Out of the box applications were very useful for us. We also use the Threat Intelligence integration for our security monitoring.
Logging all operational and security events in our enterprise environment. We use Sumo Logic to monitor all the applications that we run in the Amazon AWS cloud; we use Sumo Logic to monitor the security posture of our AWS IaaS with CloudTrail, VPC flow, S3 audit, GuardDuty, and EKS services.
How has it helped my organization?
Sumo Logic is a single place to retrieve intelligence without worrying about architecture and performance.
What is most valuable?
The out of the box applications were very useful for us. We also use the Threat Intelligence integration for our security monitoring.
What needs improvement?
Automation is open to user's implementation, in my case, we used to use API to correlate and orchestrate events from Sumo Logic with other platforms, and now we are using an automation platform to centralize the various integrations.
For how long have I used the solution?
- Leave a Comment |
- Mark review as helpful
The dashboards are great. We use them for monitoring certain events.
We use it for ingestion of VPC flow logs, CloudTrail logs, and config logs from AWS.
How has it helped my organization?
We also use it to ingest Windows domain controller logs. We use this to monitor if anyone is placed in particular administration groups that potentially shouldn't be. It helps us keep track of people.
What is most valuable?
The dashboards are great. We use them for monitoring certain events when they happen to see if we want to act upon them. The monitoring pages and the alerting pages are also very handy.
What needs improvement?
If you want to up your subscription through the AWS Marketplace, it can be difficult. You can't just go back to the AWS Marketplace, and say, "I want a bigger one now." You have to contact the sales team, then they do it on the back-end. This could definitely be improved. If they could do something about this, it would be nice.
For how long have I used the solution?
One to three years.
What do I think about the stability of the solution?
It is very stable. I've never really seen it have bad performance issues. As long as you're using optimized queries, then it always performs very well.
What do I think about the scalability of the solution?
I don't think I have ever had a performance problem with it. The scalability is good.
We have multiple different customers who ingest different amounts based on their workloads and environments. We have ten customers with our biggest customer ingesting around 18G a day. Across all our customers, we might be ingesting around 50G a day.
How is customer service and technical support?
The support team at Sumo Logic is great. They have great people. They give good support when and if we need it.
How was the initial setup?
The integration and configuration of Sumo Logic into our AWS environment was easy and great.
What's my experience with pricing, setup cost, and licensing?
Purchasing the solution through the AWS Marketplace is very easy. We chose to go through the AWS Marketplace because it makes it a lot easier when we bill our customers. Rather than having to get multiple different sources of information then correlate a monthly bill for our customers, it is just included in the AWS usage charges. Thus, it's convenient.
The AWS Marketplace pricing is fairly reasonable for what it does. Compared to the other tools that do it as well, it's reasonable. I wouldn't call it expensive, but I wouldn't call it cheap. It is pretty good.
What other advice do I have?
We love the product and haven't had any bad experiences with it.
We integrated it with Windows Active Directory. With one of our customers, we integrated it with some security software. It was some antivirus platform. We worked with their security team to ingest some logs that they used at the time and queried the data that they ingested.
It integrates easily with other products. You just have to install the Collector. Then, as long as you know what the format of your logs are like, you can write your field extraction rules, and away you go. As long as you know what you're doing, and as long as you are familiar with the logs that you're ingesting, then it is easy.
We ultimately use it because we are a managed services partner of Amazon, and we need to do it for our ordering purposes. It's just something that we have to have to be able to look at our logs in a dated manner.
I would tell people to not get Sumo Logic if you are looking for a traditional monitoring software, because that was not the purpose it was written for. They should get it if they are looking for a log ingestion and aggregation system.
Very helpful tool
I've used Sumologic for over a year, and I've used it for a number of different projects and scopes of monitoring and alerting. It's flexible, powerful, and fairly easy to use. It has a learning curve for a beginner, as it has its own DSL for running queries. But their documentation and training is good, and what you get out of this is useful, so it's worth the small time investment around figuring out some of the queries you would need. At the least, the query syntax is easier than Kibana queries. With whatever tool you choose for insightful analysis of logs and metrics, you'll have to take the time to create queries and such, but at least sumologic provides a lot of common queries and dashboards right out of the box.
showing 1 - 3