Sumo Logic (via Webhook)

If you use HTTP webhooks to share data triggered by events, you can send Tenable One AI Exposure findings to any destination using webhooks.

What to do next:

  • To start sending data for findings, you need to also configure automation rules or manually trigger an action after you add the integration. Successfully completing all integration steps doesn't trigger the sending of any data on its own.

Send Data to Sumo Logic

FedRAMP: If you use Tenable One AI Exposure in a FedRAMP environment, make sure to connect integrations only to FedRAMP authorized services and endpoints. You are responsible for confirming that each service you connect meets your FedRAMP requirements. Sending data to a service outside your authorization boundary can put your organization out of compliance with FedRAMP requirements.

To send data to Sumo Logic:

  1. In the Sumo Logic console, go to Manage Data > Collection.
  2. Configure an HTTP Logs and Metrics Source for a Hosted Collector. Refer to the Sumo Logic documentation for more information.
    • In the Advanced Options for Logs section, within the Message Processing area, choose One Message Per Request. This ensures that each message coming from AI Exposure is displayed on its own row, instead of breaking down a single message into multiple rows (multiline processing).

  3. After you finish entering all information and click Save, copy the URL that is displayed in the dialog box.

    The Sumo Logic HTTP Source Address dialog, with the URL to copy

  4. In the AI Exposure Console, navigate to Settings > Integration > Webhooks and then click Lets Start.
  5. Enter a Display name for the webhook in Tenable.
  6. Enter the Webhook URL that you copied from Sumo Logic in an earlier step.
  7. Check Accept any server SSL certificates if SSL is enabled for the collector.
  8. Add an HTTP header Name and Value if the webhook expects to receive such a header containing any additional relevant information.
  9. Click SAVE.

  10. To see Tenable data in Sumo Logic, go to the Sumo Logic console and search for the source name and collector name you defined above.

    Sumo Logic search results showing finding messages

Sample JSON

Copy

JSON

{
  "accountId": "************",
  "accountName": "Org2Account2",
  "creationTime": "2022-01-12T01:10:24.868Z",
  "description": "User FindingsFixer has 2 policies attached granting it permissions on 2 services, but none of them were used for 68 weeks",
  "findingType": "AwsExcessivePermissionUserFinding",
  "id": "************************************",
  "link": "https://us.app.ermetic.com/risks/************************************",
  "labels": [
    "Admin",
    "Access Keys",
    "No MFA"
  ],
  "resource": [
    "arn:aws:iam::***********:user/FindingsFixer"
  ],
  "severity": "High",
  "source": "Ermetic",
  "status": "Open",
  "statusUpdateTime": "2022-05-21T22:16:44.785Z",
  "title": "Overprivileged IAM user",
  "type": "Finding"
}