SIEM Validation: How the Sumo Logic + Cymulate Integration Works

Now integrated with Sumo Logic, the  Cymulate Exposure Management and Security Validation platform emulates attackers by launching production-safe attacks to uncover your infrastructure’s security gaps. Cymulate’s data-based security effectiveness metrics enable global and granular security scoring, and its capabilities grant the ability to identify which attacks are undetected and the reason behind that lack of detection. When integrated with Sumo Logic, Cymulate’s SIEM Validation capabilities increase security teams’ efficiency through dynamic, customizable dashboards, delivering even ticketing capabilities to accelerate the efficacy of IT operations.

Why Tuning Your SIEM is Critical Today 

Security analysts face an overwhelming workload in their day-to-day operations to stay ahead of the growing quantity and variety of emerging threats and effectively investigate incidents while avoiding time-wasting false positives. At the cornerstone of the Security Operation Center (SOC) is the Security Information and Event Management (SIEM) system that enables them to do this efficiently but even the best setup is temporary if not continuously optimized. Hence the need to continuously validate and refine SIEM performance and the performance of the underlying technologies that enable the SIEM to accurately detect
malicious behaviors.  

The combination of the ever-increasing influx of threat intelligence data reflecting the constant expansion of the threat landscape and the continuously evolving digital infrastructure results in the mounting complexity of keeping track of the actual potential threat impact on a specific organization. 

Switching from a traditional reactive detection and response approach to a proactive and continuous adversarial model delineates an exact match between the threat landscape and an organization's exposure.  

The synergy between Sumo Logic's advanced analytics capabilities, which provide real-time analytics about the SIEM findings, and Cymulate’s comprehensive continuous security validation capabilities delivers a blanket coverage of all aspects of reactive and proactive security information and event management. 

What are the Benefits of Integrating Sumo Logic with Cymulate?

Correlating Sumo Logic detection data with Cymulate adversarial data provides invaluable information to finetune your SIEM for optimal results. Integrating Sumo Logic with Cymulate instantly adds the benefit of continuous security validation to your SOC by: 

• Ensuring that all production-safe attacks are detected: running the comprehensive set of attack scenarios and campaigns enables verifying which ones were detected, triggered an alert and/or an automated response. 
• Accelerating mitigation: the detailed actionable mitigation recommendations included in each of Cymulate’s findings enable fast mitigation of uncovered security gaps 
• Reducing false positives: finetuning security controls based on adversarial data optimizes the accuracy of use cases triggering alerts, reducing the number of false-positive alerts. 
• Preventing security drift: the continuous nature of Cymulate ensures that variance from accepted risk tolerance levels is identified and corrected in real-time. 

• Adding immediate threat Intelligence capabilities: Activating the Cymulate Immediate Threat Intelligence module's automating option protects against emerging threats in real-time. 
• Providing end-to-end protection across the entire kill chain: by emulating the progression of production-safe attacks that gained an initial foothold within the infrastructure, Cymulate maps out attacks' potential path and documents the SIEM's ability to detect and/or respond to various stages of the attack. 

How Sumo Logic - Cymulate Integration Validates and Optimizes SIEM Efficacy 

The integration with Cymulate equips security teams with 360° visibility into the environment security posture, streamlines the response procedures, and prioritizes remediation efforts. Running simulated attacks on the production network gives extensive context to SIEM and SOAR findings, enabling security controls finetuning, compensating controls identification for vulnerability patching workload reduction purposes, optimizing supervision through integrated ticketing, and modulable interactive dashboard for instantaneous in-depth analysis. 

Cymulate’s integration with Sumo Logic is available for Endpoint Detection and Response (EDR), email and Web Gateways, and Web Application Firewall (WAF) and covers the entire cyber kill chain from initial foothold to data exfiltration and command execution. 

How to Integrate Sumo Logic with Cymulate

To set up the Sumo Logic integration, sign in to the Cymulate platform and follow the instructions. Please navigate to the integrations page, scroll to the Sumo Logic integration, and select it. Follow the instructions from Sumo Logic to create an access key. Provide the Sumo Logic API URL, API Access Key, and API Access ID within the integration details. Select the appropriate time zone and, optionally, a Proxy for the integration. Click ‘Submit’, and Cymulate will validate the connection. 

Once the integration is established, you can start running attack scenarios and campaigns and see the results for yourself. The integration will first check if Sumo Logic SIEM has detected the event and if an alert was triggered. All findings will be shown in detail in Cymulate reports.

To set up the Sumo Logic integration, sign in to the Cymulate platform and follow the instructions. If you don't have an account with Cymulate yet, book a demo to see how it works and how you can integrate Sumo Logic.