Skip to content

Sumo Logic (Log Analytics) - WIP

This document utilizes Sumo Logic's Log Analytics platform

SailPoint Entro can integrate with SumoLogic by utilizing SumoLogic's Hosted HTTP Collector and SailPoint Entro's Webhook mechanism.

Risk Data Collection

  1. Create a Hosted Collector

Hosted Collector Creation

  1. Head over to https://service.sumologic.com/collection
  2. Click on "Add Collector" on the right side of the screen
  3. Select "Hosted Collector"
  4. In the window opened, Enter a name of your choice and click Save
  5. Add a data source - Click OK

Configuring a Data Source

  1. Select "HTTP Logs & Metrics"
  2. Specify the name and category - In the Source Category specify SailPoint Entro and save
  3. Your webhook will be generated - Please copy it

Set up the Webhook in SailPoint Entro

In SailPoint Entro, go to the Webhook alerting section and add the URL as a Custom Webhook, click on Save

Now, upon Risk creation or update in SailPoint Entro, the data will be ingested in SumoLogic.

Viewing Received SailPoint Entro Risk Data

In SumoLogic either by going directly to Log Search, by specifying the collector using the following query -

_source="Entro" and _collector="Entro"

Or in the collection page by hovering on the collector and clicking on the left button.

Either way will result in the following view - Risks are ingested by SumoLogic -

Alerting and Playbooks

Let us create a sample Alert and a Playbook.

Visiting the Log Search page, enter the following query -

_source="Entro" and _collector="Entro"
| where !isBlank(createdRisk.guid)
AND createdRisk.severity="CRITICAL"

This will leave us with the ingested created risks where the severity of said risk is critical and critical only.

For this filter, we can create a Sumo Logic monitor, by pressing the three dots icon.

Monitor Configuration

In the Monitor configuration screen we can notice several things.

Below, we can see the query used to create the Monitor, the trigger, in this case - the count of risks, and the minimum threshold for which to trigger an alert. Note that we are creating an alert per risk detected.

The Monitor allows us to directly notify the alert creation, by Email or any other configured connection type.

And, most importantly - it allows us to run Playbooks - we will add a Playbook later.

In the "Monitor Details" section - give the Monitor a name, and save it.

Playbooks

Head over to the Playbooks page, this is where our Sumo Logic playbooks are created and stored.

  1. Create a Playbook
  2. Edit the Playbook by clicking on the Pencil icon
  3. Modify the start point by clicking on the Pencil icon
  4. Select the "Alert" as an input and save
  5. Add a node by clicking on the Plus icon on the start node
  6. Select Action as the node type
  7. Make sure the node integration is configured as Jira and fill in the rest of the details in the window.