From 26fc11f87105d1f463aca9b74c56384961ed98b3 Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Thu, 24 Oct 2024 17:25:23 +0530
Subject: [PATCH 1/2] LastPass app docs
---
blog-service/2024-10-28-apps.md | 16 +++
cid-redirects.json | 1 +
.../product-list/product-list-a-l.md | 2 +-
docs/integrations/saas-cloud/index.md | 6 +
docs/integrations/saas-cloud/lastpass.md | 105 ++++++++++++++++++
sidebars.ts | 1 +
6 files changed, 130 insertions(+), 1 deletion(-)
create mode 100644 blog-service/2024-10-28-apps.md
create mode 100644 docs/integrations/saas-cloud/lastpass.md
diff --git a/blog-service/2024-10-28-apps.md b/blog-service/2024-10-28-apps.md
new file mode 100644
index 0000000000..20c12ba2d6
--- /dev/null
+++ b/blog-service/2024-10-28-apps.md
@@ -0,0 +1,16 @@
+---
+title: LastPass (Apps)
+image: https://help.sumologic.com/img/sumo-square.png
+keywords:
+ - lastpass
+ - apps
+hide_table_of_contents: true
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+
+
+We're excited to introduce the new LastPass app for Sumo Logic. This app leverages the Sumo Logic Cloud-to-Cloud LastPass source to collect audit logs, providing security analysts with critical visibility into their LastPass environment.
+
+Explore our technical documentation [here](/docs/integrations/saas-cloud/lastpass/) to learn how to set up and use the LastPass app for Sumo Logic.
\ No newline at end of file
diff --git a/cid-redirects.json b/cid-redirects.json
index 11b5e5b389..871a52ccb2 100644
--- a/cid-redirects.json
+++ b/cid-redirects.json
@@ -1976,6 +1976,7 @@
"/cid/22674": "/docs/integrations/google/cloud-functions",
"/cid/22675": "/docs/integrations/google/cloud-sql",
"/cid/2323": "/docs/integrations/saas-cloud/zoom",
+ "/cid/23239": "/docs/integrations/saas-cloud/lastpass",
"/cid/2324": "/docs/integrations/saas-cloud/workday",
"/cid/23433": "/docs/search/search-query-language/search-operators/topk",
"/cid/24000": "/docs/send-data/installed-collectors/sources/preconfigure-machine-collect-remote-windows-events",
diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md
index a69deb5943..37b8a09f75 100644
--- a/docs/integrations/product-list/product-list-a-l.md
+++ b/docs/integrations/product-list/product-list-a-l.md
@@ -329,7 +329,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
|
| [Lacework](https://www.lacework.com/) | Automation integration: [Lacework](/docs/platform-services/automation-service/app-central/integrations/lacework/)
Cloud SIEM integration: [Lacework](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/b5ad3497-214f-4952-9191-e98262709251.md)
Partner integration: [Lacework](https://docs.lacework.net/onboarding/sumo-logic) |
|
| [LambdaTest](https://www.lambdatest.com/) | Partner integration: [LambdaTest](https://www.lambdatest.com/support/docs/sumo-logic-integration/) |
|
| [Lansweeper](https://www.lansweeper.com/) | Automation integration: [Lansweeper](/docs/platform-services/automation-service/app-central/integrations/lansweeper/) |
-|
| [LastPass](https://www.lastpass.com/) | Cloud SIEM integration: [LastPass](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/4a2f39e3-f76b-4d23-b601-c12f3f36de87.md)
Collector: [LastPass Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/lastpass-source) |
+|
| [LastPass](https://www.lastpass.com/) | App: [LastPass](/docs/integrations/saas-cloud/lastpass/)
Cloud SIEM integration: [LastPass](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/4a2f39e3-f76b-4d23-b601-c12f3f36de87.md)
Collector: [LastPass Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/lastpass-source) |
| | [Laurel](https://github.com/threathunters-io/laurel?tab=readme-ov-file) | Cloud SIEM integration: [Laurel](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/182b829a-46b7-4723-b9ef-7373900dc31b.md) |
|
| [Libraesva](https://www.libraesva.com/) | Automation integrations:
- [Libraesva Email Security V4](/docs/platform-services/automation-service/app-central/integrations/libraesva-email-security-v4/)
- [Libraesva Email Security V5](/docs/platform-services/automation-service/app-central/integrations/libraesva-email-security-v5/)
Cloud SIEM integration: [Libraesva](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/e8ac6d6d-eb75-4e7a-84cd-7156212ec048.md) |
|
| [Linux](https://www.linux.org/) | Apps:
- [Linux](/docs/integrations/hosts-operating-systems/linux/)
- [Linux - OpenTelemetry](/docs/integrations/hosts-operating-systems/opentelemetry/linux-opentelemetry/)
- [Linux - Cloud Security Monitoring and Analytics](/docs/integrations/cloud-security-monitoring-analytics/linux/)
- [Linux - Cloud Security Monitoring and Analytics - OpenTelemetry](/docs/integrations/cloud-security-monitoring-analytics/opentelemetry/linux-opentelemetry/)
- [PCI Compliance for Linux](/docs/integrations/pci-compliance/linux/)
- [PCI Compliance for Linux - OpenTelemetry](/docs/integrations/pci-compliance/opentelemetry/linux-opentelemetry/)
Cloud SIEM integration: [Linux](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/e5727c72-15dd-4cc8-ab4e-0b65ff196f10.md)
Collectors:
- [Add a Collector to a Linux Machine Image](/docs/send-data/installed-collectors/collector-installation-reference/add-collector-linux-machine-image/)
- [Install a Collector on Linux](/docs/send-data/installed-collectors/linux/)
- [Install OpenTelemetry Collector on Linux](/docs/send-data/opentelemetry-collector/install-collector/linux/)
- [Linux OS Syslog - Cloud SIEM](/docs/cse/ingestion/ingestion-sources-for-cloud-siem/linux-os-syslog/) |
diff --git a/docs/integrations/saas-cloud/index.md b/docs/integrations/saas-cloud/index.md
index 193285d418..9bb8ffc355 100644
--- a/docs/integrations/saas-cloud/index.md
+++ b/docs/integrations/saas-cloud/index.md
@@ -147,6 +147,12 @@ Learn about the Sumo Logic apps for SaaS and Cloud applications.
Monitor and analyze KnowBe4 Phishing Security logs.
+})
Identify security threats by analyzing audit events.
+})
+
+The Sumo Logic app for LastPass enables security analysts to monitor critical LastPass activities, providing visibility into both user and admin actions that are vital for maintaining account security. The app offers dashboards that track key events such as user logins, password resets, and multi-factor authentication (MFA) changes, helping to detect unusual patterns or potential threats.
+
+Analysts can monitor user activities like sharing keys, provisioning, de-provisioning, and policy changes, while also monitoring account creation and deletion trends. In addition, geo-location insights highlight the origins of risky activities and failed login attempts, assisting in identifying suspicious behavior across different regions. With real-time visualizations of event trends, analysts can quickly detect spikes in activity, allowing for proactive responses to potential security incidents.
+
+:::info
+This app includes [built-in monitors](#lastpass-monitors). For details on creating custom monitors, refer to [Create monitors for LastPass app](#create-monitors-for-lastpass-app).
+:::
+
+## Log types
+
+This app uses Sumo Logic’s LastPass Source to collect [audit events](https://support.lastpass.com/s/document-item?bundleId=lastpass&topicId=LastPass/api_event_reporting.html&_LANG=enus) from LastPass platform.
+
+## Sample log messages
+
+```json title="Audit Event Log"
+{
+ "Time": "2024-10-14 08:00:32",
+ "Username": "thomas@sumo.com",
+ "IP_Address": "137.80.288.60",
+ "Action": "Log in",
+ "Data": "LastPass via Chrome v4.134.0"
+}
+```
+## Sample queries
+
+```sql title="Top 10 Active Users"
+_sourceCategory="lastpass_event" Action Username
+| json "Time","Username", "Action","IP_Address", "Data" as time, user, action, ip_address, data nodrop
+
+// Global filters
+| where action matches "{{action}}"
+
+| count as frequency by user
+| sort by user
+| limit 10
+```
+
+## Set up collection
+
+To set up [Cloud-to-Cloud Integration LastPass Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/lastpass-source) for the LastPass app, follow the instructions provided. These instructions will guide you through the process of creating a source using the LastPass Source category, which you will need to use when installing the app. By following these steps, you can ensure that your LastPass app is properly integrated and configured to collect and analyze your LastPass data.
+
+## Installing the LastPass app
+
+import AppInstall2 from '../../reuse/apps/app-install-v2.md';
+
+
+
+### Security Overview
+
+The **LastPass - Security Overview** provides a detailed view of key authentication events to help security analysts monitor user activity and detect potential threats. It tracks logins to the admin console, encryption key rotations, and SAML login events, offering insight into critical security operations. The dashboard also highlights recent master password changes, MFA modifications, and both successful and failed authentication attempts. By focusing on these events, analysts can quickly identify suspicious behavior, such as unusual login patterns or password resets, and take action to secure the LastPass environment.
+
+### Admin and User Activity
+
+The **LastPass - User and Admin Activity** dashboard offers a comprehensive overview of admin and user activities within LastPass, enabling security analysts to detect and respond to unusual behavior. It tracks admin actions such as user provisioning, de-provisioning, and role changes, alongside critical policy modifications and group updates. Additionally, it highlights user actions such as data imports, exports, and shared folder activities. By analyzing trends in these events, security analysts can quickly identify potential risks, such as unauthorized access or sensitive data deletions, ensuring enhanced protection for the LastPass environment.
+
+## Create monitors for LastPass app
+
+import CreateMonitors from '../../reuse/apps/create-monitors.md';
+
+