Overview

Integrating Sumo Logic with imper.ai enables the platform to securely deliver real-time security alerts-such as verification outcomes (e.g., success, failure, risk indicators), session context (e.g., verification ID, timestamp), and identity event details (e.g., challenge responses, authentication methods)-directly to your organization's Sumo Logic SIEM environment. By routing imper.ai verification events to Sumo Logic as a centralized logging destination, security teams can correlate identity verification data with broader organizational telemetry, enabling faster threat detection, streamlined incident response, and comprehensive audit trails for compliance and forensic analysis.

NOTE

Only admin users can integrate Sumo Logic with imper.ai. Sumo Logic admin is required for the deployment.

---

Permissions

The permissions required for the Sumo Logic admin is manageCollectors (see how to create a new collection in Sumo Logic below).

---

Setup

1. Login to imper.ai admin console

2. Navigate to the Integrations page

3. Click on Connect Sumo Logic.

4. You’ll be prompted to provide a http source URL:

Connect Sumo Logic

Create a Sumo Logic Data Source URL

In Sumo Logic New UI

1. Log in with a user who has a manageCollectors capability.

2. Navigate to Data Management → Collection.
   

Sumo Logic Data Collection

3. Add a Collector

   • If you already have a Hosted Collector, you may skip this step. Otherwise, do the following:

     1. Click Add Collector

     2. Select Hosted Collector

     3. Type in the required fields, and click Save

Add Hosted Collector Dialog

4. Add a Source

   • On chosen/recently created collector, click Add Source

   • Choose the OTLP/HTTP Source

     • Type in the required fields, and click Save

Add Hosted Collector Dialog

• Copy the supplied URL into the imper.ai Sumo Logic Integration

Add Hosted Collector Dialog

Data Format & Schema

imper.ai sends every finished verification to your Sumo Logic HTTP Source as an OCSF 1.3.0 Detection Finding event. For sample events, the full list of fields and how the verification verdict maps to severity and risk, see SIEM Event Format (OCSF).