Sumo Logic Integration

Sumo Logic is a cloud-based log management and analytics platform that provides real-time insights into applications and infrastructure. This integration delivers alerts from Sumo Logic monitors to ITOC360 through a webhook connection, so triggered monitors open alerts on your dashboard and recovered monitors resolve them automatically.

How it works

Sumo Logic sends a webhook request to ITOC360 whenever a monitor triggers or recovers. ITOC360 creates an alert when the monitor fires, maps its severity to a priority, and resolves the alert when the recovery notification arrives.

Create a source in ITOC360

1. In ITOC360, go to Sources and click Add Source.

2. Select Sumo Logic as the source type.

3. Give the source a name and save it.

4. Copy the generated webhook URL with your token. It looks like this:

https://api.itoc360.app/functions/v1/events?token=YOUR_TOKEN

Create a webhook connection in Sumo Logic

1. In Sumo Logic, go to Administration → Connections and click Add.

2. Select Webhook as the connection type.

3. Name the connection (for example, ITOC360).

4. Paste your ITOC360 webhook URL into the URL field.

5. Leave Authorization Header and Custom Headers empty — the token in the URL handles authentication.

Configure the payloads

Replace the default Alert Payload with the following:

{
  "title": "{{Name}}",
  "description": "{{Description}}",
  "host": "sumo-logic",
  "severity": "{{TriggerType}}",
  "status": "Active",
  "alert_id": "{{Id}}",
  "trigger_time": "{{TriggerTime}}"
}

Replace the Recovery Payload with the following:

{
  "title": "{{Name}}",
  "description": "{{Description}}",
  "status": "Resolved",
  "alert_id": "{{Id}}",
  "trigger_time": "{{TriggerTime}}"
}

The recovery payload intentionally omits the severity and host fields — Sumo Logic does not provide these variables in the recovery context. ITOC360 matches the recovery to the original alert using the alert ID, so the alert resolves correctly without them.

Click Save to store the connection.

Attach the connection to a monitor

1. Go to Monitoring → Monitors and create or edit a monitor.

2. In the Notifications section, choose Webhook as the connection type and select your ITOC360 connection.

3. Enable the notification for both Alert and Recovery so ITOC360 receives the full lifecycle.

4. Save the monitor.

Priority mapping

ITOC360 maps the Sumo Logic trigger type to an alert priority:

Sumo Logic trigger	ITOC360 priority
Critical	CRITICAL
Warning	MEDIUM
MissingData	LOW

Verify the integration

1. Open the connection in Sumo Logic and click Test Alert. A test alert appears on your ITOC360 dashboard.

2. Click Test Recovery. The test alert resolves.

3. When a real monitor triggers, the alert arrives with the monitor name as its title and the trigger type mapped to its priority. It resolves automatically when the monitor's recovery condition is met.

{% hint style="warning" %} Resolving an alert manually inside Sumo Logic does not send a recovery notification to webhooks. Alerts resolve in ITOC360 when the monitor's recovery condition is met or when the monitor is disabled. {% endhint %}