SIEM Integration - audit & application logs from Saviynt to Sumologic

[darshanmandhane]

Please suggest the best way to integrate audit & application logs from Saviynt to Sumologic.

I found these documents:

• https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter20-EIC-Integrations/Saviynt-...
• https://docs.saviyntcloud.com/bundle/SSM-Admin-v55x/page/Content/Chapter19-EIC-Integrations/Saviynt-...
• https://docs.saviyntcloud.com/bundle/Splunk-Guide/page/Content/Understanding-the-Integration-between...
• https://docs.saviyntcloud.com/bundle/Splunk-Guide/page/Content/Managing-Application-Audit-Logs.htm

However, there are some questions.

1. What is the difference between first two options?
2. If the first options is considered, how can we forward the logs from Saviynt to Sumologic without running any script or cron? Is there any way, Saviynt can proactively push the logs to Sumologic in real time.
3. If the second option is considered with S3 bucket options, who can provide :

   CustomerS3BucketName

   Saviynt AWS Account 12 Digit ID

   Saviynt NAT IP ADDRESS1

[Darshanjain · Accepted solution]

Hi @darshanmandhane 

Only Audit logs can be sent from Saviynt to other tools. ( Application logs are not sent from Saviynt )

You can follow the SIEM integration guide fully for question 2 and its based on analytics the logs are pushed.

Saviynt aws and details will be provided by saviynt infra team, you can raise a support team for the same.

Thanks

Darshan