feat(sumologic): new Sumo Logic log-search integration

Sumo Logic REST API, 4 commands: search (job create+poll+messages, cookie session), list/get collectors. Access-key (Basic) auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:08:51 +02:00
parent 16deec38f8
commit 6548740890
5 changed files with 350 additions and 0 deletions
@@ -0,0 +1,65 @@
+id: sumologic
+name: Sumo Logic
+version: 1.0.0
+description: "Sumo Logic (REST API) — log search and collector inventory: run a search job (create, poll, and return messages) and list/read collectors. Access-ID/key (Basic) authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: search (job create+poll+messages), list/get collectors."
+category: siem
+
+# Per-instance configuration. HTTP Basic auth with the access ID + access key.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Sumo Logic API endpoint (region-specific, e.g. https://api.us2.sumologic.com)"
+    access_id:
+      type: string
+      description: "Access ID"
+    access_key:
+      type: string
+      description: "Access key"
+      x-soar-sensitive: true
+  required:
+    - base_url
+    - access_id
+    - access_key
+
+commands:
+  - id: search
+    name: sumologic-search
+    description: "Run a search: create a search job, poll until complete, and return the messages."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Sumo Logic search query" }
+        from_time: { type: string, description: "ISO-8601 start time (e.g. 2024-01-01T00:00:00)" }
+        to_time: { type: string, description: "ISO-8601 end time" }
+        limit: { type: number, description: "Max messages (default 100)" }
+      required: [query, from_time, to_time]
+    outputs_schema: { properties: {} }
+  - id: list_collectors
+    name: sumologic-list-collectors
+    description: "List collectors."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max collectors (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_collector
+    name: sumologic-get-collector
+    description: "Get a single collector by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        collector_id: { type: string, description: "Collector ID" }
+      required: [collector_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: sumologic-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }