Skip to main content
This article covers the Sumo Logic (Roles) connector, which syncs and provisions Sumo Logic users and roles. It’s distinct from the base Sumo Logic connector, which only ships Lumos events to a Sumo Logic collector for SIEM logging.

​
After this article

You will be able to connect Sumo Logic (Roles) to Lumos to sync and provision Sumo Logic users and roles, track user login activity, and run Access Reviews and offboarding.

​
Capabilities

Activity tracking is supported: the integration can track user login events.

​
Required plan and roles

  • Sumo Logic plan: no minimum plan is required to connect the integration.
  • Access key inheritance: the personal access key inherits the access of the user who created it, so pick that user based on the mode you want:
    • Read Only: the user generating the key needs read-only access to all users and roles. This can be an Analyst or an Administrator who can create API keys.
    • Provisioning: the user must be an Administrator.
  • Key capability: the account creating the access key needs the Create Access Keys role capability.

​
Read-only access vs provisioning

Is read-only possible? Yes. The personal access key inherits the access of the Sumo Logic user who creates it, so a key created by an Analyst or Administrator with read-only access to all users and roles produces a read-only connection. What read-only requires. A personal access key created by a user with read-only access to all users and roles (an Analyst or an Administrator who can create API keys), and the Create Access Keys role capability on that user. Follow the steps below to generate the key and connect. What full provisioning requires. The same personal access key, but created by a user who is a Sumo Logic Administrator. No separate connector or additional scope is needed, provisioning is governed entirely by the access level of the user who generated the key. Watch out for. Because the key inherits its creator’s access, a replacement key generated by a lower-privileged user changes the mode of the connection, turning a provisioning connection into a read-only one. Choose the key-creating user deliberately based on the mode you want, both when you first connect and whenever you rotate the key.

​
Instructions

Phase 1: Create an access key in Sumo Logic
  1. Log into Sumo Logic with an account that has the Create Access Keys role capability.
  2. Click your username in the top menu, then select Personal Access Keys.
  3. Click + Add Access Key and give it a name.
  4. Save the generated Access ID and Access Key.
Phase 2: Connect in Lumos
  1. Find the Sumo Logic (Roles) card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Provide the Access ID, Deployment Region, and Organization ID (along with the Access Key from Phase 1).
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Wrong region endpoint (404 Not Found or connection timeouts). Verify the correct region is selected (US1, US2, EU, AU, and so on). Check your Sumo Logic account URL to determine the region, update it in the Lumos integration settings, and confirm the correct regional API endpoint. Refer to the Sumo Logic docs for regional endpoints. Permission errors (403 Forbidden / insufficient privileges). Verify the user has the required role permissions. The role should include View Users, View Roles, and Manage Search capabilities, and the user should be able to access Content (saved searches, dashboards). Try an Admin account to isolate the problem, then review the role capabilities in Sumo Logic settings. No users syncing. Confirm users exist and that the access key’s user can view other users. Ensure the View Users capability is granted, review the Lumos integration logs, and test the /users endpoint manually. Rate limiting (429 Too Many Requests). Sumo Logic enforces API rate limits based on plan. Wait for the window to reset, verify no other apps use the same access key heavily, and contact Sumo Logic support or consider upgrading your plan for higher limits.