Sumo Logic

Connect Sumo Logic so agents can search logs, check monitors and collectors, and triage Cloud SIEM insights with a read-only Access Key

Connect Sumo Logic to let CloudThinker agents search your logs, check which monitors are firing or disabled, list collectors and partitions, and triage Cloud SIEM insights. The connection uses a Sumo Logic Access ID and Access Key limited to six read scopes, and it is read-only: agents can’t change anything in Sumo Logic.

Prerequisites

• A Sumo Logic account, and the deployment it lives in (you’ll pick it from a list).
• The Create Access Keys role capability, or Manage Access Keys if an administrator creates the key for a service account.
• A key owner whose roles include the View capabilities that match the required scopes. A key can’t use a scope its owner’s roles don’t grant.
• Cloud SIEM only if you want agents to read insights. Everything else works without it.
• The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

Setup

1. Open Access Keys in Sumo Logic

   Go to Administration → Security → Access Keys. In the newer Sumo Logic UI the same page is under Administration → Account Security Settings → Access Keys.

2. Create a scoped key

   Click + Add Access Key and name it cloudthinker. Set Scopes to Custom and select exactly these six:

   Scope	Why CloudThinker needs it
   runLogSearch	Run log searches
   viewCollectors	List collectors
   viewFields	List fields
   viewMonitorsV2	List monitors and their status
   viewPartitions	List partitions
   viewPersonalAccessKeys	Read this key’s own assigned and effective scopes, so CloudThinker can prove the key is read-only

   Sumo Logic also turns on viewFieldExtractionRules when you pick viewFields. Leave it on. Click Save, then copy the Access ID and Access Key. Sumo Logic shows them only once.

3. Add the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections, select Sumo Logic, and fill in:

   • Access ID: the Access ID you copied.
   • Access Key: the Access Key you copied.
   • Deployment: the deployment from your Sumo Logic sign-in URL (see the table below).

   Click Connect. CloudThinker checks the credentials and reads the key’s scopes.

   Success state: the connection shows a Connected status with the message Sumo Logic read-only connection verified (US2), naming your deployment code.

   Then run the prompt in Verify the connection in a new chat.

Connection details

Field	Description	Example
Access ID	Access ID generated with the key	Copied from the creation dialog
Access Key	Secret shown once when the key is created	Copied from the creation dialog
Deployment	The Sumo Logic deployment your account lives in. Default US East (N. Virginia)	US West (Oregon)

A key works only in the deployment that created it, so a wrong choice shows up as a rejected credential, not a region error. The code is what the success message shows.

Deployment option	Code	Sign-in URL contains
US East (N. Virginia)	US1	service.sumologic.com
US West (Oregon)	US2	service.us2.sumologic.com
Europe (Ireland)	EU	service.eu.sumologic.com
Europe (Frankfurt)	DE	service.de.sumologic.com
Asia Pacific (Sydney)	AU	service.au.sumologic.com
Asia Pacific (Tokyo)	JP	service.jp.sumologic.com
Asia Pacific (Seoul)	KR	service.kr.sumologic.com
Canada (Central)	CA	service.ca.sumologic.com
US East (N. Virginia) FedRAMP	FED	service.fed.sumologic.com

These nine are the only deployments CloudThinker supports today. If your sign-in URL isn’t in the table, CloudThinker can’t connect to that deployment yet.

Required permissions

CloudThinker accepts only a key scoped to the six read scopes above, plus the optional viewFieldExtractionRules. It checks two sets:

Scope set	What it is	What CloudThinker requires
Assigned	The scopes you selected on the key	All six, nothing outside the read set
Effective	Assigned scopes the owner’s roles actually grant	All six, nothing outside the read set

If a scope is missing or an extra one is present in either set, the connection fails and the error names the difference.

Cloud SIEM isn’t part of this check. Sumo Logic decides Cloud SIEM access from your plan and the key owner’s roles. When it refuses, agents report Cloud SIEM as unavailable and the rest of the connection keeps working.

Create a new key for CloudThinker instead of reusing one. A default or shared key usually carries scopes outside the read set and fails the check.

Agent capabilities

Capability	What agents can do
Discovery	List collectors, partitions, fields, and platform health events
Log search	Run a Sumo Logic query over a time window and return matching messages or aggregated records
Monitors	List monitors with their type, current status, and whether they’re disabled
Cloud SIEM	List insights with severity, status, assignee, and signal count, when your plan and the key owner’s roles allow it (see Required permissions)

Log searches default to the last 24 hours and are capped at 90 days, with a search budget of 60 seconds (300 at most). Each search creates a temporary search job and deletes it afterwards. Agents tell you the window they used.

Wide searches can cost credits. On Sumo Logic Flex pricing, credits are consumed by scanned log volume. Agents don’t ask before a search: with no window named they search 24 hours, and any window you name up to 90 days runs as asked. Name a short window in your prompt and ask for a count (for example “count by source category”) when you want the shape of the data, not every line.

Verify the connection

Ask CloudThinker in a new chat:

Run Sumo Logic discovery and summarize the collectors, partitions, fields, and platform health events this key can read

Expect a short list of collectors, partitions, and fields, plus any platform health events. An error on one section means the key can’t read it, not that it’s empty.

Example prompts

Search Sumo Logic for 5xx responses from the api service in the last hour and count them by source host
Which Sumo Logic monitors are triggered right now, and which are disabled?
List open Cloud SIEM insights by severity with assignee and signal count

Troubleshooting

401 Unauthorized

The Access ID or Access Key is wrong, or Deployment doesn’t match the deployment that created the key. Check the sign-in URL against the deployment table, then reconnect.

The Access Key is not scoped to this read-only connection

The key’s assigned or effective scopes differ from the read set, and the message lists what’s missing or extra. Create a new key with only the six scopes. If an effective scope is missing, ask a Sumo Logic admin to grant the key owner the matching View capability.

403 on collectors, monitors, or another resource

The credentials work, but the key owner’s roles can’t read that resource. Ask an admin to grant the matching View capability. A 403 says nothing about whether data exists.

Cloud SIEM is unavailable

Your plan doesn’t include Cloud SIEM, or the key owner’s roles can’t reach it. Logs, monitors, and discovery still work, so you don’t need to reconnect.

429 rate limit, or a search times out

Sumo Logic allows about 4 requests per second per key. Wait, then ask one focused question. If a search times out, ask for a shorter window or a longer budget. A timed-out search has an unknown match count, not zero.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Read-only by design: CloudThinker refuses any key with scopes outside the read set, and there is no write path for Sumo Logic. When a fix needs a change, agents tell you what to change in the Sumo Logic UI.
• Rotate in both places: rotate or delete the key under Access Keys in Sumo Logic, then update or delete the connection in CloudThinker.

Related

Webhook integrations

Send Sumo Logic alerts into Resolve as incidents.

Datadog

Connect Datadog logs, metrics, and monitors.