Chapter 8. Integrating with Sumo Logic
Chapter 8. Integrating with Sumo Logic If you are using Sumo Logic , you can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Sumo Logic. The following steps represent a high-level workflow for integrating Red Hat Advanced Cluster Security for Kubernetes with Sumo Logic: Add a new Custom App in Sumo Logic, set the HTTP source, and get the HTTP URL. Use the HTTP URL to integrate Sumo Logic with Red Hat Advanced Cluster Security for Kubernetes. Identify the policies you want to send notifications for, and update the notification settings for those policies. 8.1. Configuring Sumo Logic Use the Setup Wizard to set up Streaming Data and get the HTTP URL. Procedure Log in to your Sumo Logic Home page and select Setup Wizard . Move your cursor over to Set Up Streaming Data and select Get Started . On the Select Data Type page, select Your Custom App . On the Set Up Collection page, select HTTP Source . Enter a name for Source Category , for example, rhacs and click Continue . Copy the generated URL. 8.2. Configuring Red Hat Advanced Cluster Security for Kubernetes Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the HTTP URL. Procedure In the RHACS portal, go to Platform Configuration Integrations . Scroll down to the Notifier Integrations section and select Sumo Logic . Click New Integration ( add icon). Enter a name for Integration Name . Enter the generated HTTP URL in the HTTP Collector Source Address field. Click Test ( checkmark icon) to test that the integration with Sumo Logic is working. Click Create ( save icon) to create the configuration. 8.3. Configuring policy notifications Enable alert notifications for system policies. Procedure In the RHACS portal, go to Platform Configuration Policy Management . Select one or more policies for which you want to send alerts. Under Bulk actions , select Enable notification . In the Enable notification window, select the Sumo Logic notifier. Note If you have not configured any other integrations, the system displays a message that no notifiers are configured. Click Enable . Note Red Hat Advanced Cluster Security for Kubernetes sends notifications on an opt-in basis. To receive notifications, you must first assign a notifier to the policy. Notifications are only sent once for a given alert. If you have assigned a notifier to a policy, you will not receive a notification unless a violation generates a new alert. Red Hat Advanced Cluster Security for Kubernetes creates a new alert for the following scenarios: A policy violation occurs for the first time in a deployment. A runtime-phase policy violation occurs in a deployment after you resolved the runtime alert for a policy in that deployment. 8.4. Viewing alerts in Sumo Logic You can view alerts from Red Hat Advanced Cluster Security for Kubernetes in Sumo Logic. Log in to your Sumo Logic Home page and click Log Search . In the search box, enter _sourceCategory=rhacs . Make sure to use the same Source Category name that you entered while configuring Sumo Logic. Select the time and then click Start .