Sumo Logic Cloud SIEM

Integration version: 3.0

Configure Sumo Logic Cloud SIEM integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	https://{instance}	Yes	API root of the Sumo Logic Cloud SIEM instance.
API Key	String	N/A	No	API Key of the Sumo Logic Cloud SIEM account. Note: API key has priority over other authentication method.
Access ID	String	N/A	No	Access ID of the Sumo Logic Cloud SIEM account. Note: Both Access ID and Access Key are required for this type of authentication.
Access Key	String	N/A	No	Access Key of the Sumo Logic Cloud SIEM account. Note: Both Access ID and Access Key are required for this type of authentication.
Verify SSL	Checkbox	Unchecked	Yes	If enabled, verify that the SSL certificate for the connection to the Sumo Logic Cloud SIEM server is valid.

Use Cases

Ingest alerts.

Actions

Ping

Description

Test connectivity to Sumo Logic Cloud SIEM with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

This action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

N/A

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If successful: "Successfully connected to the Sumo Logic Cloud SIEM server with the provided connection parameters!" The action should fail and stop a playbook execution: If not successful: "Failed to connect to the Sumo Logic Cloud SIEM server! Error is {0}".format(exception.stacktrace)	General

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If successful: "Successfully connected to the Sumo Logic Cloud SIEM server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the Sumo Logic Cloud SIEM server! Error is {0}".format(exception.stacktrace)

General

Search Entity Signals

Description

Search signals related to entities in Sumo Logic Cloud SIEM. Supported entities: IP Address, Hostname, Username.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Lowest Severity To Return	Integer	5	No	Specify the lowest severity number that is used to return signals. Maximum: 10
Time Frame	DDL	Last Hour Possible Values: Last Hour Last 6 Hours Last 24 Hours Last Week Last Month 5 Minutes Around Alert Time 30 Minutes Around Alert Time 1 Hour Around Alert Time Custom	No	Specify a time frame for the results. If "Custom" is selected, you also need to provide "Start Time". If "Alert Time Till Now" is selected, the action uses start time of the alert as start time for the search and end time is current time. If "30 Minutes Around Alert Time" is selected, the action searches the alerts 30 minutes before the alert happened till the 30 minutes after the alert has happened. Same idea applies to "1 Hour Around Alert Time" and "5 Minutes Around Alert Time"
Start Time	String	N/A	No	Specify the start time for the results. This parameter is mandatory, if "Custom" is selected for the "Time Frame" parameter. Format: ISO 8601
End Time	String	N/A	No	Specify the end time for the results. If nothing is provided and "Custom" is selected for the "Time Frame" parameter then this parameter uses current time. Format: ISO 8601
Max Signals To Return	Integer	50	No	Specify the number of signals to return per entity.

Run On

This action runs on the following entities:

IP Address
Hostname
Username

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

[
    {
        "allRecords": [
            {
                "action": "failed password attempt",
                "bro_dns_answers": [],
                "bro_file_bytes": {},
                "bro_file_connUids": [],
                "bro_flow_service": [],
                "bro_ftp_pendingCommands": [],
                "bro_http_cookieVars": [],
                "bro_http_origFuids": [],
                "bro_http_origMimeTypes": [],
                "bro_http_request_headers": {},
                "bro_http_request_proxied": [],
                "bro_http_response_headers": {},
                "bro_http_response_respFuids": [],
                "bro_http_response_respMimeTypes": [],
                "bro_http_tags": [],
                "bro_http_uriVars": [],
                "bro_kerberos_clientCert": {},
                "bro_kerberos_serverCert": {},
                "bro_sip_headers": {},
                "bro_sip_requestPath": [],
                "bro_sip_responsePath": [],
                "bro_ssl_certChainFuids": [],
                "bro_ssl_clientCertChainFuids": [],
                "cseSignal": {},
                "day": 11,
                "device_ip": "172.30.202.30",
                "device_ip_ipv4IntValue": 2887698974,
                "device_ip_isInternal": true,
                "device_ip_version": 4,
                "fieldTags": {},
                "fields": {
                    "auth_method": "ssh2",
                    "endpoint_ip": "172.30.202.30",
                    "endpoint_username": "bL0ofHLH",
                    "event_message": "Failed password for invalid user",
                    "src_port": "39788"
                },
                "friendlyName": "record",
                "hour": 10,
                "http_requestHeaders": {},
                "listMatches": [],
                "matchedItems": [],
                "metadata_deviceEventId": "citrix_xenserver_auth_message",
                "metadata_mapperName": "Citrix Xenserver Auth Message",
                "metadata_mapperUid": "bcc62402-2870-49ad-ba8d-64ddf22fd342",
                "metadata_parseTime": 1646994593976,
                "metadata_product": "Hypervisor",
                "metadata_productGuid": "6751ee25-4ef9-4f9f-9c8b-c39668856994",
                "metadata_receiptTime": 1646994592,
                "metadata_relayHostname": "centos-002",
                "metadata_schemaVersion": 3,
                "metadata_sensorId": "0b52e838-2dbd-4fc0-a2b5-7135a5dc72b7",
                "metadata_sensorInformation": {},
                "metadata_sensorZone": "default",
                "metadata_vendor": "Citrix",
                "month": 3,
                "normalizedAction": "logon",
                "objectType": "Authentication",
                "srcDevice_ip": "172.30.202.30",
                "srcDevice_ip_ipv4IntValue": 2887698974,
                "srcDevice_ip_isInternal": true,
                "srcDevice_ip_version": 4,
                "success": false,
                "timestamp": 1646994592000,
                "uid": "7a89ebd4-3346-59fe-839a-9fc9bf99f51a",
                "user_username": "bL0ofHLH",
                "user_username_raw": "bL0ofHLH",
                "year": 2022
            }
        ],
        "artifacts": [],
        "contentType": "ANOMALY",
        "description": "Detects multiple failed login attempts from a single source with unique usernames over a 24 hour timeframe. This is designed to catch both slow and quick password spray type attacks. The threshold and time frame can be adjusted based on the customer's environment.",
        "entity": {
            "entityType": "_ip",
            "hostname": null,
            "id": "_ip-172.30.202.30",
            "macAddress": null,
            "name": "172.30.202.30",
            "sensorZone": "",
            "value": "172.30.202.30"
        },
        "id": "a9288779-354c-5a61-b492-f617d302c5ed",
        "name": "Password Attack",
        "recordCount": 10,
        "recordTypes": [],
        "ruleId": "THRESHOLD-S00095",
        "severity": 4,
        "stage": "Initial Access",
        "suppressed": true,
        "tags": [
            "_mitreAttackTactic:TA0001",
            "_mitreAttackTactic:TA0006",
            "_mitreAttackTechnique:T1110",
            "_mitreAttackTechnique:T1078",
            "_mitreAttackTechnique:T1078.001",
            "_mitreAttackTechnique:T1078.002",
            "_mitreAttackTechnique:T1078.003",
            "_mitreAttackTechnique:T1078.004",
            "_mitreAttackTechnique:T1586",
            "_mitreAttackTechnique:T1586.001",
            "_mitreAttackTechnique:T1586.002",
            "_mitreAttackTactic:TA0008",
            "_mitreAttackTechnique:T1110.003",
            "_mitreAttackTechnique:T1110.002",
            "_mitreAttackTechnique:T1110.001"
        ],
        "timestamp": "2022-03-11T10:29:52"
    }
]

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If found at least one signal (is_success=true): "Successfully returned signals for the following entities in Sumo Logic Cloud SIEM: {entities}." If nothing was found for one entity (is_success=true): "No signals were found for the following entities in Sumo Logic Cloud SIEM: {entities}." If nothing is found for all entities (is_success=true): "No signals were found for the provided entities in Sumo Logic Cloud SIEM." If the 500 status code is reported for one entity (is_success=true): "Action wasn't able to retrieve signals for the following entities in Sumo Logic Cloud SIEM: {entities}." If the 500 status code is reported for all entities (is_success=false): "Action wasn't able to retrieve signals for the provided entities in Sumo Logic Cloud SIEM." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Search Entity Signals". Reason: {0}''.format(error.Stacktrace)	General

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If found at least one signal (is_success=true): "Successfully returned signals for the following entities in Sumo Logic Cloud SIEM: {entities}."

If nothing was found for one entity (is_success=true): "No signals were found for the following entities in Sumo Logic Cloud SIEM: {entities}."

If nothing is found for all entities (is_success=true): "No signals were found for the provided entities in Sumo Logic Cloud SIEM."

If the 500 status code is reported for one entity (is_success=true): "Action wasn't able to retrieve signals for the following entities in Sumo Logic Cloud SIEM: {entities}."

If the 500 status code is reported for all entities (is_success=false): "Action wasn't able to retrieve signals for the provided entities in Sumo Logic Cloud SIEM."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Search Entity Signals". Reason: {0}''.format(error.Stacktrace)

General

Update Insight

Description

Update insight status in Sumo Logic Cloud SIEM.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Insight ID	String	N/A	Yes	Specify the ID of the insight needs to be updated.
Status	DDL	Select One Possible Values: Select One New In Progress Closed	Yes	Specify the status to set for the insight.
Assignee Type	DDL	User Possible Values: User Team	Yes	Specify the assignee type for the "Assignee" parameter.
Assignee	String	N/A	No	Specify the assignee identifier.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
  "data": {
      "artifacts": [],
      "assignedTo": "tip.labops",
      "assignee": {
          "displayName": "tip.labops@siemplify.co",
          "username": "tip.labops"
      },
      "closed": "2022-03-23T11:04:33.731971",
      "closedBy": "tip.labops",
      "confidence": 0.1,
      "created": "2022-03-11T08:48:26.030204",
      "description": "Detects multiple failed login attempts from a single source with unique usernames over a 24 hour timeframe. This is designed to catch both slow and quick password spray type attacks. The threshold and time frame can be adjusted based on the customer's environment.",
      "entity": {
          "entityType": "_ip",
          "hostname": null,
          "id": "_ip-172.30.202.30",
          "macAddress": null,
          "name": "172.30.202.30",
          "sensorZone": "",
          "value": "172.30.202.30"
      },
      "id": "dbc30c20-6d99-4f6f-8580-157ce70368a5",
      "lastUpdated": "2022-03-23T11:04:33.740470",
      "lastUpdatedBy": null,
      "name": "Initial Access",
      "orgId": "siemplify",
      "readableId": "INSIGHT-13927",
      "recordSummaryFields": [],
      "resolution": "False Positive",
      "severity": "CRITICAL",
      "signals": [
          {
              "allRecords": [
                  {
                      "action": "failed password attempt",
                      "bro_dns_answers": [],
                      "bro_file_bytes": {},
                      "bro_file_connUids": [],
                      "bro_flow_service": [],
                      "bro_ftp_pendingCommands": [],
                      "bro_http_cookieVars": [],
                      "bro_http_origFuids": [],
                      "bro_http_origMimeTypes": [],
                      "bro_http_request_headers": {},
                      "bro_http_request_proxied": [],
                      "bro_http_response_headers": {},
                      "bro_http_response_respFuids": [],
                      "bro_http_response_respMimeTypes": [],
                      "bro_http_tags": [],
                      "bro_http_uriVars": [],
                      "bro_kerberos_clientCert": {},
                      "bro_kerberos_serverCert": {},
                      "bro_sip_headers": {},
                      "bro_sip_requestPath": [],
                      "bro_sip_responsePath": [],
                      "bro_ssl_certChainFuids": [],
                      "bro_ssl_clientCertChainFuids": [],
                      "cseSignal": {},
                      "day": 11,
                      "device_ip": "172.30.202.30",
                      "device_ip_ipv4IntValue": 2887698974,
                      "device_ip_isInternal": true,
                      "device_ip_version": 4,
                      "fieldTags": {},
                      "fields": {
                          "auth_method": "ssh2",
                          "endpoint_ip": "172.30.202.30",
                          "endpoint_username": "1ewk0XJn",
                          "event_message": "Failed password for invalid user",
                          "src_port": "59088"
                      },
                      "friendlyName": "record",
                      "hour": 8,
                      "http_requestHeaders": {},
                      "listMatches": [],
                      "matchedItems": [],
                      "metadata_deviceEventId": "citrix_xenserver_auth_message",
                      "metadata_mapperName": "Citrix Xenserver Auth Message",
                      "metadata_mapperUid": "bcc62402-2870-49ad-ba8d-64ddf22fd342",
                      "metadata_parseTime": 1646987453926,
                      "metadata_product": "Hypervisor",
                      "metadata_productGuid": "6751ee25-4ef9-4f9f-9c8b-c39668856994",
                      "metadata_receiptTime": 1646987443,
                      "metadata_relayHostname": "centos-002",
                      "metadata_schemaVersion": 3,
                      "metadata_sensorId": "0b52e838-2dbd-4fc0-a2b5-7135a5dc72b7",
                      "metadata_sensorInformation": {},
                      "metadata_sensorZone": "default",
                      "metadata_vendor": "Citrix",
                      "month": 3,
                      "normalizedAction": "logon",
                      "objectType": "Authentication",
                      "srcDevice_ip": "172.30.202.30",
                      "srcDevice_ip_ipv4IntValue": 2887698974,
                      "srcDevice_ip_isInternal": true,
                      "srcDevice_ip_version": 4,
                      "success": false,
                      "timestamp": 1646987443000,
                      "uid": "c2e6188b-202c-5736-9b4d-248ab6ba88dd",
                      "user_username": "1ewk0XJn",
                      "user_username_raw": "1ewk0XJn",
                      "year": 2022
                  }
              ],
              "artifacts": [],
              "contentType": "ANOMALY",
              "description": "Detects multiple failed login attempts from a single source with unique usernames over a 24 hour timeframe. This is designed to catch both slow and quick password spray type attacks. The threshold and time frame can be adjusted based on the customer's environment.",
              "id": "b4adb0dc-1340-56ec-87aa-c6f1fc0fa247",
              "name": "Password Attack",
              "recordCount": 10,
              "recordTypes": [],
              "ruleId": "THRESHOLD-S00095",
              "severity": 4,
              "stage": "Initial Access",
              "tags": [
                  "_mitreAttackTactic:TA0001"
              ],
              "timestamp": "2022-03-11T08:31:28"
          }
      ],
      "source": "USER",
      "status": {
          "displayName": "Closed",
          "name": "closed"
      },
      "subResolution": null,
      "tags": [
          "aaa3"
      ],
      "teamAssignedTo": null,
      "timeToDetection": 1271.030204,
      "timeToRemediation": 1044967.701767,
      "timeToResponse": 21.186055,
      "timestamp": "2022-03-11T08:31:28"
  },
  "errors": []
}

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If the 200 status code is reported (is_success=true): "Successfully updated insight with ID "{id}" in Sumo Logic Cloud SIEM." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Update Insight". Reason: {0}''.format(error.Stacktrace) If errors are reported: "Error executing action "Update Insight". Reason: {message}.' If "Select One" is selected for the "Status" parameter and no assignee is provided: "Error executing action "Update Insight". Reason: either status or assignee needs to be provided."	General

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If the 200 status code is reported (is_success=true): "Successfully updated insight with ID "{id}" in Sumo Logic Cloud SIEM."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Update Insight". Reason: {0}''.format(error.Stacktrace)

If errors are reported: "Error executing action "Update Insight". Reason: {message}.'

If "Select One" is selected for the "Status" parameter and no assignee is provided: "Error executing action "Update Insight". Reason: either status or assignee needs to be provided."

General

Add Comment To Insight

Description

Add a comment to an insight in Sumo Logic Cloud SIEM.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Insight ID	String	N/A	Yes	Specify the ID of the insight to which action needs to add a comment.
Comment	String	N/A	Yes	Specify the comment that needs to be added to the insight.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
    "data": {
        "author": {
            "username": "tip.labops"
        },
        "body": "In Progress",
        "id": "1",
        "timestamp": "2022-03-16T12:03:56.472109"
    },
    "errors": []
}

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If the 200 status code is reported (is_success=true): "Successfully added a comment to an insight with ID "{id}" in Sumo Logic Cloud SIEM." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Add Comment To Insight". Reason: {0}''.format(error.Stacktrace) If errors are reported: "Error executing action "Add Comment To Insight". Reason: {message}.	General

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If the 200 status code is reported (is_success=true): "Successfully added a comment to an insight with ID "{id}" in Sumo Logic Cloud SIEM."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Add Comment To Insight". Reason: {0}''.format(error.Stacktrace)

If errors are reported: "Error executing action "Add Comment To Insight". Reason: {message}.

General

Add Tags To Insight

Description

Add tags to an insight in Sumo Logic Cloud SIEM.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Insight ID	String	N/A	Yes	Specify the ID of the insight to which action needs to add tags.
Tags	CSV	N/A	Yes	Specify a comma-separated list of tags that needs to be added to the insight.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
    "data": {
        "author": {
            "username": "tip.labops"
        },
        "body": "In Progress",
        "id": "1",
        "timestamp": "2022-03-16T12:03:56.472109"
    },
    "errors": []
}

Entity Enrichment

N/A

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If the 200 status code is reported (is_success=true): "Successfully added tags to an insight with ID "{id}" in Sumo Logic Cloud SIEM." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Add Tags To Insight". Reason: {0}''.format(error.Stacktrace) If errors are reported: "Error executing action "Add Tags To Insight". Reason: {message}.	General

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If the 200 status code is reported (is_success=true): "Successfully added tags to an insight with ID "{id}" in Sumo Logic Cloud SIEM."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Add Tags To Insight". Reason: {0}''.format(error.Stacktrace)

If errors are reported: "Error executing action "Add Tags To Insight". Reason: {message}.

General

Enrich Entities

Description

Enrich entities using information from Sumo Logic Cloud SIEM. Supported entities: Hostname, User, IP Address.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Create Insight	Checkbox	Checked	No	If enabled, the action creates an insight containing all of the retrieved information about the entity.

Run On

This action runs on the following entities:

Hostname
User
IP Address

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success=False

JSON Result

{
    "activityScore": 8,
    "criticality": null,
    "entityType": "_ip",
    "firstSeen": null,
    "hostname": null,
    "id": "_ip-172.30.202.30",
    "inventory": [],
    "isSuppressed": false,
    "isWhitelisted": false,
    "lastSeen": "2022-03-11T09:44:53",
    "macAddress": null,
    "name": "172.30.202.30",
    "sensorZone": null,
    "tags": [],
    "value": "172.30.202.30"
}

Entity Enrichment - Prefix SumoLogicCloudSIEM_

Enrichment Field Name	Source (JSON Key)	Logic - When to apply
isSuppressed	isSuppressed	When available in JSON
isWhitelisted	isWhitelisted	When available in JSON
tags	CSV of tags	When available in JSON
firstSeen	firstSeen	When available in JSON
lastSeen	lastSeen	When available in JSON
criticality	criticality	When available in JSON
activityScore	activityScore	When available in JSON

Insights

N/A

Case Wall

Result type	Value/Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from Harmony Mobile: {entity.identifier}". If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from Sumo Logic Cloud SIEM: {entity.identifier}" If data is not available for all entities (is_success=false): "None of the provided entities were enriched." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace)	General
Case Wall Table	Table Title: {entity.identifier} Table Columns: Key Value	Entity

Result type

Value/Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from Harmony Mobile: {entity.identifier}".

If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from Sumo Logic Cloud SIEM: {entity.identifier}"

If data is not available for all entities (is_success=false): "None of the provided entities were enriched."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace)

General

Case Wall Table

Table Title: {entity.identifier}

Table Columns:

Key
Value

Entity

Connectors

Sumo Logic Cloud SIEM - Insights Connector

Description

Pull information about insights from Sumo Logic Cloud SIEM.

Configure Sumo Logic Cloud SIEM - Insights Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	N/A	Yes	Enter the source field name in order to retrieve the Product Field name.
Event Field Name	String	generalized_data_name	Yes	Enter the source field name in order to retrieve the Event Field name.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regex pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field via regex logic. If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
API Root	String	https://{instance}	Yes	API root of the Sumo Logic Cloud SIEM instance.
API Key	String	N/A	No	API Key of the Sumo Logic Cloud SIEM account. Note: API key has priority over other authentication method.
Access ID	String	N/A	No	Access ID of the Sumo Logic Cloud SIEM account. Note: Both Access ID and Access Key are required for this type of authentication.
Access Key	Secret	N/A	No	Access Key of the Sumo Logic Cloud SIEM account. Note: Both Access ID and Access Key are required for this type of authentication.
Lowest Severity To Fetch	String	N/A	No	The lowest priority that needs to be used to fetch cases. Possible values: Low, Medium, High, Critical. If nothing is specified, the connector will ingest insights with all severities.
Max Hours Backwards	Integer	1	No	Number of hours from where to fetch insights.
Max Insights To Fetch	Integer	20	No	Number of insights to process per one connector iteration.
Use dynamic list as a blacklist	Checkbox	Unchecked	Yes	If enabled, dynamic list is used as a blacklist.
Verify SSL	Checkbox	Unchecked	Yes	If enabled, verify that the SSL certificate for the connection to the Sumo Logic Cloud SIEM server is valid.
Proxy Server Address	String	N/A	No	The address of the proxy server to use.
Proxy Username	String	N/A	No	The proxy username to authenticate with.
Proxy Password	Password	N/A	No	The proxy password to authenticate with.

Connector rules

Proxy support

The connector supports proxy.