Integrations are connectors to applications from industry-leading network and security vendors. Playbooks run actions provided by resources in integrations.
Integrations that are already installed to your environment appear in the Integrations menu in the Automation Service.
Before you can use actions from an integration resource, you must configure the connection for the resource to work with the Automation Service.
By default, no more than 50 playbook actions can be executed per hour. For more information, see Actions limit.
- Click the Configuration button (gear icon) at the top of the UI.
- Under Integrations, select Automation.
- From the Automation screen, click Manage Playbooks.
- Click Integrations in the left navigation bar.
- Select an integration to see the actions on the resource. You call these actions when you add an action node to a playbook.
To add a new resource to an integration, click the + button to the left of Resources. This is useful if you have another instance of the vendor application you want to connect to.
Certified integrations are those that are provided by Sumo Logic. You can install certified integrations using App Central.
Certified integrations are designated by a Certified Integration check mark.
After you select the integration resource and click the View Code button, the certified integration code is set to read-only mode. The certified integrations code can’t be edited using the Cloud SIEM internal IDE. This is also true for the actions available for that integration.
Certified actions are designated by a Certified Action check mark.
You can add resources to the certified integration by clicking the + button, or you use it as-is.
Duplicate an integration
To modify an integration's code, you must first duplicate the integration and make your modifications in the duplicated version. When you click the Duplicate integration button, a new integration will be created in the integrations list with an incremented name.
Following is a duplicated integration:
If the certified integration resource was configured before the duplication process, all the settings will be saved and replicated inside the duplicated integration. There is no need to reset the duplicated integration.
Note that in the following example a (2) follows the duplicated integration's name, as well as the resource name. A (3) would follow the name of the next duplicate, (4) the next, and so on. Also note that the actions listed in the integration do not have the Certified Actions check mark, because they exist on a duplicated integration.
If you choose a duplicated resource when you add an acton node to a playbook, the actions available will be the ones belonging to the duplicated resource. The following example shows selecting an action from a duplicated resource.
For a complete list of integrations that are available to install, see the Integrations tab in App Central.