Sumo Logic

Sumo Logic is a cloud-native log management, SIEM and observability platform for DevOps and SecOps teams, run as multi-tenant SaaS and priced by data scanned.

Sumo Logic gathers logs, metrics and traces from cloud and on-premises systems so operations and security teams can search, alert and investigate from one place. It is built and run by Sumo Logic, Inc. of Redwood City, California, as a multi-tenant SaaS service with no infrastructure for the customer to deploy, patch or manage. The problem it addresses is noise: large log volumes in which the few events that explain an outage or an attack are hard to find. Data arrives through the Installed Collector on hosts, hosted collectors for cloud sources and the Cloud Syslog Source. Processing rules drop noisy lines and mask sensitive values before ingestion, while Field Extraction Rules pull fields out at ingest or at search time. Searches combine keyword expressions with a query language, Live Tail streams events as they land, and LogReduce clusters similar messages into patterns. Monitors raise alerts on log and metric queries, Logs-to-Metrics turns values inside logs into time series, and dashboards place both side by side. Cloud SIEM adds entity-centric detection, MITRE ATT&CK mapping and UEBA, and Dojo AI adds the Mobot assistant and a SOC Analyst Agent that picks up alerts and gathers telemetry. The Essentials edition is aimed at small and mid-sized DevOps and SecOps teams that investigate problems as they come up across cloud, hybrid and multi-cloud estates. Enterprise Suite is meant for maturing security teams that need a cloud-native SIEM, centralised audit trails, posture monitoring and round-the-clock support across several orgs. Teams that want AI agents working alongside their analysts add Dojo AI. The platform suits organisations that would rather send data to a hosted service than run log servers of their own. A platform team on Kubernetes ships container logs tagged with cluster, namespace and pod, then watches a release land in Live Tail. When a monitor fires, an engineer right-clicks the failing log line to open its trace and runs LogReduce to see which message pattern is new. Security analysts read AWS CloudTrail and NGINX logs in Cloud SIEM and follow each detection to the MITRE ATT&CK technique behind it. Older logs move to Amazon S3 archives, ready to be ingested again when an audit or an incident reaches back months.