Sumologic SOAR Integration

Overview

This document outlines the tools available in the Sumologic SOAR integration. These tools allow interaction with Sumologic for searching logs and testing connectivity.

Tools

sumologic_search

Run a query and get search resutls from Sumologic

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• query (str, required): Sumologic query to run. e.g: _collector=*
• delete_search_job (Optional[bool], optional, default=None): If checked, delete the jobs after a search is completed.
• since (Optional[str], optional, default=None): Start date of the search, ISO-8601 or unixtime (milliseconds). e.g. 1970-01-01T00:00:00. Default: Last 30 days.
• to (Optional[str], optional, default=None): End date of the search, ISO-8601 or unixtime (milliseconds). e.g. 1970-01-01T00:00:00. Default: now (current utc unixtime).
• limit (Optional[str], optional, default=None): Number of results to return. e.g. 10. Default: 25.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default='All entities'): Defines the scope for the action.

sumologic_ping

Test Connectivity to Sumologic

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default='All entities'): Defines the scope for the action.