> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Sumo Logic

> Connect Sumo Logic to CloudThinker for log search, monitor review, resource discovery, and Cloud SIEM insight triage

Connect Sumo Logic to let CloudThinker agents search logs, inspect monitors and ingest resources, review platform health events, and triage Cloud SIEM insights. The connection uses a read-only Access ID and Access Key tied to your Sumo Logic deployment.

## Prerequisites

* A **Sumo Logic account** and its deployment.
* The **Create Access Keys** role capability, or **Manage Access Keys** when an administrator creates the key for another account.
* A user or service account whose roles allow the six read scopes listed under [Required permissions](#required-permissions).
* A Cloud SIEM plan and role capabilities only if agents need to inspect Cloud SIEM insights.

## Setup

<Steps>
  <Step title="Open Access Keys">
    Sign in to Sumo Logic. In the new UI, go to **Administration → Account Security Settings → Access Keys**. In the classic UI, go to **Administration → Security → Access Keys**. See [Sumo Logic Access Keys](https://www.sumologic.com/help/docs/manage/security/access-keys/) for details.
  </Step>

  <Step title="Create a read-only key">
    Click **+ Add Access Key**, name the key `cloudthinker`, and set **Scopes** to **Custom**. Select exactly these scopes: `runLogSearch`, `viewCollectors`, `viewFields`, `viewMonitorsV2`, `viewPartitions`, and `viewPersonalAccessKeys`.

    Click **Save**, then copy the **Access ID** and **Access Key** before closing the dialog. Sumo Logic shows them only once.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Sumo Logic** and enter:

    * **Access ID**: the generated Access ID
    * **Access Key**: the generated Access Key
    * **Deployment**: the deployment that matches your Sumo Logic sign-in URL

    Click **Connect**. CloudThinker verifies the credentials and both scope sets, then shows a **Connected** status.
  </Step>
</Steps>

## Connection details

| Field                      | Description                                    | Example                         |
| -------------------------- | ---------------------------------------------- | ------------------------------- |
| **SUMOLOGIC\_ACCESS\_ID**  | Access ID generated with the key               | Copied from the creation dialog |
| **SUMOLOGIC\_ACCESS\_KEY** | Secret shown once when the key is created      | Copied from the creation dialog |
| **SUMOLOGIC\_REGION**      | Sumo Logic deployment selected in CloudThinker | `us2`                           |

CloudThinker supports these deployment choices:

| Deployment | Location                      |
| ---------- | ----------------------------- |
| `us1`      | US East (N. Virginia)         |
| `us2`      | US West (Oregon)              |
| `eu`       | Europe (Ireland)              |
| `de`       | Europe (Frankfurt)            |
| `au`       | Asia Pacific (Sydney)         |
| `jp`       | Asia Pacific (Tokyo)          |
| `kr`       | Asia Pacific (Seoul)          |
| `ca`       | Canada (Central)              |
| `fed`      | US East (N. Virginia) FedRAMP |

Use Sumo Logic's [API endpoint guide](https://www.sumologic.com/help/docs/api/about-apis/getting-started/) to identify the deployment from your account URL. The key works only in the deployment where it was created.

## Required permissions

The Access Key must contain exactly these assigned scopes and no others:

* `runLogSearch`
* `viewCollectors`
* `viewFields`
* `viewMonitorsV2`
* `viewPartitions`
* `viewPersonalAccessKeys`

The key owner's roles must grant the matching capabilities. Sumo Logic calculates effective scopes from the key scopes and the owner's role capabilities. CloudThinker rejects the connection if either the assigned or effective scopes differ from this six-scope set.

<Tip>
  Create a dedicated key instead of reusing a default key. Default keys can carry permissions outside this read-only set and will fail CloudThinker's scope verification.
</Tip>

## Agent capabilities

| Capability     | What the agent can do                                                                                    |
| -------------- | -------------------------------------------------------------------------------------------------------- |
| **Discovery**  | List collectors, partitions, fields, and platform health events                                          |
| **Log search** | Run a bounded Sumo Logic query over a specified time window                                              |
| **Monitors**   | List monitors and inspect whether they are disabled or currently triggered                               |
| **Cloud SIEM** | Triage insights, severity, status, assignee, and signal count when the plan and owner roles allow access |

This connection is read-only. Log searches create temporary search-job state and remove it after collecting the result.

### Verify the connection

```text theme={null}
@alex #report list Sumo Logic collectors, partitions, fields, and platform health events, then summarize what is reachable
```

### Example prompts

```text theme={null}
@alex #report search Sumo Logic logs for 5xx responses from the api service in the last hour and group them by source host
@alex #alert review Sumo Logic monitors and identify which are disabled or currently triggered
@oliver #report triage open Sumo Logic Cloud SIEM insights and summarize severity, assignee, and signal count
```

## Troubleshooting

<Accordion title="401 Unauthorized">
  Check the Access ID and Access Key. If both are correct, select the deployment where the key was created. Another deployment rejects the key as an unknown credential.
</Accordion>

<Accordion title="Scope verification fails">
  Recreate the key with exactly the six [required scopes](#required-permissions). If an effective scope is missing, grant the owner the matching role capability, then test again.
</Accordion>

<Accordion title="403 Forbidden on a Sumo Logic resource">
  The credentials are valid, but the key owner's roles do not allow that resource. Ask a Sumo Logic administrator to grant the matching View capability. A permission error does not mean the account has no data.
</Accordion>

<Accordion title="Cloud SIEM is unavailable">
  A 403 or 404 from Cloud SIEM means the feature is not included in the plan or the key owner's roles cannot reach it. Logs, monitors, and discovery can still work, so do not recreate the connection only for this result.
</Accordion>

<Accordion title="429 rate limit exceeded">
  Sumo Logic limits API requests. Wait, then retry one focused request with a short time window instead of running several broad searches at once.
</Accordion>

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Exact read scope**: keep both assigned and effective scopes limited to the six required values. CloudThinker refuses broader keys.
- **Credential lifecycle**: use Sumo Logic's [rotate or delete controls](https://www.sumologic.com/help/docs/manage/security/access-keys/#edit-activatedeactivate-rotate-or-delete-access-keys), then update or remove the CloudThinker connection.

## Related

<CardGroup cols={2}>
  <Card title="Coralogix Connection" icon="https://mintcdn.com/cloudthinker/CGWam0VVP8R5KVLk/images/icons/coralogix.svg?fit=max&auto=format&n=CGWam0VVP8R5KVLk&q=85&s=b93db8be4df83bdef5ac59815fd38517" href="/guide/connections/coralogix" width="139" height="139" data-path="images/icons/coralogix.svg">
    Log search, metrics, traces, and incident triage
  </Card>

  <Card title="Datadog Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48" href="/guide/connections/datadog" width="24" height="24" data-path="images/icons/datadog.svg">
    Logs, metrics, infrastructure, and incidents
  </Card>
</CardGroup>