})
4. Click **HTTP Logs & Metrics.** })
5. The source configuration page appears. })
6. **Name**. Enter a name for the source.
7. **Description**. (Optional)
8. **Source Host**. (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called `_sourceHost`.
9. **Source Category**. Enter a string to tag the output collected from the source, for example, _cse/custom/inventory_. The string that you supply will be saved in a metadata field called `_sourceCategory`.
10. **SIEM Processing**. Click the check box to configure the source to forward log messages to Cloud SIEM.
11. **Fields**. Click **+Add Field**, and add a field whose name is `_siemdatatype` with value _inventory_.
12. Click **Save**
13. Copy the URL that appears. You will need this to create the Webook in the next step.
## Step 2: Create a Webhook connection
In this step, you create a webhook that points to the HTTP source.
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Monitoring > Connections**. You can also click the **Go To...** menu at the top of the screen and select **Connections**. })
2. Click the plus sign (+) icon.
3. On the **Select Connection Type** page, click **Webhook.**
4. Give it a name and input the URL from the HTTP Endpoint as your URL.
5. On the **Create New Webhook** page:
1. **Name**. Enter a name for the Webhook.
2. **URL**. Enter the URL of the HTTP Source you created above.
3. **Payload**. Enter a JSON object })
## Step 3: Create search query
In this step, you create a log query that extracts inventory-related fields from your inventory source. Refer to [Cloud SIEM inventory schema](#cloud-siem-inventory-schema) for the inventory attributes that are supported for host and user objects.
## Step 4: Create a Scheduled Search
In this step, you schedule the search you created above to send results to the Webhook you created.
1. In your log search tab, click **Save As**.
2. On the Save Item popup:
1. **Name**. Enter a name for your search,
2. **Time range**. Select a time range.
3. **Click Schedule This Search**. })
4. The popup refreshes.
5. **Run Frequency**.
6. **Time range for scheduled search**.
7. **Timezone for scheduled search**.
8. **Alert Type**. Select Webhook, and pick the one you created that goes to the HTTP Endpoint. Check **Send a separate alert for each search result**.
9. **Location to save to**. Choose a folder location for the search. })
## Cloud SIEM inventory schema
This section defines the attributes in the Cloud SIEM inventory schema for hosts and users. Note that the same attributes can be used for either host or user inventory data.
### Host inventory attributes
The table below lists attributes most typically used in host inventory records. The ones you choose depend on the fields available from your inventory data source. For a host, you might consider using `computername`, `deviceUniqueId`, and `hostname`, at a minimum.
| Inventory attribute | Notes |
computername |
|
deviceUniqueId |
A unique ID that distinguishes an inventory item from other inventory items from the same source. |
groups |
The directory service (for example, Azure AD) group that the inventory item belongs to. |
hostname |
|
ip |
|
location |
|
mac |
|
natIp |
|
normalizedComputerName |
|
normalizedHostname |
|
os |
|
osVersion |
|
uniqueID |
A unique ID that distinguishes an inventory item from all other inventory items from all inventory sources. |
| Inventory attribute | Notes |
department |
|
emails |
|
givenName |
|
groups |
The directory service (for example, Azure AD) group that the inventory item belongs to. |
lastName |
|
middleName |
|
uniqueID |
A unique ID that distinguishes an inventory item from all other inventory items from all inventory sources. |
userId |
|
username |