Logs for Security (AWS Built-In)

The main use case for Sumo Logic Security  is as a SIEM  platform where our customers prefer it to gather logs from multiple places and have good detections, especially Sumo Logic insights, which is helping us a great deal to detect and correlate logs from different platforms and consolidate them into one insight. It helps for investigation and analysis. The major part is threat detection and threat analysis.

The best features of Sumo Logic Security  are automated log and event correlation, which may come from a firewall event, and User Entity Behavior Analytics (UEBA ) for detecting impossible travel and unusual access times. Threat intelligence enrichments are good, and the MITRE ATT&CK framework is beneficial. The centralized log search for investigation is better compared to multiple SIEM  solutions, where I can query everything in one place. The SEC records feature, something that returns index=sec_records, provides all the logs from different places. Pre-built dashboards and analytics, especially threat trends and the anomalies that return compliance patterns, are valuable. The workflow, including playbooks and workflows, can be triggered when we need to quarantine an endpoint, revoke credentials, or block IPs. Most importantly, it is cloud-native and has elastic scale. As a cloud-native SIEM, it scales up very well automatically, and real-time threat detection is available.

One of the most important things is MTTD, which is faster threat detection that reduced our MTTD, and we were able to detect alerts with multiple detections that used to take hours. Now the correlated alerts surface the real threat very quickly. Detection time has dropped significantly. We used to have MTTD of three to four hours, but now it is under 30 minutes. Automatically, our mean time to response has also increased substantially. Analysts are able to quickly pivot items and make faster decisions, especially without switching between tools. We have all our EDR tools and firewalls integrated to the same platform and viewing everything there. As a SOC, which faces major problems, it reduced the alert fatigue by over 100 days of low volume alerts, which have been made into insights, and this has greatly improved our alert efficiency and decision quality, the way we are able to enrich information. Operation stability has also improved very much. It has significantly impacted our organization, and our KPIs have improved substantially with respect to this.

If I want to mention anything related to Sumo Logic Security, I would say that with the current AI situation, AI enrichments should be very well integrated. I saw something in insights that it is doing something around 14 days of correlation, but I would prefer something around seven days would be better. Sometimes we see alerts coming from a different time frame. In some places, correlation could be much better in Sumo Logic. There is a scenario where we see five to six employees from the company log in from the same IP address, which is a shared IP address. Maybe one employee has login failures, perhaps because they forgot their password. In this situation, Sumo Logic gives us an alert saying that a brute-force alert was detected or a credential compromise was detected, stating that five people have successful logins and one user has a bad password. This is not practically correct detection. They should be doing some kind of better analysis, such as a historical analysis of this IP, to make it clear that this IP is a shared IP, so the logins that happened for all other users are normal. Sumo Logic has the capability as a modern SOC to include behavior correlation or attack chain visibility, which would be a great addition to reduce false positives. Good dashboards with AI capabilities would also be more helpful.

Since our product is also AI-based, something where they can focus more on AI with the possibility of detection engineering, writing custom correlation rules, and tuning detections to make more valid true positives would be beneficial. I have experienced some situations where false positives occurred. There can be more improvement in MITRE ATT&CK mapping, especially, as it helps us measure coverage gaps and where we are positioned. Beyond that, SOAR  capabilities with automation focus should include more enrichments into the detection part and provide higher levels of true positives overall. When I compare Sumo Logic Security with other solutions like Splunk, Azure Sentinel , or Sentinel  One, these are improvements I would expect to see.

Automation should be improved further. As we move to AI SOC, there is talk of automated multi-step response workflows where playbooks should be enriched for logs of different activities based on IP, user, user agent, or other fields. More advanced playbook-based correlation should be coming up with a set of rules that can help detect real true positives. Rich incident response playbooks and better integrations with ticketing tools would be beneficial so that we can take quick actions if a breach has been identified. Advanced attack path visualizations would be helpful. Creating a good attack graph showing when something has been detected, how quickly it has been investigated, what the timeline of all these activities was, and including entities such as user, host, network, cloud, or indicators of compromise would be valuable. Built-in threat group playbooks would be very helpful, whether for ransomware, account compromise, or data exfiltration. AI-driven threat insights at the automated flow of investigation would be more helpful. Sumo Logic Security is very good at role-based access controls, and we were able to manage that very well without any issues. Advanced attack path visualizations and built-in threat group playbooks for ransomware, account compromise, or data exfiltration scenarios would enhance the platform significantly.

I have been using Sumo Logic Security for the past four years in my previous two organizations.

Sumo Logic Security is stable. It operates very well as a cloud-native SaaS platform with high availability, and there is no downtime that I have experienced. Sometimes we had API integration issues, but the platform scales up automatically without any performance degradation, especially with large volumes of logs without any failures in ingestion. This is something that I have seen be difficult in other places. It does not require any hardware and patch management, which is another good thing for being stable. These are some of the reasons why I would say it is stable.

Sumo Logic Security scales up automatically because it is a cloud-native SIEM, and I do not need to worry about hardware clusters or capacity planning. The platform grows as security data grows. Real-world ingestion limits, cold versus hot data performance, and retention implications on the cost and query performance under high load are all handled very well. It supports business growth, as when the company grows, security analytics also grows with more servers, more users, and more applications, but without infrastructure headaches. Onboarding is something that I need to mention as well. I can ingest identity logs, endpoint detections, or any type of logs without worrying about underlying capacity. I was able to ingest all types of logs with Sumo Logic Security. In other platforms, we faced some challenges with complexities, especially in terms of handling the hardware part as well.

Support for Sumo Logic Security is good. We have had a couple of issues, especially with the technical support team troubleshooting problems, particularly around API integration issues, but they had a faster response time. I would score them around 9 out of 10. Direct support includes documentations, tutorials, and training access along with community forums, which helps us resolve many questions independently without reaching out to them. Where we have faced some challenges, I would say it may be because of region-specific support in India or Europe, as some support times were slower. Some tickets even took two weeks when we were finding issues with email-related matters. Everything else is good because their documentation is very helpful and querying is also very good. They have a limited direct call option for support, but the response is good, and technically they will explain everything we need to do. Premium support is also available. The customer support is very good with them, and the documentation is helping us to fix issues today.

We used Devo  and Splunk before Sumo Logic Security. Due to our organization's budget platforms and other factors, we switched to Sumo Logic to have our SIEM. We used to face challenges before, such as storage clusters and scaling issues, and the detection part was very much worse in other SIEMs. I may not give specific details, but Sumo Logic insights are playing a major role today in our investigation and reporting parts. I have used Splunk, Devo , and even ArcSight.

As I mentioned, we have 100% return on investment very well. I have experienced that we used to have over 100 alerts where we needed eight analysts, but now we are able to operate with five analysts because the time drop in investigation has been from 20 to 40 minutes. We have saved 64 hours of our time overall. Before we used to have eight analysts, now we have at least five analysts and we are able to do the work completely. We have a good return on investment in terms of even the log retention part as well.

We have not typically evaluated other solutions as alternatives. As I mentioned, we used Splunk, Azure Sentinel , and Devo. We directly switched to Sumo Logic Security as per our organization's needs. We had used different SIEM platforms as well.

I would say to define especially what problems they have, particularly the threat detection part, incident response part, reporting part, cloud security monitoring, or insider threat analytics. They need to plan their log strategy about how much quality versus quantity they require and send only meaningful logs while filtering out debug and low-level information that makes noise. Categorizing the logs by priority is one of the most important things. Using something with very much tiered retention periods is helpful because Sumo Logic Security provides pre-built dashboards, correlation rules, analytics, and threat intelligence feeds. That is going to be helping. I would recommend investing in training, as good training helps the team write more effective queries, build custom correlation rules, alert tuning, and perform threat hunting. These are things to focus on, which especially help the organization. Measure metrics as well, such as MTTD, MTTR, false positive rate, analyst hours worked, and threat signals escalated, as these are outstanding for Sumo Logic Security.

Regarding additional thoughts about Sumo Logic Security before wrapping up, I would mention improvement in the detection part with AI integration regarding log summarization and advanced analytics, which should be part of the roadmap. Also, how Sumo Logic Security is going to handle scalability, such as onboarding different data sources or tuning alerts. The major direction I am interested in seeing is how Sumo Logic Security will move forward with AI-based SOC capabilities, as that is the next era of SIEM tools. I would give Sumo Logic Security an overall rating of 8 out of 10.

Sumo Logic Security  encompasses all three areas: SIEM , SOAR , and log management.

Sumo Logic Security  offers excellent features including ease of use. I came from a competing product, Splunk, and I was able to recycle a lot of the knowledge from that tool into Sumo because the logic was very similar.

Beyond the ease of use, the consumption model of Sumo Logic Security is also easy to understand, which was helpful. The build-out with Sumo was very good, as they spent a lot of time ensuring that we were sized correctly for the product, and the follow-ups were good. Sumo Logic Security has really good customer support.

The capabilities of Sumo Logic Security in providing security visibility across multi-cloud and hybrid environments are very good, particularly because Mambu  is still a multi-cloud vendor, and the product worked extremely well in that scenario.

Regarding the automated TDRI workflows in Sumo Logic Security, they are excellent. I would put them at the top because they are truly useful and actually work as advertised.

My experience with Sumo Logic Security has been good. My SOC analysts were crushed under Splunk, but Sumo has actually eased the workload and made it tolerable for three people.

The improvements or benefits I have seen from Sumo Logic Security relate to alerts. We were buried under alerts and Sumo actually helped us clean that up. The number one value is being able to action things in a proper time frame.

A more transparent roadmap as to what Sumo Logic Security is trying to achieve would be beneficial. Sumo often gives information in three-month cycles, which makes it hard for planning purposes.

I have been using Sumo Logic Security for about a year and a half.

In terms of stability, Sumo Logic Security rates a ten; it has been up.

Regarding scalability, I give Sumo Logic Security a nine. I have yet to run into an issue with scalability, but we really have not tested it.

The build-out with Sumo was very good, as they spent a lot of time ensuring that we were sized correctly for the product, and the follow-ups were good. Sumo Logic Security has really good customer support.

The interactions have been extremely good, and the account team is great, so I never feel as though they just forgot us.

I rate the technical support for Sumo Logic Security a nine.

I came from a competing product, Splunk, and I was able to recycle a lot of the knowledge from that tool into Sumo because the logic was very similar.

When comparing Sumo Logic Security to Splunk or other vendors, the models are vastly different. Sumo's consumption model is easier to understand, while Splunk's is much more complex. Additionally, the Splunk service was not really fit for the size of our organization, which was about 1,000 people as it was a much more robust solution for something larger.

The initial deployment of Sumo Logic Security was complex, but working with Sumo made it very easy.

It took three months to deploy Sumo Logic Security.

I do use the SOC analyst agent for alert triage. I have three SOC analysts.

The return on investment I have seen with Sumo Logic Security in the past year and a half is tough to quantify, but I would estimate it has hit the milestones we set internally for return on investment, as we have not looked at the product and said it is not paying for itself.

When it comes to pricing, I would say Sumo Logic Security is in the upper middle-class tier. It is not expensive, but it is not inexpensive, sitting between those two.

From one to ten, where one is cheap and ten is expensive, I would put Sumo Logic Security at a seven.

Regarding the effectiveness of AI-driven analytics in reducing the workload and response times, it is too early to tell, as it is something that recently came out and we have not consumed it yet.

My impressions on the built-in threat intelligence feature are not bad. I would give them four out of five stars. They tend to be very good, but very specific to certain situations.

The impact of Sumo Logic Security in prioritizing alerts has been hard to quantify at this stage, as we are still trying to determine the value of that.

I could not tell you if the knowledge agent has helped improve onboarding efficiency because we do not utilize that function.

When it comes to how much time Sumo Logic Security saves, I would not say it is a time saver. It is an FTE saver. It did not really make my analysts work less in a day. They still have to work, but it avoided the need to procure more analysts to do the work.

Sumo Logic Security has probably saved us three FTEs.

Approximately 15 users utilize Sumo Logic Security.

Sumo Logic Security does not require any maintenance as it is a SaaS-based solution. We do not have to patch it, maintain it, or host it.

Sumo Logic Security was purchased through an engagement that was done pre-Marketplace, but it was purchased through Marketplace.

My advice for others looking to implement Sumo Logic Security would be three things: first, do a proof of concept because these solutions are very expensive. Second, definitely keep involved with Sumo through the entire process, making them a partner throughout the process. Third, and this is the most critical one, definitely take time to size your environments correctly because once you sign those contracts, that is the size.

I rate this review an overall eight.