Sumo Logic Tables & Permissions

Permissions Required (Total List)

Table Name	Permissions Required
SumoLogicAllowlistedUsers	Security → Manage SAML
SumoLogicCapabilities	User Management (all role capabilities)
SumoLogicConnections	Data Management → View Connections; Manage Connections
SumoLogicPasswordPolicies	Security → Manage Password Policy
SumoLogicRoles	User Management (all role capabilities)
SumoLogicSAMLConfigurations	Security → Manage SAML
SumoLogicSecurityPolicies	Security (all role capabilities)
SumoLogicUsers	User Management (all role capabilities)
SumoLogicAllowlistedCidrs	Security → Allowlist IP Addresses
SumoLogicDatastores	Threat Intel → View & Manage Threat Intel Data Store
SumoLogicDatastoreSourceStatuses	Threat Intel → View & Manage Threat Intel Data Store
SumoLogicDatastoresRetentionPeriod	Threat Intel → View & Manage Threat Intel Data Store
SumoLogicIntegrations	None required.
SumoLogicPartitions	Data Management → Manage Partitions; View Partitions
SumoLogicPartitionsQuota	Data Management → View Partitions
SumoLogicCapabilities_SumoLogicRoles	User Management (all role capabilities)
SumoLogicRoles_SumoLogicUsers	User Management (all role capabilities)

Tables

SumoLogicAllowlistedUsers

Required Permissions: Security → Manage SAML

People who are explicitly allowed to sign in with SAML, plus their basic details and status.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
UserID	string	Unique identifier of the user.
FirstName	string	First name of the user.
LastName	string	Last name of the user.
Email	string	Email address of the user.
CanManageSAML	boolean	If the user can manage SAML configurations.
IsActive	boolean	Checks if the user is active.
LastLogin	datetime	Timestamp of the last login of the user.
BatchDate	datetime	The sync date.

SumoLogicCapabilities

Required Permissions: User Management (all role capabilities)

The individual permissions (capabilities) that can be granted to roles in Sumo Logic.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
Name	string	Name of role capability.
BatchDate	datetime	The sync date.

SumoLogicConnections

Required Permissions: Data Management → View Connections; Manage Connections

A list of configured integrations (like webhooks or ServiceNow) with their names, types, and audit info.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Unique identifier for the connection.
Type	string	Type of connection. Valid values are `WebhookConnection`, `ServiceNowConnection`.
Name	string	Name of the connection.
Description	string	Description of the connection.
CreatedAt	datetime	Creation timestamp in UTC in RFC3339 format.
CreatedBy	string	Identifier of the user who created the resource.
ModifiedAt	datetime	Last modification timestamp in UTC.
ModifiedBy	string	Identifier of the user who last modified the resource.
BatchDate	datetime	The sync date.

SumoLogicPasswordPolicies

Required Permissions: Security → Manage Password Policy

Your organization’s password rules (length, complexity, lockout, MFA requirements, etc.).

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	Unique identifier for the policy.
MinLength	integer	The minimum length of the password.
MaxLength	integer	The maximum length of the password.
MustContainLowercase	boolean	If the password must contain lowercase characters.
MustContainUppercase	boolean	If the password must contain uppercase characters.
MustContainDigits	boolean	If the password must contain digits.
MustContainSpecialChars	boolean	If the password must contain special characters.
MaxPasswordAgeInDays	integer	Maximum number of days that a password can be used before user is required to change it. Put `-1` if the user should not have to change their password.
MinUniquePasswords	integer	The minimum number of unique new passwords that a user must use before an old password can be reused.
AccountLockoutThresholds	integer	Number of failed login attempts allowed before account is locked-out.
FailedLoginResetDurationInMins	integer	The duration of time in minutes that must elapse from the first failed login attempt after which failed login count is reset to 0.
AccountLockoutDurationInMins	integer	The duration of time in minutes that a locked-out account remained locked before getting unlocked automatically.
RequireMFA	boolean	If MFA should be required to log in. By default, this field is set to false.
RememberMFA	boolean	If MFA should be remembered on the browser.
DisallowWeakPasswords	boolean	If weak passwords should be disallowed. By default, this field is set to false.
BatchDate	datetime	The sync date.

SumoLogicRoles

Required Permissions: User Management (all role capabilities)

The roles available in Sumo Logic, with their descriptions and audit info.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Unique identifier for the role.
Name	string	Name of the role.
Description	string	Description of the role.
AutofillDependencies	boolean	Set this to true if you want to automatically append all missing capability requirements. If set to false an error will be thrown if any capabilities are missing their dependencies.
CreatedAt	datetime	Creation timestamp in UTC RFC3339 format.
CreatedBy	string	Identifier of the user who created the resource.
ModifiedAt	datetime	Last modification timestamp in UTC.
ModifiedBy	string	Identifier of the user who last modified the resource.
SystemDefined	boolean	Role is system or user defined.
BatchDate	datetime	The sync date.

SumoLogicSAMLConfigurations

Required Permissions: Security → Manage SAML

Settings for your SAML identity providers and how users are provisioned when they sign in.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Unique identifier of the SAML Identity Provider.
SpInitiatedLoginPath	string	This property has been deprecated and is no longer used.
ConfigurationName	string	Name of the SSO policy or another name used to describe the policy internally.
Issuer	string	The unique URL assigned to the organization by the SAML Identity Provider.
SpInitiatedLoginEnabled	boolean	True if Sumo Logic redirects users to your identity provider with a SAML AuthnRequest when signing in.
AuthnRequestURL	string	The URL that the identity provider has assigned for Sumo Logic to submit SAML authentication requests to the identity provider.
FirstNameAttribute	string	First name attribute of the new user account.
LastNameAttribute	string	Last name attribute of the new user account.
OnDemandProvisioningRoles	string	Sumo Logic RBAC roles to be assigned when user accounts are provisioned.
RolesAttribute	string	The role that Sumo Logic will assign to users when they sign in.
LogoutEnabled	boolean	True if users are redirected to a URL after signing out of Sumo Logic.
LogoutURL	string	The URL that users will be redirected to after signing out of Sumo Logic.
EmailAttribute	string	The email address of the new user account.
DebugMode	boolean	True if additional details are included when a user fails to sign in.
SignAuthnRequest	boolean	True if Sumo Logic will send signed Authn requests to the identity provider.
DisableRequestedAuthnContext	boolean	True if Sumo Logic will include the RequestedAuthnContext element of the SAML AuthnRequests it sends to the identity provider.
IsRedirectBinding	boolean	True if the SAML binding is of HTTP Redirect type.
CreatedAt	datetime	Creation timestamp in UTC in RFC3339 format.
CreatedBy	string	Identifier of the user who created the resource.
ModifiedAt	datetime	Last modification timestamp in UTC.
ModifiedBy	string	Identifier of the user who last modified the resource.
AssertionConsumerURL	string	The URL on Sumo Logic where the IdP will redirect to with its authentication response.
EntityID	string	A unique identifier that is the intended audience of the SAML assertion.
MetadataURL	string	The URL to fetch SAML metadata XML.
BatchDate	datetime	The sync date.

SumoLogicSecurityPolicies

Required Permissions: Security (all role capabilities)

Organization-wide security settings like auditing, session limits, and data access rules.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	Identifier for the Security policy.
AuditPolicyEnabled	boolean	Whether the Audit policy is enabled.
SearchAuditPolicyEnabled	boolean	Whether the Search Audit policy is enabled.
ShareDashboardsPolicyEnabled	boolean	Whether the Share Dashboards Outside Organization policy is enabled.
AccessLevelPolicyEnabled	boolean	Whether the Data Access Level policy is enabled.
ConcurrentSessionsPolicyEnabled	boolean	Whether the Concurrent Sessions policy is enabled.
ConcurrentSessionLimit	integer	Maximum number of concurrent sessions a user may have.
MaxUserSessionTimeout	string	Maximum web session timeout users are able to configure within their user preferences. Valid values are: `5m`, `15m`, `30m`, `1h`, `2h`, `6h`, `12h`, `1d`, `2d`, `3d`, `5d`, or `7d`
BatchDate	datetime	The sync date.

SumoLogicUsers

Required Permissions: User Management (all role capabilities)

All users in Sumo Logic with their names, emails, status, and last-login information.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Unique identifier for the user.
FirstName	string	First name of the user.
LastName	string	Last name of the user.
Email	string	Email address of the user.
CreatedAt	datetime	Creation timestamp in UT RFC3339 format.
CreatedBy	string	Identifier of the user who created the resource.
ModifiedAt	datetime	Last modification timestamp in UTC.
ModifiedBy	string	Identifier of the user who last modified the resource.
IsActive	boolean	True if the user is active.
IsLocked	boolean	This has the value true if the user's account has been locked. If a user tries to log into their account several times and fails, his or her account will be locked for security reasons.
IsMFAEnabled	boolean	True if multi factor authentication is enabled for the user.
LastLoginTimestamp	datetime	Timestamp of the last login for the user in UTC. Will be null if the user has never logged in.
BatchDate	datetime	The sync date.

SumoLogicAllowlistedCidrs

Required Permissions: Security → Allowlist IP Addresses

The IP addresses or networks that are allowed to access Sumo Logic.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the `AllowListedCIDR`.
Cidr	string	The string representation of the CIDR notation or IP address.
Description	string	Description of the CIDR notation or IP address.
BatchDate	datetime	The sync date.

SumoLogicDatastores

Required Permissions: Threat Intel → View & Manage Threat Intel Data Store

Overall size and limits of the Threat Intelligence datastore.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Synthetic GUID used to key related source status rows.
DiskSize	integer	Total disk size used by the Threat Intel datastore (bytes).
IndicatorCount	integer	Total count of indicators in the datastore.
IndicatorLimit	integer	Maximum supported indicators for the datastore.
BatchDate	datetime	The sync date.

SumoLogicDatastoreSourceStatuses

Required Permissions: Threat Intel → View & Manage Threat Intel Data Store

Health and usage details for each Threat Intelligence data source (size, counts, enabled, etc.).

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	Surrogate key for the source status row.
DatastoreID	string	Foreign key to `SumoLogicDatastores.ID`.
Source	string	Threat Intel source name.
Description	string	Description of the Threat Intel source.
DiskSize	integer	Disk size used by this source (bytes).
IndicatorCount	integer	Indicator count for this source.
SumoProvided	boolean	Whether the source is provided by Sumo Logic.
SupportsCat	boolean	Whether the source supports the category field.
Enabled	boolean	Whether the source is enabled.
BatchDate	datetime	The sync date.

SumoLogicDatastoresRetentionPeriod

Required Permissions: Threat Intel → View & Manage Threat Intel Data Store

How long Threat Intelligence data is kept.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	Surrogate key for the retention record.
RetentionPeriod	integer	Retention period for the Threat Intel datastore (days).
BatchDate	datetime	The sync date.

SumoLogicIntegrations

Required Permissions: None required.

The configured Sumo Logic connection profile used for syncing (name, URL, status, and audit info).

Name	Type	Description
ID	integer	The SumoLogic Configuration ID.
Name	string	The name provided for the Configuration.
IsEnabled	boolean	Determines if the integration has been enabled for syncing.
BaseURL	string	The Base URL of your SumoLogic API.
AccessID	string	The Access ID used as credentials to access the SumoLogic API.
CreatedDate	datetime	The date the Configuration was created.
ModifiedDate	datetime	The date the Configuration was modified.
CreatedBy	string	The user who created the Configuration.
ModifiedBy	string	The user who modified the Configuration.

SumoLogicPartitions

Required Permissions: Data Management → Manage Partitions; View Partitions

Your log partitions, including names, routing rules, retention, and activity status

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	string	Unique identifier for the partition.
Name	string	Partition name.
RoutingExpression	string	Expression that routes data into this partition.
AnalyticsTier	string	Analytics tier of the partition.
RetentionPeriod	integer	Current retention period (days).
IsCompliant	boolean	Whether the partition meets compliance requirements.
IsIncludedInDefaultSearch	boolean	Whether the partition is included in default search.
NewRetentionPeriod	integer	Pending retention period (days).
RetentionEffectiveAt	string	Timestamp when the new retention takes effect (UTC).
CreatedAt	datetime	Creation timestamp (UTC).
CreatedBy	string	Identifier of the user who created the partition.
ModifiedAt	datetime	Last modification timestamp (UTC).
ModifiedBy	string	Identifier of the user who last modified the partition.
TotalBytes	integer	Total bytes stored in the partition.
IsActive	boolean	Whether the partition is active.
IndexType	string	Index type of the partition.
DataForwardingId	string	Associated data forwarding ID, if any.
BatchDate	datetime	The sync date.

SumoLogicPartitionsQuota

Required Permissions: Data Management → View Partitions

Your overall partition quota and how much remains.

Name	Type	Description
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	Surrogate key for the quota record.
Quota	integer	Total partitions quota for the account.
Remaining	integer	Remaining partitions available.
BatchDate	datetime	The sync date.

Sumo Logic Bridge Tables

SumoLogicCapabilities_SumoLogicRoles

Required Permissions: User Management (all role capabilities)

Which capabilities are included in each role.

Name	Type	Description
Capability	string	Role capability
RoleID	string	Unique identifier for the role.
ConfigID	integer	The ID of the configuration within Compyl.

SumoLogicRoles_SumoLogicUsers

Required Permissions: User Management (all role capabilities)

Which users are assigned to which roles.

Name	Type	Description
RoleID	string	Unique identifier for the role.
UserID	string	Unique identifier for the user.
ConfigID	integer	The ID of the configuration within Compyl.

Permissions Required (Total List)

Tables

SumoLogicAllowlistedUsers

SumoLogicCapabilities

SumoLogicConnections

SumoLogicPasswordPolicies

SumoLogicRoles

SumoLogicSAMLConfigurations

SumoLogicSecurityPolicies

SumoLogicUsers

SumoLogicAllowlistedCidrs

SumoLogicDatastores

SumoLogicDatastoreSourceStatuses

SumoLogicDatastoresRetentionPeriod

SumoLogicIntegrations

SumoLogicPartitions

SumoLogicPartitionsQuota

Sumo Logic Bridge Tables

SumoLogicCapabilities_SumoLogicRoles

SumoLogicRoles_SumoLogicUsers

Learn more...