> For the complete documentation index, see [llms.txt](https://docs.itoc360.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.itoc360.com/integrations/inbound-integrations/log-management/sumo-logic-integration.md).
# Sumo Logic Integration
Sumo Logic is a cloud-based log management and analytics platform that provides real-time insights into applications and infrastructure. This integration delivers alerts from Sumo Logic monitors to ITOC360 through a webhook connection, so triggered monitors open alerts on your dashboard and recovered monitors resolve them automatically.
### How it works
Sumo Logic sends a webhook request to ITOC360 whenever a monitor triggers or recovers. ITOC360 creates an alert when the monitor fires, maps its severity to a priority, and resolves the alert when the recovery notification arrives.
### Create a source in ITOC360
1. In ITOC360, go to **Sources** and click **Add Source**.
2. Select **Sumo Logic** as the source type.
3. Give the source a name and save it.
4. Copy the generated webhook URL with your token. It looks like this:
```
https://api.itoc360.app/functions/v1/events?token=YOUR_TOKEN
```
### Create a webhook connection in Sumo Logic
1. In Sumo Logic, go to **Administration → Connections** and click **Add**.
2. Select **Webhook** as the connection type.
3. Name the connection (for example, `ITOC360`).
4. Paste your ITOC360 webhook URL into the **URL** field.
5. Leave **Authorization Header** and **Custom Headers** empty — the token in the URL handles authentication.
### Configure the payloads
Replace the default **Alert Payload** with the following:
```json
{
"title": "{{Name}}",
"description": "{{Description}}",
"host": "sumo-logic",
"severity": "{{TriggerType}}",
"status": "Active",
"alert_id": "{{Id}}",
"trigger_time": "{{TriggerTime}}"
}
```
Replace the **Recovery Payload** with the following:
```json
{
"title": "{{Name}}",
"description": "{{Description}}",
"status": "Resolved",
"alert_id": "{{Id}}",
"trigger_time": "{{TriggerTime}}"
}
```
The recovery payload intentionally omits the severity and host fields — Sumo Logic does not provide these variables in the recovery context. ITOC360 matches the recovery to the original alert using the alert ID, so the alert resolves correctly without them.
Click **Save** to store the connection.
### Attach the connection to a monitor
1. Go to **Monitoring → Monitors** and create or edit a monitor.
2. In the **Notifications** section, choose **Webhook** as the connection type and select your ITOC360 connection.
3. Enable the notification for both **Alert** and **Recovery** so ITOC360 receives the full lifecycle.
4. Save the monitor.
### Priority mapping
ITOC360 maps the Sumo Logic trigger type to an alert priority:
| Sumo Logic trigger | ITOC360 priority |
| ------------------ | ---------------- |
| Critical | CRITICAL |
| Warning | MEDIUM |
| MissingData | LOW |
### Verify the integration
1. Open the connection in Sumo Logic and click **Test Alert**. A test alert appears on your ITOC360 dashboard.
2. Click **Test Recovery**. The test alert resolves.
3. When a real monitor triggers, the alert arrives with the monitor name as its title and the trigger type mapped to its priority. It resolves automatically when the monitor's recovery condition is met.
{% hint style="warning" %} Resolving an alert manually inside Sumo Logic does not send a recovery notification to webhooks. Alerts resolve in ITOC360 when the monitor's recovery condition is met or when the monitor is disabled. {% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.itoc360.com/integrations/inbound-integrations/log-management/sumo-logic-integration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.