This page explains how to configure SIEM integration when using Sumo Logic.

Note: Due to Sumo Logic's specifications, it is not possible to configure the sync start time. By default, syncing starts from the time the Collector was created.
Also, you cannot configure the sync interval or the number of log entries retrieved per sync; syncing occurs at the shortest possible interval.
For more details, please contact the provider.

Please note that some of the screens displayed after login differ between the new UI and the old UI. Please check the instructions for your environment.

New UI Instructions

1. Log in as an administrator.
   
   
   
   
2. After logging in, click the gear icon in the upper right corner of the screen, then click "Collection" under "Data Collection" in "Configuration".
   
   
   
   
   
   
3. Click the "Add Collector" link.
   
   
   For the following steps, please refer to the Common Steps.

Old UI Instructions

1. Log in as an administrator.
   
   
   
   
2. From the menu on the left side of the screen, click "Manage Data", then click "Collection".
   
   > >
   
   
3. Click the "Add Collector" link.
   
   
   
   
   For the following steps, please refer to the Common Steps.
   
   

Common Steps

1. Click "Hosted Collector".
   
   
   
2. Enter any name, select "(GMT+9:00) Asia/Tokyo" for TimeZone, then click "Save" followed by "OK".
   
   
   
   
   
3. In the Data Source list, enter "TrustLogin", then click the service button to create a Collector for TrustLogin.
   
   
4. After configuring each field, click "Save" to complete the setup. Syncing will begin at the configured interval.
   
   
   Name: any name
   Bearer Token: Authentication token. Obtain this from the TrustLogin Admin Page.
   For instructions on how to obtain it, click here
   Interval: time interval (in minutes)
   
   
5. Click the icon to view the logs.