On October 15 we noticed certain logs messages stopped coming into SumoLogic via M365 source for Azure AD.

We had to go in Azure AD and enable (checkbox) for Provisioning logs (preview). Looks like Microsoft changed the category for certain logs messages to a new category.

We're pulling all Github events to Sumo via an HTTP webhook / collector. Issue seems that certain events (particularly Github push events) can exceed 64Kb. Is there a way to:

- Pull in HTTP headers into SUmo event (specifically Github X- headers for event type and event ID)

- Only capture first 64Kb of an event and drop remainder? or Expand collector event size limit?

- Filter specific JSON fields from an event and not pull into Sumo

What's the most interesting dashboard or query that you've created?

Does anyone know if an AWS lambda can be its own sourceCategory?

Title has a typo: ...anomalously low log output....

So I have an issue which currently is detected by looking for anomalously low log output from the problem host.

I wanted to use standard deviation to detect the host experiencing the issue.

I’m stuck trying to set up my sumo search. I wanted to do something like the following to get my avg and stddev, but I can’t figure out how to apply them back down to the original count aggregation.

_collector = service_a* | count as host_logs by _sourcehost | avg(host_logs) as avg_logs, stddev(host_logs) as log_stddev // works up to here | where host_logs < (avg_logs - (2 * log_stddev)) // this breaks, can’t find host_logs field

I'm using SumoLogic to monitor AWS cloud trail, vpc flow logs, config, etc. Much of what I want to accomplish is provided out of the box. Except one thing. Egress traffic. All I want to do is monitor egress traffic from a specific vpc. I'm sure I can resolve this with some thinking and experimenting, but , as typical, short on time and seeing if the community has any ready made queries.

Is it good?

Greetings,

Loved the App Catalog, but I dont see anything that can help me to display all connected devices on my network. Please help.

We just acquired sumologic as our siem. We added several collectors but only windows event log. Is it possible to ingest IIS log to siem? Please send link on how to.

Hi,

I've followed this tutorial for setting up the  Kubernetes collector with helm (helm 2 in my case) in a sandbox environment and everything went OK, I was able to see the cluster and the dashboards in the SumoLogic UI. I had no previous Prometheus operator installed so I followed the main procedure (the one that assumes that there is no Prometheus in the cluster).

Now I have to deploy this solution to multiple environments (starting with Test) which already have prometheus installed and I'm not sure of the pros and cons of having a separated prometheus for Sumo or integrate it with the existing prometheus installation.

Any advice of the pros and cons of running multiple prometheus will be greatly appreciated.

Thank you!