---
title: "SIEM Integration with Sumo Logic"
url: "https://docs.indusface.com/en/article/siem-integration-with-sumo-logic"
language: "en"
last_updated: "2025-03-10T06:27:19.544Z"
---

# SIEM Integration with Sumo Logic

### Introduction

SIEM refers to the process of integrating Security Information and Event management system with WAS. Integrating SIEM with WAS gives all the details. 

### How to configure SIEM details in WAS using Sumo Logic SIEM account as an example? 

#### Step 1: Enable SIEM 

-   Navigate to **Settings** menu. 
-   Click on the **Scan Logs Config** tab.

![](https://files.helpdocs.io/1fZENFEEfs/articles/ydo46jy70a/1723009862082/image.png)

-   Click on the toggle button **Enable SIEM S3 Logs** to enable. 

![](https://cdn-assets.productfruits.com/3c34fc4a-0eff-4c76-8d6b-b36b0486dcbb)

-   Enter the **Account ID** and **External ID** in the respective fields and then click on the **Submit** button.

![](https://cdn-assets.productfruits.com/70b65783-6334-4ae5-bc1a-e3ffa020f216)

> The account ID and External ID are present in the users’ SIEM solutions., likewise RSA, Splunk, McAfee, Sumo Logic, and so on.  

#### Step 2: Log on to Sumo Logic 

-   Sign-in to Sumo Logic. 
-   From Home page, Install Collector > Go to **Collection** Page. 
-   Go to **Collection** > **Add Source**.

![](https://cdn-assets.productfruits.com/fd7742f8-d3aa-468f-a04c-949c8a41b990)

-   Search a resource or select the respective resource for logs. 
-   For use case, we have selected Amazon S3. 
-   From **Amazon S3** > **AWS Access** > **Access Method**. 
-   By default, Role-based access is recommended and selected. 
-   The account Id and External ID are displayed under Role-based access.

![](https://cdn-assets.productfruits.com/f74f917d-b1c3-423a-9930-9e61d9a2d8b4)

#### Step 3: Configuration Details 

-   Enter the Sumo Logic **Role-based access Account ID** and **External ID** in SIEM **AWS Account ID** and **SIEM External ID** fields.  
-   Once user enters the valid details, a success pop-up is displayed.

![](https://cdn-assets.productfruits.com/e6254548-8513-4311-9ab0-3c4b7147e005)

-   SIEM Integration configuration details are also displayed.

![](https://cdn-assets.productfruits.com/4e07f401-14f6-43e5-a814-e76a072c1367)

#### Step 4: Integrate with Sumo Logic 

-   Enter a valid name and Description in the respective fields. 
-   Select S3 Region 
-   Enter the Bucket name and path expression details (obtained from the configuration details) in their respective fields. In the path expression field, add an asterisk symbol (\*) after path. 
-    Ex: cust-2/\* 

![](https://cdn-assets.productfruits.com/b21c24a4-f763-4b91-812c-cb0c9e5f152e)

-    In AWS Access> Role ARN, enter the role ARN copied from the configuration details.

![](https://cdn-assets.productfruits.com/7021a33b-0df5-420f-a7fd-6469871d7fc8)

-   In Log File Discovery, select the specific scan interval.

![](https://cdn-assets.productfruits.com/a0651d01-581d-4bc0-8219-0bd63fa3ea37)

-   After entering all the mentioned fields, go to the end of the page and click **Save**. 

#### Step 5: View Scan Logs 

-   In Collection page, hover on your collectors’ name and a blue icon will be displayed, click on the icon.

![](https://cdn-assets.productfruits.com/b50b5d6b-8912-4283-bfa9-ee70f98b863f)

-   Source collector is opened, select a time span, and click on the search icon to fetch the log record. 

![](https://cdn-assets.productfruits.com/357f673c-e638-4779-a863-2926fde9e6ac)

-   Scan logs details for the selected collector are displayed.

![](https://cdn-assets.productfruits.com/2ab19752-a866-4733-91b6-ace4315622ed)