	Response data
data.source	string	Response data
data.assignedTo	string	Response data
data.teamAssignedTo	string	Response data
data.created	string	Response data
data.closed	string	Response data
data.closedBy	string	Response data
data.severity	string	Response data
data.confidence	number	Response data
data.assignee	object	Response data
data.assignee.username	string	Response data
data.assignee.displayName	string	Response data
data.status	object	Response data
data.status.name	string	Response data
data.status.displayName	string	Response data
data.resolution	string	Response data
data.subResolution	string	Response data
data.entity	object	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"id":"string","readableId":"string","name":"string","description":"string","timestamp":"2024-04-22T09:18:50Z","source":"ALGORITHM","assignedTo":"string","teamAssignedTo":"string","created":"2024-04-22T09:18:50Z","closed":"2024-04-22T09:18:50Z","closedBy":"string","severity":"CRITICAL","confidence":0,"assignee":{},"status":{}}}}

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	123
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Mon, 29 Jan 2024 16:08:07 GMT
Expires	The date/time after which the response is considered stale	Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie	HTTP response header: Set-Cookie	AWSALB=OMpD6EKOCBj7WwupPIzaBUgz6ixM7oNx9hN/dwiwCK0qRmXVNCxxad1735q11PlBJFudHlw9xCswXJn6lDGxaidBEvshMbrrSRDM67p8EdXIzZQ5vaOiQmXLGN4a; Expires=Mon, 05 Feb 2024 16:08:07 GMT; Path=/, AWSALBCORS=OMpD6EKOCBj7WwupPIzaBUgz6ixM7oNx9hN/dwiwCK0qRmXVNCxxad1735q11PlBJFudHlw9xCswXJn6lDGxaidBEvshMbrrSRDM67p8EdXIzZQ5vaOiQmXLGN4a; Expires=Mon, 05 Feb 2024 16:08:07 GMT; Path=/; SameSite=None; Secure, SUMOAPIID=node08z5fwybx9i1z6ebzu7o38tn51837873.node0; Path=/; Secure; HttpOnly
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block