Sumo Logic Access ID
Service Name: Sumo Logic
Service Description: Sumo Logic is a cloud-based log management and analytics service that leverages machine data to deliver real-time IT insights.
Service Address: https://www.sumologic.com/
Validation Type: API Auth
IP Allow list: Does not exist
Secret Access Scope: Grants access to Sumo Logic APIs and services based on the associated user's permissions.
Secret Revokement URL: Does not exist
Secret Example: su1AbCdEfGhIjK
Suspicious Activity Investigation Instructions:
- Review Sumo Logic audit logs for unauthorized access or unusual API calls
- Check for unexpected data exports or configuration changes
- Monitor for unusual query patterns or dashboard access
- Verify if there are any new users or roles created without authorization
Mitigation Instructions:
- Immediately rotate the access key in the Sumo Logic admin console
- Revoke the compromised credentials by generating new access keys
- Review and update access policies to ensure least privilege
- Enable multi-factor authentication if not already enabled
- Audit all actions performed using the compromised credentials