Introducing the Sumo Logic detection module: monitor alerts become incidents

Reviewed by ContraForce team · Updated 2026-10-02

Your SOC works Microsoft Sentinel and Defender XDR incidents in ContraForce. A customer whose detection runs on Sumo Logic monitors is harder to cover, because their alerts fire in Sumo Logic, outside the queue your analysts work. Covering that customer can mean adding a Sumo Logic login to the shift checklist and resolving each alert there by hand.

With the Sumo Logic detection module, ContraForce opens an incident for each new monitor alert from that customer, in that same queue, alongside your other customers' incidents. Detection carries on in Sumo Logic, on the monitors the customer runs today, and their team can keep tuning them there.

What lands in the queue

ContraForce checks the customer's Sumo Logic organization for new monitor alerts about every two minutes. Each new alert becomes its own incident under that customer.

Say one of their monitors watches for failed sign-ins on a service account. It fires, and after the next check an incident appears. Your analyst opens it and sees the monitor that raised the alert and the log messages that triggered it. ContraForce pulls those logs from Sumo Logic when your analyst opens the incident and keeps no copy, so the customer's log data stays in their Sumo Logic organization.

Closing the incident resolves the alert

Close the incident in ContraForce and the alert is resolved in Sumo Logic. If the monitor recovers and Sumo Logic resolves the alert by itself, ContraForce closes the incident for you. Your analysts triage on the ContraForce incident, where they assign an owner, add comments, move it from New to In Progress and classify it.

Your team's status, owner, classification, comments and audit trail live on the ContraForce incident, and they're still there after Sumo Logic ages the alert out at 30 days.

Security Delivery Agents work the same queue

If a Security Delivery Agent runs on the customer's workspace, it picks these incidents up from the same queue, runs its investigation and records its findings on the ContraForce incident for your analyst to read. Any response goes through the workspace's Gamebooks and approvals. The agent answers to the per-workspace controls you already use for your Sentinel and Defender XDR customers: which severities it picks up on its own (On Queue), investigation policies and agent shifts.

Decide up front whether the agent should close incidents on this workspace. When the agent closes an incident, the alert is resolved in the customer's Sumo Logic, just as it is when an analyst closes it, so anyone on the customer's team who checks that alert will see it resolved.

Editing the customer's monitors in ContraForce

Now suppose that service account monitor fires every night because a scheduled job keeps retrying an expired password. Your analyst can open the monitor straight from the incident it raised. The customer's monitors also have a dedicated Sumo Logic tab on the workspace's detection rules page, showing type, alert levels and status.

Workspace Owners and Content Admins can enable, disable or delete a monitor on that tab, and edit its name, description, queries and alert thresholds. Here the fix is probably a query that excludes the scheduled job, which keeps the monitor watching for every other failed sign-in. You make the edit in ContraForce, and it's written to Sumo Logic.

The customer's team may be editing the same monitor in Sumo Logic while you're in it. If they save first, ContraForce keeps their change and has you reload before you save yours.

Connecting the customer's Sumo Logic organization

The module runs on any Sumo Logic plan that has monitors. Each ContraForce workspace connects to one Sumo Logic organization, and setup starts inside that organization. Someone with the Sumo Logic Administrator role there creates a service account and an OAuth client for it, with the scopes ContraForce needs, and notes the deployment (region) the organization is hosted in. If nobody on your team holds that role, this is a request you'll send to the customer's Sumo Logic admin.

A Workspace Owner then enters the client ID and secret, plus the region, in ContraForce. The connection test confirms the credentials, the region and the scopes.

Where to start

If you have more than one Sumo Logic customer, start with the customer whose Sumo Logic your team checks least often, since that's where alerts are most likely to sit unseen. Before you connect, go through what that customer's monitors fire on. Every new monitor alert in the organization becomes an incident, so a monitor that's noisy in Sumo Logic will be just as noisy in your queue.

Next, set the agent controls on that workspace and start the agent on Manual. Then connect from the workspace's Modules page, wait for the next alert and open the incident. The monitor that raised the alert and the log messages behind it should both be there. Once you've reviewed the agent's first investigations, move severities to On Queue.

The step-by-step setup, the sync rules and troubleshooting are in the Sumo Logic Detection Module guide.

Questions about connecting Sumo Logic to ContraForce? Contact us at support@contraforce.com.

What is "Introducing the Sumo Logic detection module: monitor alerts become incidents" about?

Sumo Logic monitor alerts now open as ContraForce incidents, in the same queue as the rest of your customers, where Security Delivery Agents can investigate them too.