Detection & Response Enablement
Aperçu
Sumo Logic SIEM is a cloud-native security information and event management system for modern enterprises. It manages security data by automating data ingestion, analysis, and visualization processes.
Sumo Logic SIEM is a cloud-native security information and event management system for modern enterprises. It manages security data by automating data ingestion, analysis, and visualization processes.
This OpenCTI connector allows the ability to create, update and delete STIX indicator data from your OpenCTI platform to Sumo Logic. The connector uses the following Sumo Logic APIs:
- Uploads indicators in a STIX 2.x json format API to create/update STIX indicators: https://api.sumologic.com/docs/#operation/uploadStixIndicators
- Removes indicators by their IDs API to remove expired STIX indicators: https://api.sumologic.com/docs/#operation/removeIndicators.