> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Sumo Logic
> Send Plerion findings and tenant audit logs to a Sumo Logic HTTP Source for search, dashboards and correlation in your SIEM
With the **[Sumo Logic integration](https://app.plerion.com/settings/integrations/add/SumoLogic/SumoLogic)**, you can send the findings a workflow selects, and your tenant's audit logs, to a Sumo Logic HTTP Source. Findings arrive once a night as they open, change and resolve, with every open finding resent once a week. Audit logs arrive as they happen.
**Note:** This is a one-way outbound integration. Plerion posts to Sumo Logic, and nothing in Sumo Logic changes Plerion.
***
## How it works
The integration holds the connection to one Sumo Logic HTTP Source. A [workflow](/guides/platform/workflows) decides what goes through it:
* **Findings:** add a Sumo Logic action to a workflow, and the findings that match its finding conditions are sent each night.
* **Tenant audit logs:** tick **Send tenant audit logs** on that action, and the tenant's audit logs are sent as they happen.
A workflow that sends to Sumo Logic works differently from one that raises alerts:
* It uses finding conditions only. Asset and vulnerability conditions are turned off while a Sumo Logic action is on the workflow.
* A workflow whose only action is Sumo Logic does not create alerts. The findings go to Sumo Logic directly.
***
## Steps to create a Sumo Logic HTTP Source
* Go to `Manage Data` > `Collection`. In newer Sumo Logic accounts, this is `Data Management` > `Collection`.
* Choose a Hosted Collector, or create one.
* Select `Add Source` next to the collector.
* Choose **HTTP Logs & Metrics**.
* Enter a **Name**, for example `plerion`.
* Optionally, set a **Source Category**, for example `security/plerion`.
* Select `Save`.
Copy the URL Sumo Logic shows for the new source. It looks like `https://endpoint4.collection.us2.sumologic.com/receiver/v1/http/...`.
The URL contains the source's token. Anyone who has it can post to your source, so treat it like a password.
***
## Steps to integrate Sumo Logic with Plerion
* **Name:** a name for this destination, for example `Security operations`.
* **HTTP Source URL:** the URL you copied from Sumo Logic. Plerion stores it encrypted and never shows it again.
* **Source category (optional):** sent as the source category on every record, so you can search for `_sourceCategory=`. Leave it empty to use the category set on the source.
Click `Test`. Plerion posts one test event to the source. In Sumo Logic, search for `_sourceName="Plerion test"` or open Live Tail to see it.
If Sumo Logic refuses the event, Plerion shows its answer, for example `401 Unauthorized` when the source was deleted or the URL is incomplete.
Click `Add`. The integration page opens, with `Send test message` and `Sync now`.
To change the source URL later, edit the integration and paste the new URL. Leave the field empty to keep the stored one.
***
## Steps to send findings and audit logs
Give the workflow a name, for example `Send findings to Sumo Logic`.
Add one or more finding conditions, for example **Severity** is **Critical** or **High**. Each condition selects findings on its own, and a finding that matches any of them is sent.
* Under **Actions**, add an action and choose your Sumo Logic integration.
* Tick **Send tenant audit logs** to also send the tenant's audit logs to the same source.
* Select `Save`.
The first sync sends every finding the workflow selects that night. To start it straight away, open the integration under `Settings` > `Integrations` > `Sumo Logic` and click `Sync now`.
***
## What Plerion sends
Every record is one JSON object. Plerion sets the source name on each request, so you can tell the streams apart:
| Source name | Contents | When |
| - | - | - |
| `plerion-findings` | Findings from workflows that send to this integration | Once a night, plus `Sync now` |
| `plerion-audit-logs` | Tenant audit logs | As they happen |
| `Plerion test` | One test event | When you click `Test` or `Send test message` |
### Finding records
Each finding record has an `event` field that says why it was sent:
| `event` | Meaning |
| - | - |
| `opened` | The finding started failing since the last sync and matches the workflow. |
| `changed` | A finding that matches the workflow changed, for example its severity, message, exemption, SLA, fact-check verdict or resource name. |
| `resolved` | The finding passed. The record carries the finding's details as they are now. |
| `left` | The finding no longer matches the workflow, for example because it left the SLA band a condition asks for. The record carries only `id`, `tenantId` and `reason`. |
| `snapshot` | Part of the weekly resend of every open finding the workflow selects. |
| `snapshot_complete` | The snapshot with this `syncId` finished. `findings` is how many it sent. |
Finding records carry, among others, `id`, `detectionId`, `message`, `status`, `severityLevel`, `provider`, `providerAccountId`, `region`, `resourceType`, `resourceId`, `resourceName`, `resourceTags`, `isExempted`, `exemptionReason`, `slaDueAt`, `factCheck`, `firstObservedAt`, `lastObservedAt`, `lastChangedAt` and `plerionUrl`, a link that opens the finding in Plerion. Every record also has `syncId`, `workflowId` and `sentAt`.
A finding is sent only when something that matters about it changes. A scan that sees the same finding again does not resend it.
### Keeping an up-to-date list of open findings
To track which findings are open:
* Take the latest record for each finding `id`. `opened`, `changed` and `snapshot` mean it is open, and `resolved` or `left` mean it is not.
* Once a week, compare against the newest snapshot that has a `snapshot_complete` record. Drop any finding that is missing from that snapshot. It has left the workflow's selection, for example because it was deleted or exempted.
The weekly snapshot also keeps findings that never change inside your Sumo Logic retention period.
A query for the findings opened or changed in the last day:
```
_sourceName="plerion-findings"
| json "event", "id", "severityLevel", "message", "plerionUrl"
| where event in ("opened", "changed")
```
### Audit log records
Audit log records have `event` set to `audit`, and carry `id`, `operation`, `operationTime`, `operatorEmail`, `operatorUserId`, `ip`, `userAgent`, `location`, `tenantId` and `organizationId`. They use the same fields as the [list audit logs API](/api-reference/audit-logs/list).
Sign-ins and organization-level events are not sent. If more than one workflow ticks **Send tenant audit logs** for the same integration, each audit log is still sent once.
***
## Sync now
`Sync now` on the integration page sends what changed since the last sync for every enabled workflow that uses the integration, without waiting for the night.
* A workflow that has never synced sends every finding it selects.
* The weekly snapshot stays with the nightly sync.
* After a sync starts, `Sync now` is available again after 15 minutes. Plerion shows the time you can try again.
* If no enabled workflow sends findings to the integration, Plerion says so and nothing is sent.
***
## Stopping the integration
* Remove the Sumo Logic action from a workflow, or disable the workflow, to stop sending its findings. A sync already running stops at its next step.
* Untick **Send tenant audit logs** on every workflow that uses the integration to stop sending audit logs.
* Delete the integration to stop everything that goes through it.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.