> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/sumo-logic.md).

# Sumo Logic

You can send these DoControl entities to your organization's consolidated event management system for further investigation, data aggregation, and monitoring:

* **Alerts** - Investigate alerts in Sumo Logic and remediate in the DoControl platform when necessary.
* **Workflows** - A JSON structured log is sent to Sumo Logic, containing a synthetic high-level summary of each workflow execution. The log includes the workflow name, actor, event type, app, execution duration, and execution path.
* **SaaS events** -  Select the relevant app and event types to send to Sumo Logic.

{% hint style="info" %}

* Sending events and workflows to your SIEM increases the volume of generated logs and might impact your SIEM cost.
* DoControl sends logs for event-triggered workflows only, not for on-demand, scheduled, or alert-triggered workflows.
* For reference, see headers that are supported in [Sumo Logic](https://help.sumologic.com/docs/send-data/hosted-collectors/http-source/logs-metrics/upload-logs/#supported-http-headers).
  {% endhint %}

To push DoControl data downstream to the Sumo Logic alert and event pipeline and display them in the collection board, you need to:

1. [Generate the HTTP event collector in Sumo Logic](#generate-http-event-collector-in-sumo-logic)
2. [Connect to Sumo Logic SIEM in DoControl](#connect-to-sumo-logic-siem-in-docontrol)

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F9L9wkw1fMjKudmHJjl5o%2FSIEM%20SOAR%20connectors.png?alt=media&amp;token=2ca8c612-9702-4f73-ad4b-4626d3bc45d1" alt=""><figcaption><p>Defining a SIEM connector for sending DoControl alerts or events to Sumo Logic</p></figcaption></figure>

## Generate HTTP event collector in Sumo Logic

1. Login to your Sumo Logic account.
2. In the left menu, click **Manage data > Collection**.
3. On the Collection page, click **Setup Wizard**.&#x20;
4. Choose the **Integrate with Sumo Logic** option.
5. In the Select Data Type page, click on **Your Custom App**, and then **HTTPS Source**.
6. For the **Source Category** give a proper name, such as DoControl-alerts and click **Next**.
7. Copy the **HTTP Source** to keep for the next procedure.

## Connect to Sumo Logic SIEM in DoControl

Make sure you generated the [HTTP event collector ](#generate-http-event-collector-in-sumologic)in Sumo Logic before you perform the one-time SIEM connection in DoControl.

1. In DoControl, click **Settings** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FWkfN1O2BKZBlrnVXQ5Wu%2Fsettings%20icon.png?alt=media&amp;token=9336f06e-7a3c-4651-97c7-a1ccd2cbface" alt="" data-size="line"> from the top-right corner in any screen.
2. Navigate to **Connectors > SIEM and SOAR connectors > Sumo Logic**.
3. Paste the **HTTP Source** that you copied in the [previous step](#generate-http-event-collector-in-sumo-logic) into the **URL or HTTP event connector** field.
4. Optional: Enter custom header keys and values.\
   HTTP headers can provide attribution information on the data being sent to the SIEM.
5. Click **Add** to enter additional header keys and values.
6. Select the DoControl data types to send to Sumo Logic:

   * Alerts
   * SaaS events
   * Workflows

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FpSmuswI7ovK5gwfopFAl%2Fdata%20types%20Sumo%20Logic.png?alt=media&amp;token=c4764aed-e9c3-4e2b-b199-1ba1d33d7204" alt=""><figcaption></figcaption></figure></div>
7. For **SaaS events**, select the relevant **app** and **event types**.
8. For **workflows**, select the relevant workflows and execution status.\
   You can select between 1 and 100 event-triggered workflows.&#x20;

   1. To send all your workflows to Sumo Logic, click **Select all**.&#x20;
   2. Select the relevant execution status: Completed, Warning, Failed, Cancelled or Timed out.<br>

   <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FDVWf4jcrcT2MmxpJ4po1%2Fworkflows%20to%20SIEM.png?alt=media&amp;token=a00816dd-3e25-412b-99c5-c3d304c140a6" alt="" width="563"><figcaption></figcaption></figure></div>
9. Click **Add app** to send events from another integrated app.
10. Click **Test & Save**.
11. If you wish to edit the connector, make any changes and click **Test & Save**.

{% hint style="success" %}
Once you're connected to Sumo Logic, you'll receive a success message as confirmation:\
\
**Success!**

Your Sumo Logic connector is all set up. DoControl data logs are now being pushed downstream to Sumo Logic.
{% endhint %}

## Delete a connector

If you wish to delete the connector, you can no longer view DoControl alerts, workflows or events in Sumo Logic.

1. From the top-right corner in DoControl, navigate to **Settings > Connectors > SIEM and SOAR connectors > Sumo Logic**.
2. Click **Disable** in the top-right.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/sumo-logic.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.