Introduction to Sumo Logic: Unlocking the Power of Log Management and Analytics

In today's digital landscape, managing and deriving meaningful insights from the vast amount of log data generated by systems, applications, and infrastructure components has become a critical necessity for businesses. Enter Sumo Logic, a cloud-native log management and analytics platform that equips organizations with the tools and capabilities to harness the full potential of their log data. In this article, we will provide an insightful introduction to Sumo Logic, highlighting its key features, benefits, and demonstrating its value through practical examples.
Here are some of my favorites.

1. DHCP Events in Sumo Logic:

_sourceCategory="Windows/DC/EventLogs" and _collector="DHCP-server01" "Microsoft-Windows-Dhcp-Server/Operational"
| parse "Message = \"*\";" as msg
| parse "EventCode = *;" as eventcode
| parse "Logfile = \"*\";" as logfile
| count eventcode, msg

This query searches for DHCP events in the Windows event logs, specifically in the "Microsoft-Windows-Dhcp-Server/Operational" log file. It filters events from the specified source category and collector. The parse commands extract the msg, eventcode, and logfile fields. Finally, the query performs a count aggregation on the eventcode and msg fields.

2. Account Locked Out Events in Sumo Query:

_sourceCategory = Windows/DC/EventLogs _sourceName=Security (4740 or 644) "User Account Management"
| parse "EventCode = *;" as event_id nodrop
| parse "Computer = \"*\";" as host nodrop | parse "ComputerName = \"*\";" as host nodrop
| parse "InsertionStrings = {\"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\"};" as user,field1,guid,guid2,device,domain,field2
| count by user
| where _count > 2

This query focuses on account locked out events in the Windows Security logs. It filters events from the specified source category and source name. The parse commands extract the relevant fields such as event_id, host, and user. The query then performs a count aggregation on the user field and filters for users with a count greater than 2.

3. User Added to AD Group in Sumo:

_sourceCategory = Windows/DC/EventLogs _sourceName=Security (4728 or 4732 or 4746 or 4751 or 4756 or 4761) ("EventCode = 4728;" or "EventCode = 4732;" or "EventCode = 4746;" or "EventCode = 4751;" or "EventCode = 4756;" or "EventCode = 4761;" )
//| parse "InsertionStrings = {\"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\"}" as user_details,someID,ADGroup,src_domain,someID2,someID3,src_user,dest_domain,hexcode,lastfield
| parse "\"CN=*," as dest_user
| parse "{\"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\", \"*\"," as userdetails,code1,group_domain,dest_domain,id1,id2,src_user,src_domain nodrop
//| parse field=userdetails "CN=*, OU" as dest_user
| parse "EventCode = *;" as event_id nodrop | parse "Computer = \"*\";" as host nodrop | parse "ComputerName = \"*\";" as host nodrop | parse regex "Message = \"(?<msg_summary>[^\r]+?)\r" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Subject:[\s\S]+?Account Name:\s+(?<dest_user>[^\r\"]+?)\r[\s\S]+?(?:New|Deleted) Group:[\s\S]+?(?:Account|Group) Name:\s+(?<group_name>[^\r\"]+?)\r\s+?(?:Account|Group) Domain:\s+(?<group_domain>[^\r\"]+?)(?:\r|\")" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Account Name:\s+(?<src_user>[^\r]+?)\r[\s\S]+?Account Domain:\s+(?<src_domain>[^\r\"]+?)\r" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Subject:[\s\S]+?Account Name:\s+(?<src_user>[^\r]+?)\r[\s\S]+?Member:[\s\S]+?Account Name:\s+(?<dest_user>[^\r\"]+?)\r[\s\S]+?Group:[\s\S]+?(?:Account|Group) Name:\s+(?<group_name>[^\r\"]+?)\r\s+?(?:Account|Group) Domain:\s+(?<group_domain>[^\r\"]+?)(?:\r|\")" nodrop
| where event_id in ("4728", "4732", "4746", "4751", "4756", "4761")
//| fields host, event_id, msg_summary

, src_user, dest_user, src_domain, group_name, group_domain
| count by src_user, dest_user, group_domain

This query focuses on events where a user is added to an Active Directory (AD) group in the Windows Security logs. It filters events from the specified source category and source name. The parse commands extract various fields related to the source user, destination user, and group details from the log messages. The query then filters events based on the specified event codes and performs a count aggregation on the source user, destination user, and group domain fields.

4. Failed Login by User and Count Query:

_sourceCategory = Windows/DC/EventLogs _sourceName=Security (4625 or 4768 or 4771 or 4776) ("EventCode = 4625;" or "EventCode = 4768;" or "EventCode = 4771;" or "EventCode = 4776;") _source="Server-01"
//| parse "InsertionStrings = {*};\n};" as in_string
//| count by in_string
| parse "EventCode = *;" as event_id nodrop
| parse "Computer = \"*\";" as host nodrop
| parse "ComputerName = \"*\";" as host nodrop
| parse regex "Message = \"(?<msg_summary>[^\r]+?)\r" nodrop
| parse regex "Logon Type:\s+(?<logon_type>\d+)*" nodrop
| parse regex "Failure Information:\s+Failure Reason:\s+(?<fail_reason>[^.\r]+?)[.\r]" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Client Address:\s+(?<src_ip>[^\r]+?)\r[\s\S]+?Client Port:\s+?(?<src_port>[\d-]+)" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Source Network Address:\s+(?<src_ip>[^\r]+?)\r[\s\S]+?Source Port:\s+?(?<src_port>[\d-]+)" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Account Name:\s+(?<src_user>[^\r]+?)\r" nodrop
| parse regex "Logfile = \"Security\";[\s\S]+?Subject[\s\S]+?Account Name:\s+(?<src_user>[^\r]+?)\r[\s\S]+?Account Domain:\s+(?<src_domain>[^\r\"]+?)\r[\s\S]+?Account Name:\s+(?<dest_user>[^\r]+?)\r[\s\S]+?Account Domain:\s+(?<dest_domain>[^\r\"]+?)\r" nodrop
| parse regex "Result Code:\s+(?<result_code>[^\r]+)\r" nodrop
| parse "Type = \"*\";" as type
| parse regex "Logon Account:\s+(?<src_user>[^\r]+?)\r[\s\S]+?Source Workstation:\s+(?<src_host>[^\r]+?)\r[\s\S]+?Error Code:\s+(?<error_code>[^\r\"]+?)(?:\r|\";)" nodrop
| parse regex "Failure Code:\s+(?<failure_code>[^\r]+)\r" nodrop
| where event_id in ("4625", "4771") or (event_id="4768" and result_code !="0x0") or (event_id="4776" and error_code !="0x0")
| fields host, event_id, msg_summary, src_user, src_ip, src_port, src_domain, dest_user, dest_domain, fail_reason, logon_type, result_code, failure_code, src_host, error_code, type  
| where !isBlank(src_user)
| count by src_user
| where _count > 5
| sort by _count

This query focuses on failed login events in the Windows Security logs. It filters events from the specified source category, source name, and source IP address. The parse commands extract various fields such as event_id, host, msg_summary, src_user, src_ip, src_port, src_domain, dest_user, dest_domain, fail_reason, logon_type, result_code, failure_code, src_host, error_code, and type. The query then filters events based on specific conditions and performs a count aggregation on the src_user field. It further filters for users with a count greater than 5 and sorts the results by count in descending order.

5. Find All Windows Events That Match a Username:

_sourceCategory = Windows/DC/EventLogs _sourceName=Security (4624) username*

This query searches for all Windows events in the Security logs that match a username starting with "username". It filters events from the specified source category and source name, and it searches for events with event code 4624.

6. Find All Windows Events That Match a Username:

_sourceCategory = Windows/DC/EventLogs _sourceName=Security (4625)"foobar"*

This query searches for all Windows events in the Security logs that match a username containing "foobar". It filters events from the specified source category and source name, and it searches for events with event code 4625.

These queries provide examples of searching and analyzing specific types of events in Windows event logs using Sumo Logic. They demonstrate the use of filtering, parsing, counting, and other operations to extract and analyze log data based on specific criteria.