Logs for Security (AWS Built-In)

What do you like best about the product?

I really appreciate how fast the search is across a lot of data, and the saved searches are a huge benefit because I often reuse the same queries instead of rebuilding them. Writing and tuning detection rules is pretty straightforward, which makes things easier for us. The support from Sumo Logic has been great since we started using them. The dashboards are very helpful as I can build a specific view around a detection or system and share it with other teams, saving time on having to teach the query language. This setup facilitates better collaboration, as security and operations can look at the same information during an investigation and get to a resolution faster. The initial setup of Sumo Logic was pretty easy, especially with the help we got from their team. It's been overall a great tool, and I consider Sumo Logic our main source of truth.

What do you dislike about the product?

My one gripe is cost. The pricing is tied to how much you ingest so the bill scales with log volume. We've had to make some tough calls about what to send based on budget based on what we actually want visibility into.

What problems is the product solving and how is that benefiting you?

Sumo Logic allows us to investigate security alerts from one spot, making it easy to write detection rules and search across logs quickly. It reduces the need for switching between tools and facilitates sharing views with other teams, enhancing investigation speed.

What do you like best about the product?

I like the customer service Sumo Logic offers through our representative, Greg Jerry, who is always ready to help with any issues and is proactive in providing tailored solutions. The reliability of the data logging is also impressive, ensuring we get accurate and deep data queries. Additionally, I find the interface to be user-friendly and easy to navigate, which doesn't require much extra exposure to get used to. It's simple and straightforward to use, making it a convenient tool for our needs. I also appreciate the new mobile features, which aid in investigations and correlating previously triggered signals. Integrating Sumo Logic with our single sign-on system was pretty straightforward, aided by Okta, and it enhances our capability to run logic seamlessly.

What do you dislike about the product?

Sometimes the time it takes for a query to execute can be slow, especially when dealing with large queries. However, this may not be entirely a Sumo Logic issue and could relate to how old the data is or how it's stored. It's understandable that larger queries take longer, but it's still something that occasionally impacts my experience.

What problems is the product solving and how is that benefiting you?

Sumo Logic helps us investigate security alerts by screening log systems for insights and details, supporting our security incident investigations effectively.

What do you like best about the product?

I use Sumo Logic to look at all the logs of our services and to dive into the response times and health of our systems. I appreciate being able to see the performance of our services at any time, helping to manage system uptime and errors. It's also very helpful when a customer has an issue because I can search logs to understand exactly what they have done. I really like the new AI connectors that assist in writing new queries, as they help me explore deeper without needing extensive knowledge of all the Sumo Logic query standards. I spend most of my time using the search, SLOs, and dashboards within Sumo Logic. The initial setup was very easy with lots of assistance and good training provided.

What do you dislike about the product?

I think my dislike in the past has been about the fact that we can only store xx number of months data due to price. Also early day internal AI wasn't as evolved as I thought it might be. This has got better over time.

What problems is the product solving and how is that benefiting you?

I use Sumo Logic to monitor our services' logs, response times, and health. It ensures uptime, helps manage errors, and allows me to track customer issues effectively.

What do you like best about the product?

I really appreciate how Sumo Logic correlates incidents from different platforms into insightful signals, giving analysts a comprehensive view for incident investigation, especially on the SIEM side. Its strongest feature for me is the integration, particularly with the MCP server and the SOC analyst agent, which embeds smoothly into our workflow to provide new insights and correlated activities. I also like the detection engineering and rule set fine-tuning capabilities with MCP integration. The cloud-first model makes setup easy, with minimal maintenance since there's nothing on-premise. The fact that everything ultimately got delivered, like custom parsers, is definitely a plus.

What do you dislike about the product?

I think the biggest area where Sumo Logic could improve is its out-of-the-box rules and SIEM capabilities. They seem to need a significant update to keep up with the current landscape, especially with the rise of AI. The rule sets are still quite basic, and it would be great if there was a way for AI to analyze our large datasets to find attack patterns and create customized rules tailored to our needs. Additionally, the recent UI changes from a non-tab to a tab version, with tabs inside tabs, is quite messy. I would prefer if Sumo Logic stuck to a consistent design rather than trying to cater to everyone.

What problems is the product solving and how is that benefiting you?

Sumo Logic correlates incidents, providing comprehensive insights for incident investigation. Its integration enhances workflow and enables detection engineering, while the cloud-first model eases maintenance and setup.

What do you like best about the product?

Many of the applications that we use is supported by Sumo

What do you dislike about the product?

The lengthy and complicated search scripts

What problems is the product solving and how is that benefiting you?

Being able to monitor products, servers and applications that my team would otherwise not be able to do so.

What do you like best about the product?

Setting up data collections and reading the logs is pretty intuitive. So is the UI

What do you dislike about the product?

It's very robust, so I am still learning everything it can do.

What problems is the product solving and how is that benefiting you?

Alert investigation and logging.

What do you like best about the product?

The pro serve, sales, team, and support team is by far the best I've worked with no matter what the vendor is. Their tool is phenomenal, but the people we work with are also fantastic.

What do you dislike about the product?

I don't have anything I can think of at this time. Everything has been great.

What problems is the product solving and how is that benefiting you?

Sumo Logic's performance, integrations to our current tooling, and ease of use programmatically and UI-wise have been great. I try to think of things that can't be done within our stack at this time and I can't think of anything.

What do you like best about the product?

Easy of use, integration with AI and look and feel of the UI

What do you dislike about the product?

It takes a while for the page to load and usually there is a delay in the logs of about 20-30 secs.

What problems is the product solving and how is that benefiting you?

We use it for logs and debugging issues in our application.

What do you like best about the product?

I really like the scalability and speed of search that Sumo Logic offers. It's pretty plug and play, and I really appreciate how easy it is to plug into Firehose, making the setup and integration processes smooth for me.

What do you dislike about the product?

The mobot really underwhelms me. I need to guide it so much that it's quicker to just use the log search. It should know my collectors off the bat and what kind of data the collectors have. When I say "show me all my Postgres logs," I shouldn't have to explicitly say use these 6 collectors.

What problems is the product solving and how is that benefiting you?

Sumo Logic helps us with observability by parsing log files and building dashboards and alerts for our AWS resources.

What do you like best about the product?

What I like most about Sumo Logic is how much it helps me work faster and more effectively during day-to-day monitoring and incident investigations. Its dashboards give me a quick view of what is happening across production environments, while powerful queries help me drill into logs, identify patterns, validate alerts, and find the root cause of issues. Reusable queries also save me time by making common investigations much more efficient. Most importantly, Sumo Logic helps me quickly understand whether an issue could impact customers and provide clear, actionable information to the right engineering teams. It gives me the visibility and tools I need to move from detection to investigation and escalation with greater confidence.

What do you dislike about the product?

The biggest downside for me is the learning curve for advanced queries and troubleshooting. When working with complex log structures or trying to build a query from scratch, it can take time to get the syntax and filtering exactly right. Some investigations also require multiple queries or deeper knowledge of how the data is indexed and structured. I’d like to see more intuitive query-building assistance, clearer guidance for complex use cases, and easier ways for newer users to discover relevant fields and existing queries. These are relatively minor compared with the visibility and troubleshooting capabilities Sumo Logic provides, but improving them would make the platform faster and easier to use for day-to-day monitoring.

What problems is the product solving and how is that benefiting you?

Sumo Logic helps me quickly monitor and troubleshoot complex cloud environments. For example, when I receive an alert about a production service, I can use a Sumo Logic dashboard to immediately review related logs and signals, then run targeted queries to determine whether the issue is isolated or could affect multiple customers or services. I can look for error patterns, abnormal activity, and related events without manually searching through multiple systems. Reusable queries and dashboards also make recurring investigations much faster and more consistent. This helps me quickly validate alerts, identify the likely root cause, and provide actionable details when escalating an issue to SRE or DevOps. The biggest benefit to me is speed and visibility: Sumo Logic helps me understand what is happening in production sooner, prioritize potential customer impact, and take the right action before an issue becomes a larger incident.

Recommendations to others considering the product:

To enhance user experience, Sumo Logic could introduce more intuitive query-building tools and provide clearer guidance for complex use cases. Offering tutorials or interactive guides for new users would also be beneficial. Additionally, simplifying the process of discovering relevant fields and existing queries could significantly reduce the learning curve, making the platform more accessible and efficient for day-to-day monitoring.