Sumo Logic Keys

Description

General

• Documentation: https://help.sumologic.com/APIs
• Summary: Sumo Logic is a cloud-based data analytics company. It exposes an API to interact with the Sumo Logic platform. This detector aims at catching Sumo Logic keys in the form of an accessId and an accessKey.
• IPs allowlist: The use of Sumo Logic credentials can be restricted to some IP addresses. This specific documentation gives more information on how to create a whitelist for IP.
• Scopes: This feature is currently not supported.

Revoke the secret

API credentials can be revoked and regenerated from the administration tab of the user's dashboard. Credentials can also be temporarily deactivated from this page.

Check for suspicious activity

This feature is currently not supported.

Details for Sumo Logic Keys

• Family: credentials

• Category: monitoring

• Company: Sumo Logic

• High recall: False

• Validity check available: True

• Analyzer available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: True

• Minimum number of matches: 2

• Occurrences found for one million commits: 0.01

• Prefixed: False

• PreValidators:

- type: FilenameBanlistPreValidator
  banlist_extensions:
    - ^lock$
    - ^storyboard(c|er)?~?$
    - ^xib$
  banlist_filenames: []
  check_binaries: false
  include_default_banlist_extensions: false
  ban_markup: false
- type: ContentWhitelistPreValidator
  patterns:
    - secret
    - token
    - key
- type: ContentWhitelistPreValidator
  patterns:
    - su[a-z0-9]{12}

Examples

- text: |
    sumologic.accessId = "suzAlcKzTi3hAO"
    sumologic.accessKey = "XPU8IIaT6arXZkVMX3wVvOMHeqpkNM0N4s8dIh6IQVV0H8tFphZxMTy5TBhnpCBB"
  client_id: suzAlcKzTi3hAO
  client_secret: XPU8IIaT6arXZkVMX3wVvOMHeqpkNM0N4s8dIh6IQVV0H8tFphZxMTy5TBhnpCBB