Configure integration with SIEM

Setting up Sumo Logic

To use Sumo Logic as a logging endpoint, you will need to create a Sumo Logic account, add a new source, and save the HTTP source URL. To add a new source in the Sumo Logic website, perform the following steps:

1. After you create your Sumo Logic account, the Sumo Logic Setup Wizard appears. If you already have an account, you can access the wizard by selecting Setup Wizard from the Manage menu at the top of the Sumo Logic application. In the Setup Wizard, click Set Up Streaming Data.
   
   

   The Select Data Type window appears.

2. Click All Other Sources.
   
   

   The Set Up Collection window appears.

3. Click HTTP Source.
   
   

   The Configure Source: HTTP Source window appears.

4. Enter a name in the Source Category (for example, Http Input), and select a timezone for your log files.
   
   
5. Click Continue to see a magic url such as the following:

   https://endpoint1.collection.us2.sumologic.com/receiver/v1/http/ZaVnA4dhaV0nFJAEMuwFDGEEZUnDedm7hYhkdUJSAE44bmKKp1mp4LsYDCr2MzTA0C21czkqjz9UVjC1mk4lw512KQ7Usz3OAmNwCMWO09eK9r7h2VZT7B==

   Save this URL in an editor. You will need it when you add Sumo Logic as an SIEM logging endpoint. Adding Sumo Logic as an SIEM logging endpoint

Adding Sumo Logic as an SIEM logging endpoint

To configure the server where audit logs will be sent, perform the following steps:

1. Navigate to Administration > Settings > SIEM Integration Configuration.
   
   
2. Select Enabled and paste the SIEM server endpoint that you copied previously, from Setting up Sumo Logic.
   Note: Ensure that you refer to your SIEM provider's documentation to get the information regarding the HTTP headers and requirements around JSON attributes (request body).
   
   
   
3. Select POST HTTP method, because Sumo Logic accepts the inputs as a POST method.
   Note: The SIEM tool certificate is optional and depends on the SIEM provider. Some SIEM providers require you to enter a valid SIEM tool certificate.
4. Enter a name for Event attribute(for example, audit). All the log messages will be logged under this category and will act as key to locate all the event logs.
   Note: The timestamp attribute is an optional field and depends on the SIEM provider's mapping for this field. For example, Splunk requires the value to be time and mapped to one of its timestamp fields. The maximum length allowed is 256 characters. All special characters are allowed except the backslash (\) and double quotation marks ("). These characters have to be escaped.
5. Click on plus (+) sign to enter a few key-value pairs for body (static attributes) that are sent out along with the logs. The key-value pairs also take special characters as inputs. You will be able to configure a maximum of 50 attributes.
   
   
6. Click on plus (+) sign to enter a few key value pairs for header to be sent with every event data log. The header data is specific to the SIEM provider. For example, with Sumo Logic, it supports header names starting with the letter X (for example, X-Sumo-Fields). You will be able to configure a maximum of 50 headers.
   
   

   For more information about header data, see the corresponding SIEM provider's documentation.

Verifying data in Sumo Logic