Sumo Logic Monitoring and Analytics Platform

What do you like best about the product?

What I like best about Sumo Logic is the control it gives over data before it becomes a cost problem. Being able to filter, transform, enrich, and route logs upstream means we pay to store only what’s valuable, and searches stay cleaner. Cloud SIEM turns raw logs into actionable signals and insights, and the customizable rules and playbooks cut down repetitive triage work for our analysts. The instructor-led training on Cloud SIEM and automation also made onboarding much faster. Overall, it keeps security and observability in one place while keeping costs more predictable.

What do you dislike about the product?

The learning curve can be steep at first, especially for writing efficient search queries and building custom Cloud SIEM rules, so new team members need some time and training before they get comfortable. Some advanced features, like the newer pipeline capabilities, are still rolling out, so the documentation and examples don’t always cover every real-world scenario yet. Costs can also climb quickly if data ingestion isn’t carefully managed, which makes upfront planning important. A few more out-of-the-box dashboards and templates would help speed up initial setup.

What problems is the product solving and how is that benefiting you?

Sumo Logic solves the problem of exploding log and telemetry volumes that outpace budgets, while security and operations teams still need fast visibility into what’s happening. It lets us filter, enrich, and route data before it’s stored, so we keep high-value data and cut out noise. Cloud SIEM and automation playbooks turn raw logs into prioritized insights and speed up incident triage. The benefit for us is lower data costs, quicker investigations, less manual work for analysts, and one platform for both security and observability.

What do you like best about the product?

I love how easy Sumo Logic is to use, and the UI is easy to use. Mobot is very efficient: it gives me a wider view of what I should worry about and alert on, and suggests ways to improve rules and reduce less important alerts. I like being able to see information from different sources in one place instead of checking each source separately. The academy has been very helpful and impactful, especially the hands-on practice with a fake account. It helps me understand the platform, improve my log searches, and use Mobot better. I also appreciate the log search, which helps me see what an IP was doing and try different values. AI investigations give me an overview of what happened, what was blocked, and what needs attention. I like being able to create playbooks with the alerts, workflows, and enrichments I want, including running an insight through VirusTotal and sending the result to Slack. The ability to create monitors is also a feature I appreciate.

What do you dislike about the product?

I notice that my logging budget gets used up quickly, sometimes reaching or exceeding its limit before the day is over. After a number of insights, AI investigations also stop working for the rest of the day's insights. I think the tokens or budget may be getting used up very fast.

What problems is the product solving and how is that benefiting you?

I use Sumo Logic to correlate logs from AWS, our EDR, and other security-team sources with Mobot, which makes triage easier. Its Academy and resources help me understand how to use the platform and become a better SOC analyst.

What do you like best about the product?

SumoLogic processing events efficiently and quickly. The UI changes have generally been an improvement. The organization is better. Recent Mobot changes have been a noticeable upgrade in capability. Mobot has saved me significant time in understanding events even identify activity that I'm not sure I would have noticed. The support team is excellent and readily available. They have acted as a true partner, contributing to operation of Sumo and not just supporting through one question at a time.

What do you dislike about the product?

Collectors can not be marked as inactive. A collector will show green for healthy but that can be misleading. A collector should have an active/inactive indicator to mark those sources either not configured or no longer in use. Mobot usage is limited as it is still in beta. Instructions can not be applied to Mobot and there are capabilities it does not have, e.g. it can not update a monitor.

What problems is the product solving and how is that benefiting you?

My company uses a number of firewalls, Sumo is able to identify the firewalls in use across the business units. We implemented a number of traffic blocks for sanctioned countries, Sumo is able to track and report on anonymous activity with those countries. Resulting in Incidents for concerning behavior to be further investigated.

What do you like best about the product?

Cloud-native, no infrastructure to manage: There are no servers to maintain, and it scales with log volume.
Powerful search and query language: You can parse, filter, and aggregate logs quickly, and saved searches and dashboards make recurring analysis easy.
Unified logs, metrics, and traces: One platform covers observability and security monitoring.
Built-in security analytics: Its cloud SIEM features and pre-built apps for AWS, Kubernetes, and others speed up setup.
Real-time alerting: Alerts and dashboards help teams catch issues early and cut troubleshooting time.
Integrations: It connects with most major cloud services and DevOps tools.

What do you dislike about the product?

Cost: Pricing can climb quickly as log volume grows, and many users find it hard to predict or control spend.
Learning curve: The query language is powerful but takes time to learn, especially for complex parsing and aggregation.
Performance on large searches: Queries over big time ranges or huge data sets can be slow.
Dashboard and UI limitations: Some users find customization less flexible than competitors, and the interface can feel cluttered as features expand.
Alert tuning: Setting up alerts that are accurate without being noisy takes effort.
Support and documentation: Experiences vary, and some users say complex issues take a while to resolve.
Feature sprawl: Because the platform covers logs, metrics, traces, and SIEM, some capabilities feel less mature than specialized tools.

What problems is the product solving and how is that benefiting you?

Scattered logs: Applications, servers, and cloud services each produce their own logs. Sumo Logic centralizes them in one searchable place.
Slow troubleshooting: Instead of logging into individual systems, teams can search across everything at once to find the root cause of an outage or error.
Security visibility: It helps detect threats and suspicious activity by correlating events across systems, and it supports compliance reporting.
Monitoring blind spots: Dashboards and alerts surface performance problems before users notice them.
Scaling overhead: Being cloud-hosted, teams don't have to run or scale their own logging infrastructure.

What do you like best about the product?

It can transform complex operational data into actionable insights, helping customers proactively identify issues and resolve them more quickly by capturing the correct required logs.

What do you dislike about the product?

Too many logs to read if not specified.

What problems is the product solving and how is that benefiting you?

It helps in solving the challenge of managing and making sense of the massive amounts of data generated by modern cloud applications, infrastructure, and security systems.