Chapter 8. Integrating with Sumo Logic

If you are using Sumo Logic, you can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Sumo Logic.

The following steps represent a high-level workflow for integrating Red Hat Advanced Cluster Security for Kubernetes with Sumo Logic:

Add a new Custom App in Sumo Logic, set the HTTP source, and get the HTTP URL.
Use the HTTP URL to integrate Sumo Logic with Red Hat Advanced Cluster Security for Kubernetes.
Identify the policies you want to send notifications for, and update the notification settings for those policies.

8.1. Configuring Sumo Logic

Use the Setup Wizard to set up Streaming Data and get the HTTP URL.

Procedure

Log in to your Sumo Logic Home page and select Setup Wizard.
Move your cursor over to Set Up Streaming Data and select Get Started.
On the Select Data Type page, select Your Custom App.
On the Set Up Collection page, select HTTP Source.
Enter a name for Source Category, for example, rhacs and click Continue.
Copy the generated URL.

Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the HTTP URL.

Procedure

In the RHACS portal, go to Platform Configuration Integrations.
Scroll down to the Notifier Integrations section and select Sumo Logic.
Click New Integration (add icon).
Enter a name for Integration Name.
Enter the generated HTTP URL in the HTTP Collector Source Address field.
Click Test (checkmark icon) to test that the integration with Sumo Logic is working.
Click Create (save icon) to create the configuration.

Enable alert notifications for system policies.

Procedure

In the RHACS portal, go to Platform Configuration Policy Management.
Select one or more policies for which you want to send alerts.
Under Bulk actions, select Enable notification.
In the Enable notification window, select the Sumo Logic notifier.
Note
If you have not configured any other integrations, the system displays a message that no notifiers are configured.
Click Enable.

Note

Red Hat Advanced Cluster Security for Kubernetes sends notifications on an opt-in basis. To receive notifications, you must first assign a notifier to the policy.
Notifications are only sent once for a given alert. If you have assigned a notifier to a policy, you will not receive a notification unless a violation generates a new alert.
Red Hat Advanced Cluster Security for Kubernetes creates a new alert for the following scenarios:
- A policy violation occurs for the first time in a deployment.
- A runtime-phase policy violation occurs in a deployment after you resolved the previous runtime alert for a policy in that deployment.

You can view alerts from Red Hat Advanced Cluster Security for Kubernetes in Sumo Logic.

Log in to your Sumo Logic Home page and click Log Search.
In the search box, enter _sourceCategory=rhacs. Make sure to use the same Source Category name that you entered while configuring Sumo Logic.
Select the time and then click Start.