Skip to content
downpipes docs

Forward the downpipes audit trail to Sumo Logic

Sumo Logic receives the downpipes audit trail through an HTTP Logs Source on a Hosted Collector. The engine dials out to the source’s unique URL on the scheduler tick and posts the audit events as a JSON array (or newline-delimited JSON).

Sumo’s HTTP Logs Source is a generic JSON intake, not a Splunk-compatible HEC, so send the JSON array or NDJSON format, never the Splunk HEC shape. The source URL itself carries the secret (a unique code in its path), so there is no separate auth header to set, and this platform parses the JSON once you point at the right source.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • A Sumo Logic role that can add an HTTP Logs Source to a Hosted Collector.
  • The source’s unique URL (which carries the secret in its path), and owner access to the downpipes console.

Set it up

  1. In Sumo Logic, add an HTTP Logs and Metrics Source to a Hosted Collector, set its source category, and copy its unique URL. The URL ends in a long unique code, which is the credential.
  2. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  3. Set the sink to HTTPS endpoint and the format to JSON array. NDJSON also works; both split into events on Sumo’s intake.
  4. Because Sumo authenticates by the URL rather than a header, turn on Carry the auth token in the URL. Set the Endpoint URL to the source URL up to (but not including) the final unique code, and paste that final code as the Auth secret. The engine appends it back as the last path segment and sends no auth header.
  5. Choose Test send and confirm Sumo accepts the batch, then Enable the destination.

What lands in Sumo Logic

Each batch arrives as a JSON array of raw audit events (or one per line if you chose NDJSON):

[{"seq":4097,"ts":"2026-06-19T02:14:08.221Z","actorEmail":"ops@acme.example","action":"restore-approve","outcome":"success","...":"..."}]

Sumo parses the JSON on ingest. The source category you set on the Sumo source is what you scope a search to.

Good to know

  • Send generic JSON, not the Splunk HEC shape. Sumo’s HTTP Logs Source is not a HEC, so the Splunk HEC format would arrive as unparsed text. Use JSON array or NDJSON.
  • The URL is the credential, so keep it in the sealed secret. With the URL-token option on, the code sits in the write-only secret field rather than the stored endpoint; use Test send to confirm Sumo accepts the reconstructed URL. Delivery is at-least-once, so dedup on the stable seq or hash; the feed carries operator identity (member emails, source IPs, roles and approver emails) and no backup data or secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .