cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Export Sumo Logic Logs for Security Investigations

· Original article ↗

Summary

The article explains how to export raw Sumo Logic logs through the Search Job API, including pagination, cookie handling, query limitations, common errors, and options for reviewing exported logs in LogTotal.

Key points

  • Create a Search Job API search, wait for results to finish gathering, then page through messages; original log lines are in `_raw`.
  • Keep cookies between API calls and use the API host for the correct Sumo Logic deployment; the access key’s role must have permission to search the data.
  • Pages hold up to 10,000 messages and jobs have a result cap; use narrow time windows and split searches when needed.
  • Use plain filter queries to retrieve messages with `_raw`; aggregation queries return records without that field.
  • The guide recommends handling cancelled jobs in scripts and slowing requests when the API returns 429 errors.
  • The job body can use `byReceiptTime: true` to search by receipt time instead of message time.

Article Details

Defense Focus
Export and review raw log messages to support an investigation.
Detection Methods
  • Use a plain filter query to retrieve messages and retain each message's _raw log line.
  • Review exported logs; the article does not provide specific detection logic or indicators.
Data Sources
  • Raw log messages in the _raw field.
  • Example query targets the linux/secure source category and web-03 host.
Rule Types
  • Aggregation-free search filter through the Search Job API.
  • Structured JSON-lines output of message fields using jq.
Defensive Actions
  • Use an access key whose role permits searches on the required data, and select the API endpoint matching the deployment.
  • Keep cookies between API calls, wait for results to finish gathering, and page through messages in batches of up to 10,000.
  • Use tight time windows to manage per-job message limits; split the time window if results are capped.
  • Check for a cancelled job to avoid an endless wait loop.
  • Use fewer parallel jobs or slow requests when rate-limited.
  • Use byReceiptTime when late-arriving or incorrectly timestamped sources make receipt-time searches useful.
  • Upload the exported file to LogTotal for sanitization and review.

Vendors

Sumo LogicRun your search through Sumo Logic’s Search Job API: create a job, wait until it has gathered all results, then page through the messages.

Products

LogTotalThe Messages tab in the UI can export results too, but not in a format LogTotal reads today.Sumo LogicRun your search through Sumo Logic’s Search Job API: create a job, wait until it has gathered all results, then page through the messages.

Related Articles