Meet the new Cloud SIEM
Cloud SIEM is Sumo Logic's cloud-based security information and event management (SIEM) system, which collects, correlates, and prioritizes security data into actionable insights. It provides the following functionality:
- Collection of log and event data from your infrastructure and applications, on-premise and in-cloud.
- Correlation of the collected data to reduce the volume of info you need to sift through to investigate issues.
- A rich interface that analysts and admins can use to investigate security issues and administer Cloud SIEM itself.
- Integration with the Sumo Logic core platform.
Sumo Logic Academy offers free training courses covering these concepts that allow you to practice in a lab environment and level up your knowledge. Check out self-paced and free live instructor-led offerings today! (To access our self-paced courses, first sign in to our learning portal.)
- Self-paced:
- Instructor-led virtual classes:
This section contains the following topics:
Get Started with Cloud SIEM
Learn how to start using Cloud SIEM for threat hunting.
Records, Signals, Entities, and Insights
Learn about Insight generation, working with Entities, and how to query Cloud SIEM Records.
Ingestion
Learn how to configure ingestion for supported products and services.
Rules
Learn how to write rules, rules syntax, and Cloud SIEM built-in rules.
Schema
Learn about Cloud SIEM Schema v3, schema attributes, and the Record processing pipeline.
Sensors
Cloud SIEM Sensors collect log and event data from your infrastructure and applications.
Integrations
Cloud SIEM integration with Sumo Logic and threat intel sources, and leveraging the Cloud SIEM Insight Enrichment Server.
Match Lists and Suppressed Lists
Learn about creating a Match list and their usage in rules.
Automation
Learn how to configure automations to create notifications and enrichments in Cloud SIEM.
Administration
Learn how to set up user accounts and roles, Actions, Network Blocks, custom Insight status and sub-resolutions, and more.
Troubleshoot
Learn how to troubleshoot problems with Cloud SIEM.
FAQ
What is Cloud SIEM?
Cloud SIEM is a cloud-based security information and event management system that collects and correlates log and event data from your infrastructure and applications into prioritized security insights.
What data can I send to Cloud SIEM?
You can forward log and event data already ingested into Sumo Logic, from on-premises or cloud sources, to Cloud SIEM for parsing, mapping, and enrichment into records.
How is Cloud SIEM different from Cloud SOAR?
Cloud SIEM focuses on the investigation phase of security operations, while Cloud SOAR focuses on automated response. You can use them together or independently.
What are records, signals, entities, and insights in Cloud SIEM?
Records are parsed and enriched log messages. Signals are created when a record matches a rule. Entities are the unique identifiers, like IP addresses or usernames, extracted from signals. Insights are groups of related signals for the same entity that cross a severity threshold.
Can I write custom rules in Cloud SIEM?
Yes. In addition to hundreds of built-in rules, you can write custom match, threshold, chain, aggregation, first seen, and outlier rules to cover threats or data sources specific to your environment.