Sumo Logic Monitoring and Analytics Platform

What do you like best about the product?

SumoLogic processing events efficiently and quickly. The UI changes have generally been an improvement. The organization is better. Recent Mobot changes have been a noticeable upgrade in capability. Mobot has saved me significant time in understanding events even identify activity that I'm not sure I would have noticed. The support team is excellent and readily available. They have acted as a true partner, contributing to operation of Sumo and not just supporting through one question at a time.

What do you dislike about the product?

Collectors can not be marked as inactive. A collector will show green for healthy but that can be misleading. A collector should have an active/inactive indicator to mark those sources either not configured or no longer in use. Mobot usage is limited as it is still in beta. Instructions can not be applied to Mobot and there are capabilities it does not have, e.g. it can not update a monitor.

What problems is the product solving and how is that benefiting you?

My company uses a number of firewalls, Sumo is able to identify the firewalls in use across the business units. We implemented a number of traffic blocks for sanctioned countries, Sumo is able to track and report on anonymous activity with those countries. Resulting in Incidents for concerning behavior to be further investigated.

What do you like best about the product?

Cloud-native, no infrastructure to manage: There are no servers to maintain, and it scales with log volume.
Powerful search and query language: You can parse, filter, and aggregate logs quickly, and saved searches and dashboards make recurring analysis easy.
Unified logs, metrics, and traces: One platform covers observability and security monitoring.
Built-in security analytics: Its cloud SIEM features and pre-built apps for AWS, Kubernetes, and others speed up setup.
Real-time alerting: Alerts and dashboards help teams catch issues early and cut troubleshooting time.
Integrations: It connects with most major cloud services and DevOps tools.

What do you dislike about the product?

Cost: Pricing can climb quickly as log volume grows, and many users find it hard to predict or control spend.
Learning curve: The query language is powerful but takes time to learn, especially for complex parsing and aggregation.
Performance on large searches: Queries over big time ranges or huge data sets can be slow.
Dashboard and UI limitations: Some users find customization less flexible than competitors, and the interface can feel cluttered as features expand.
Alert tuning: Setting up alerts that are accurate without being noisy takes effort.
Support and documentation: Experiences vary, and some users say complex issues take a while to resolve.
Feature sprawl: Because the platform covers logs, metrics, traces, and SIEM, some capabilities feel less mature than specialized tools.

What problems is the product solving and how is that benefiting you?

Scattered logs: Applications, servers, and cloud services each produce their own logs. Sumo Logic centralizes them in one searchable place.
Slow troubleshooting: Instead of logging into individual systems, teams can search across everything at once to find the root cause of an outage or error.
Security visibility: It helps detect threats and suspicious activity by correlating events across systems, and it supports compliance reporting.
Monitoring blind spots: Dashboards and alerts surface performance problems before users notice them.
Scaling overhead: Being cloud-hosted, teams don't have to run or scale their own logging infrastructure.

What do you like best about the product?

I really appreciate how fast the search is across a lot of data, and the saved searches are a huge benefit because I often reuse the same queries instead of rebuilding them. Writing and tuning detection rules is pretty straightforward, which makes things easier for us. The support from Sumo Logic has been great since we started using them. The dashboards are very helpful as I can build a specific view around a detection or system and share it with other teams, saving time on having to teach the query language. This setup facilitates better collaboration, as security and operations can look at the same information during an investigation and get to a resolution faster. The initial setup of Sumo Logic was pretty easy, especially with the help we got from their team. It's been overall a great tool, and I consider Sumo Logic our main source of truth.

What do you dislike about the product?

My one gripe is cost. The pricing is tied to how much you ingest so the bill scales with log volume. We've had to make some tough calls about what to send based on budget based on what we actually want visibility into.

What problems is the product solving and how is that benefiting you?

Sumo Logic allows us to investigate security alerts from one spot, making it easy to write detection rules and search across logs quickly. It reduces the need for switching between tools and facilitates sharing views with other teams, enhancing investigation speed.

What do you like best about the product?

I like the customer service Sumo Logic offers through our representative, Greg Jerry, who is always ready to help with any issues and is proactive in providing tailored solutions. The reliability of the data logging is also impressive, ensuring we get accurate and deep data queries. Additionally, I find the interface to be user-friendly and easy to navigate, which doesn't require much extra exposure to get used to. It's simple and straightforward to use, making it a convenient tool for our needs. I also appreciate the new mobile features, which aid in investigations and correlating previously triggered signals. Integrating Sumo Logic with our single sign-on system was pretty straightforward, aided by Okta, and it enhances our capability to run logic seamlessly.

What do you dislike about the product?

Sometimes the time it takes for a query to execute can be slow, especially when dealing with large queries. However, this may not be entirely a Sumo Logic issue and could relate to how old the data is or how it's stored. It's understandable that larger queries take longer, but it's still something that occasionally impacts my experience.

What problems is the product solving and how is that benefiting you?

Sumo Logic helps us investigate security alerts by screening log systems for insights and details, supporting our security incident investigations effectively.

What do you like best about the product?

I use Sumo Logic to look at all the logs of our services and to dive into the response times and health of our systems. I appreciate being able to see the performance of our services at any time, helping to manage system uptime and errors. It's also very helpful when a customer has an issue because I can search logs to understand exactly what they have done. I really like the new AI connectors that assist in writing new queries, as they help me explore deeper without needing extensive knowledge of all the Sumo Logic query standards. I spend most of my time using the search, SLOs, and dashboards within Sumo Logic. The initial setup was very easy with lots of assistance and good training provided.

What do you dislike about the product?

I think my dislike in the past has been about the fact that we can only store xx number of months data due to price. Also early day internal AI wasn't as evolved as I thought it might be. This has got better over time.

What problems is the product solving and how is that benefiting you?

I use Sumo Logic to monitor our services' logs, response times, and health. It ensures uptime, helps manage errors, and allows me to track customer issues effectively.

What do you like best about the product?

I really appreciate how Sumo Logic correlates incidents from different platforms into insightful signals, giving analysts a comprehensive view for incident investigation, especially on the SIEM side. Its strongest feature for me is the integration, particularly with the MCP server and the SOC analyst agent, which embeds smoothly into our workflow to provide new insights and correlated activities. I also like the detection engineering and rule set fine-tuning capabilities with MCP integration. The cloud-first model makes setup easy, with minimal maintenance since there's nothing on-premise. The fact that everything ultimately got delivered, like custom parsers, is definitely a plus.

What do you dislike about the product?

I think the biggest area where Sumo Logic could improve is its out-of-the-box rules and SIEM capabilities. They seem to need a significant update to keep up with the current landscape, especially with the rise of AI. The rule sets are still quite basic, and it would be great if there was a way for AI to analyze our large datasets to find attack patterns and create customized rules tailored to our needs. Additionally, the recent UI changes from a non-tab to a tab version, with tabs inside tabs, is quite messy. I would prefer if Sumo Logic stuck to a consistent design rather than trying to cater to everyone.

What problems is the product solving and how is that benefiting you?

Sumo Logic correlates incidents, providing comprehensive insights for incident investigation. Its integration enhances workflow and enables detection engineering, while the cloud-first model eases maintenance and setup.

What do you like best about the product?

Many of the applications that we use is supported by Sumo

What do you dislike about the product?

The lengthy and complicated search scripts

What problems is the product solving and how is that benefiting you?

Being able to monitor products, servers and applications that my team would otherwise not be able to do so.

What do you like best about the product?

Setting up data collections and reading the logs is pretty intuitive. So is the UI

What do you dislike about the product?

It's very robust, so I am still learning everything it can do.

What problems is the product solving and how is that benefiting you?

Alert investigation and logging.

What do you like best about the product?

The pro serve, sales, team, and support team is by far the best I've worked with no matter what the vendor is. Their tool is phenomenal, but the people we work with are also fantastic.

What do you dislike about the product?

I don't have anything I can think of at this time. Everything has been great.

What problems is the product solving and how is that benefiting you?

Sumo Logic's performance, integrations to our current tooling, and ease of use programmatically and UI-wise have been great. I try to think of things that can't be done within our stack at this time and I can't think of anything.

What do you like best about the product?

Easy of use, integration with AI and look and feel of the UI

What do you dislike about the product?

It takes a while for the page to load and usually there is a delay in the logs of about 20-30 secs.

What problems is the product solving and how is that benefiting you?

We use it for logs and debugging issues in our application.