Skip to content

Sumo Logic Install Token

Service Name: Sumo Logic

Service Description: Sumo Logic is a cloud-based log management and analytics service that leverages machine data to deliver real-time IT insights. It provides a unified platform for log management, metrics, and security analytics.

Service Address: https://www.sumologic.com/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to create and configure collectors in Sumo Logic environments.

Secret Revokement URL: Does not exist

Secret Example: SUMOodHRwczovL2NvbGxlY3RvcnMub2xvZ2ljLmNvbQ==

Suspicious Activity Investigation Instructions:

  • Check Sumo Logic audit logs for unauthorized collector installations or configurations
  • Review collector configurations for any unauthorized changes
  • Monitor for unusual data collection patterns or unexpected sources
  • Check for unauthorized access to log data or dashboards

Mitigation Instructions:

  • Revoke the compromised install token by contacting Sumo Logic support
  • Generate a new install token for legitimate collectors
  • Update all existing collectors with the new token
  • Review and update access controls for Sumo Logic administration
  • Implement IP restrictions if possible through Sumo Logic's enterprise security features