Integrate Security ADR with Sumo Logic
The Contrast Security ADR integration with Sumo Logic® enables ADR to send incident details to your Security Information and Event Management (SIEM), Security Orchestration, Automation and Response (SOAR), and Extended Detection and Response (XDR) environments, which contextualizes incidents with other threat detection and response solutions.
How it works
When configured, Security ADR sends detected attack events from the Contrast Security platform to your Sumo Logic instance over HTTPs.
The Security ADR for Sumo Logic application enables Sumo Logic to:
Parse and normalize the data received over HTTPs
Display Contrast Security ADR attack events in Sumo Logic, for consumption in the provided Contrast Security ADR Dashboard in Sumo Logic, or search and correlation in Sumo Logic Cloud SIEM
Before you begin
Before you start, you must have:
Sumo Logic
Applications instrumented with a Contrast Security agent
Set up Sumo Logic
Set up Sumo Logic for Contrast Security ADR.
Find the official Contrast Security ADR parser template by following the instructions
on the relevant documentation page.Go to the Sumo Logic Parsers configuration page.
Search for Contrast.
Copy the parser template path by following steps 1-3
on the relevant documentation page.Use the three-dot icon on the line for the Contrast ADR parser and select Copy Path.
Continue with step 4 in the instructions if you have already set up an HTTP Logs and Metrics Collector you prefer to use; otherwise, continue with step 3 below. Continue with step 4 in the instructions if you have already set up an HTTP Logs and Metrics Collector you prefer to use; otherwise, continue with the following step.
Set up an HTTP Logs and Metrics Source in a Hosted Collector by following the instructions on
the relevant documentation page.Select the Forward to SIEM option.
Select +Add Field.
When the two blank fields appear, under any fields that have already been defined for the source, enter
_parseras the field name and the path to your parser as the value (as in this step).