This guide provides instructions on how to integrate BI events data with Sumologic.
Prerequisites
Ensure that you have the following:
You have a tenant configured for your organization and able to enroll users.
Sumologic configuration
Create a Hosted Collector
Add HTTP Log data source to hosted collector
Copy the HTTP source address . Provide this to BI SME.
Create a Hosted Collector
Access your Sumologic tenant URL and login as a user with administrative privileges. In the dashboard, click Collections under Manage Data
On the right-hand side top menu, click Add Collector. In the Select Collector Type screen, click on Hosted Collector
Type in a name for the Hosted collector, for example “Tenant events from Beyond Identity” and add a relevant description. Leave other fields to the default values. Click “Save”
Add HTTP Datasource
After clicking Save, you will see the below “Confirm” pop-up to confirm adding a data source. Click “OK”
Type “HTTP” in the search box as shown below. Click on “HTTP Logs & Metrics” in the search results.
Type in “HTTP Log source for Beyond Identity Tenant” in the name field. Type in a relevant description in the description field. Leave other values to the defaults. Click “Save”
You will see a pop-up screen showing “HTTP Source Address”. Click “Copy” to copy the address and provide it to BI SME. Click “OK”
Beyond Identity Configuration
The configuration is done using the BI admin console. Access BI admin console through your SSO integration. Click on Integrations and click on SIEM
Click on the + sign next to Sumo. Using HTTP source address copied in section 3.2 fill out the value for Url. Provide a name for the configuration. From the events drop down, select all events or one of the events you are interested in.
Once SIEM configuration is complete in BI admin console, you will be able to see the events in your Sumologic. You can verify with a search in Sumologic, for example
((_collector="Tenant events from Beyond Identity")) AND _source = " HTTP Log source for Beyond Identity Tenant " | sort by event_type
Replace the collector name and HTTP source name with the ones you created
Appendix
How to get event types?
Click on https://developer.beyondidentity.com/api/v0#tag/Events/operation/getEvents
Scroll down
Click on arrow next to 200
Click on body
Click on events
Scroll down
event_type lists all the events