Introduction
-
About
This guide provides instructions on how to:
- Integrate BI events data with Sumologic
-
Prerequisites
Ensure that you have the following:
- You have a tenant configured for your organization and able to enroll users.
-
Sumologic configuration
- Create a Hosted Collector
- Add HTTP Log data source to hosted collector
- Copy the HTTP source address . Provide this to BI SME.
-
Create a Hosted Collector
Access your Sumologic tenant URL and login as a user with administrative privileges. In the dashboard, click “Collections” under “Manage Data”
On the right-hand side top menu, click “Add Collector”. In the “Select Collector Type” screen, click on “Hosted Collector”
Type in a name for the Hosted collector, for example “Tenant events from Beyond Identity” and add a relevant description. Leave other fields to the default values. Click “Save”
-
Add HTTP Datasource
After clicking “Save”, you will see the below “Confirm” pop-up to confirm adding a data source. Click “OK”
Type “HTTP” in the search box as shown below. Click on “HTTP Logs & Metrics” in the search results.
Type in “HTTP Log source for Beyond Identity Tenant” in the name field. Type in a relevant description in the description field. Leave other values to the defaults. Click “Save”
You will see a pop-up screen showing “HTTP Source Address”. Click “Copy” to copy the address and provide it to BI SME. Click “OK”
-
Beyond Identity Configuration
The configuration is done using the BI admin console. Access BI admin console through your SSO integration. Click on “Integrations” and click on “SIEM”
Click on the “+” sign next to Sumo. Using HTTP source address copied in section 3.2 fill out the value for Url. Provide a name for the configuration. From the events drop down, “select all” events or one the events you are interested in.
- Once SIEM configuration is complete in BI admin console, you will be able to see the events in your Sumologic. You can verify with a search in Sumologic, for example
- ((_collector="Tenant events from Beyond Identity ")) AND _source = " HTTP Log source for Beyond Identity Tenant " | sort by event_type
- Replace the collector name and HTTP source name with the ones you created
-
Appendix
How to get event types?
Click on https://developer.beyondidentity.com/api/v0#tag/Events/operation/getEvents
Scroll down
Click on arrow next to 200
Click on body
Click on events
Scroll down
event_type lists all the events
Comments
0 comments
Please sign in to leave a comment.