You can trigger an AWS Lambda function directly from a Scheduled Search or Metrics Monitor by configuring a Webhook Connection in Sumo Logic.
For example, you can create a Scheduled Search that triggers a Lambda function when too many requests are received from a suspicious IP address. The Lambda function can shut down additional requests from that IP address, while simultaneously sending a notification to the security team for review.
Build an API in the API Gateway to Expose a Lambda Function
First, generate an Invoke URL for your Lambda function by creating an API in Amazon API Gateway. For information about exposing an HTTP endpoint, see Amazon's API Gateway documentation:
When you have created the Invoke URL, copy and paste it into a notepad. You will need it in to configure the Webhook Connection in the next section.
Create a Webhook Connection
Configure the Webhook Connection to trigger the AWS Lambda function.
- Go to Manage > Connections.
- On the Connections page click Add.
- Click AWS Lambda.
- In the Create Connection dialog, enter:
- Name. Enter a name for the Connection.
- Description. Optional: Enter a Description for the Connection.
- URL. Enter the Invoke URL from the previous section.
- Access Key and Secret Key. Enter your AWS Access Key and Secret Key.
- Region. Select your region.
- Service Name. Enter execute-api as service name.
- Payload. Enter a JSON object in the format required. For details on variables that can be used as parameters within your JSON object, see Webhook Payload Variables.
- Click Test Connection. If the connection is made, you will see a 200 OK response message.
- Click Save.
Create a Scheduled Search
To trigger the Webhook Connection, you can use a Scheduled Search. The following is an example configuration.
- Create a search query and click Save As below the search field.
- Click Schedule this search.
- Run Frequency. Select Hourly.
- Time range for scheduled search. Select Last 60 Minutes.
- Alert Condition. Select Send notification only if the condition below is satisfied.
- Number of results. Enter Greater than > 0.
- Alert Type. Select Webhook to upload search results to your Connection.
- Webhook. Select the Webhook you created in the previous section.
- Customize Payload. (Optional) If needed, select the check box and customize the Payload for this search. If you’d like to use the default payload, leave this as-is.
- Click Save.
Create a Metrics Monitor
Alternatively, to trigger the Webhook Connection, you can use a Metrics Monitor. For instructions, see Metrics Monitors and Alerts.