Cisco Security and Sumo Logic Cloud SIEM

Sumo Logic was founded in 2010 by experts in log management, scalable systems, big data, and security. Today, our purpose-built, cloud-native service analyzes more than 100 petabytes of data, more than 16 million searches, and delivers 10s of millions of insights daily. All positioning Sumo among the most powerful machine data analytics services in the world.

As a SIEM, Sumo Logic SIEM (formerly JASK) correlates this data with all other data-sources in the SOC – network, logs, IAM, Threat Intel feeds and more. Sumo Logic then automates the triage process by creating Insights – correlated, aggregated, prioritized group of alerts serving as a real call-for-action for the SOC analyst.

Product Integrations

• SecureX threat response: The Sumo Logic Cloud SIEM integration provides security analysts with enhanced visibility across the enterprise to thoroughly understand the impact and context of an attack. Streamlined workflows automatically triage alerts to maximize security analyst efficiency and focus. This integration indicates to users that the observable in an investigation is contained in an insight and/or signal within Sumo Logic Cloud SIEM. It allows you to query IPv4, IPv6, SHA-1, SHA-256, MD5, domain, and URL data types. It also returns sightings and indicators of an observable from each insight and signal retrieved from Sumo Logic Cloud SIEM.
• Secure Endpoint: Sumo Logic Cloud SIEM platform seamlessly ingests logs and alerts from Cisco Secure Endpoint. With this out-of-the-box integration, our mutual customers enjoy better context of the endpoint alerts created by Secure Endpoint.