--- title: "Resolve incidents faster with AI-driven investigations, Claude monitoring, and query macros" page_name: "Resolve incidents faster with AI-driven investigations, Claude monitoring, and query macros" type: "blog" slug: "resolve-incidents-faster-log-analytics-updates" published_at: "2026-07-09" modified_at: "2026-07-09" url: "https://www.sumologic.com/blog/resolve-incidents-faster-log-analytics-updates" canonical: "https://www.sumologic.com/blog/resolve-incidents-faster-log-analytics-updates" markdown_url: "https://www.sumologic.com/blog/resolve-incidents-faster-log-analytics-updates.md" lang: "en" excerpt: "Sumo Logic Log Analytics now runs multi-step AI investigations with Mobot, lets you browse metrics without writing a query, and adds reusable query macros, Claude API monitoring, and Windows OTel collector management." taxonomy_blog_category: - "AI" - "SecOps & Security" --- [ All blogs ](https://www.sumologic.com/blog "blog")[AI](https://www.sumologic.com/blog/ai), [SecOps & Security](https://www.sumologic.com/blog/secops-security) # Resolve incidents faster with AI-driven investigations, Claude monitoring, and query macros [Michelle Beastall](#blog-author-block-376) July 9, 2026 4 min read [AI](https://www.sumologic.com/blog/ai), [SecOps & Security](https://www.sumologic.com/blog/secops-security) ##### Table of contents [Sumo Logic’s Log Analytics](https://www.sumologic.com/guides/log-analytics) is built so that [DevOps](https://www.sumologic.com/glossary/devops), SRE, and ITOps teams can focus on the actual work of keeping systems running, not on managing infrastructure or wrestling with query syntax. With continuous releases, the team has shipped a meaningful set of updates over the past several months. Here’s a look at what matters most for practitioners. ## AI investigation: Meet your new log analysis partner Investigations are rarely a single question, they’re a chain of them. You spot a symptom, pull a log, find a clue, pivot to another data source, and repeat. That process requires context, pattern recognition, and time that most teams don’t have when an incident is live. [Mobot, Sumo Logic’s conversational AI assistant](https://www.sumologic.com/blog/mobot-your-log-analysis-partner) within the [Dojo AI](https://www.sumologic.com/solutions/dojo-ai) platform, has evolved from a query tool into a full investigation partner. It now drives multi-step investigations autonomously by inferring the right data sources, reasoning across disparate logs, and surfacing a complete causal chain with suggested next steps. Instead of answering one question at a time, Mobot works through the investigation with you, so your team reaches the root cause faster and with less manual pivoting. **Note:** Mobot’s investigation capabilities are currently in public preview. Reach out to your account team to request access. ## Explore your metrics without running a single query When something breaks, the first instinct is to search, but if you don’t know exactly which metric to query or how it’s structured, you end up running speculative searches, getting nothing, adjusting, and trying again. That cycle burns time and adds unnecessary scan costs before you’ve even started diagnosing. Metrics browser eliminates the guesswork. It’s an interactive, searchable catalog of every metric, dimension, and dimension value available in your environment. Browse by metric name, explore associated dimensions and values, and drop the metric directly into a query, all without running a single exploratory search first. The result is faster root cause analysis and lower data consumption costs. ## Get visibility into Claude AI tools are becoming part of the production stack, and that means they need to be monitored like any other production system. But most teams lack the visibility to answer basic questions: Is the API healthy? Are requests succeeding? Where are latency spikes coming from, and are we staying within usage limits? The new [Claude Compliance API App](https://www.sumologic.com/app-catalog/claude) gives DevOps and SRE teams pre-built dashboards to monitor Claude API usage across your organization. It tracks request volume, error rates, latency, and compliance-relevant usage patterns. The [ChatGPT App](https://www.sumologic.com/help/docs/integrations/saas-cloud/chatgpt-compliance/) covers the same ground for OpenAI’s tools. It uses detailed metadata, content insights, and audit trails to surface interaction patterns and flag data-sharing behavior that violates policy, so your team can catch compliance risks before they become reportable incidents. Together, the two apps close the visibility gap on the AI tools employees actually use. If Claude and ChatGPT are part of your stack, you now have the same operational and compliance visibility over them that you’d expect from any other production service. ## Write query logic once, use it everywhere Most teams maintain the same filtering logic across dozens of dashboards, saved searches, and alerts – environment tags, service identifiers, error patterns. When that logic needs to change, someone has to hunt down every instance and update it manually. And with manual hunting, something always gets missed. The new macro operator lets you define reusable query logic once and reference it everywhere. Change the macro in one place, and every dashboard, alert, and search that references it updates automatically. No drift, no missed copies, no manual reconciliation. ## Manage collectors from the UI, no server access required For teams running OTel Collectors on Windows, routine configuration changes previously required direct server access. That meant either having the right credentials on hand or opening a ticket and waiting, neither of which works well during an active incident. Windows is now fully supported for remote OTel Collector management alongside Ansible, Chef, and Puppet. [Configuration changes can be made directly from the Sumo Logic UI](https://www.sumologic.com/help/release-notes-collector/2025/12/31/#december-03-2025-opentelemetry-collector), with no server access required. ## Simplify migration from Installed Collectors to OpenTelemetry Migrating from Installed Collectors to OpenTelemetry has historically been a high-effort, error-prone process. You have to rebuild source configurations by hand, with no guardrails to catch mistakes along the way. A new guided, in-platform workflow now converts existing Installed Collector sources into OpenTelemetry Source Templates step by step. It reduces manual setup, catches common misconfiguration, and dramatically cuts the time a migration like this used to require. ## Spot what needs attention on your dashboards instantly In a war room or a live postmortem, nobody has time to read every number in a dense operational table. But that’s exactly what teams were forced to do to spot the outlier that mattered. Conditional Thresholds lets you apply color rules to rows and cells in table charts based on threshold values. Critical values surface immediately so your team sees what needs attention the moment the dashboard loads. ## See all your collectors in one place In environments with multiple orgs or large deployments, getting a health snapshot of your collector fleet has meant logging into each org individually. There’s been no single view of what’s running, what’s degraded, or what needs attention across your deployment. The new Collection Overview page provides a unified view of all installed, hosted, and OTel collectors across child orgs, including health status, deployment state, and drill-down access, in one place. ## Stay ahead of system limits before they impact operations Credit usage for Lookup Tables, Partitions, Fields and Field Extraction Rules have a way of being discovered at the worst possible time, usually when something in production is broken. Now, a health event triggers automatically when usage reaches 90% of any of these limits. Set up a scheduled search to alert your team by email so you have the runway to act before a limit causes an outage, not after. ## Start exploring All features listed above are generally available unless otherwise noted. Review the full [What’s New page](https://www.sumologic.com/platform/whats-new) for release details, or reach out to your account team for a walkthrough. ### Article Tags - [AI](https://www.sumologic.com/blog/ai) - [SecOps & Security](https://www.sumologic.com/blog/secops-security) Michelle Beastall Senior Product Marketing Manager Michelle Beastall is a Senior Product Marketing Manager at Sumo Logic, where she brings cybersecurity and SaaS products to life through clear, compelling messaging. With 15+ years in marketing roles and extensive experience spanning both established companies and startups, she has a passion for translating complex technology into stories that help businesses cut through the noise and make confident decisions. [](https://www.sumologic.com/feed "RSS Feed")[](https://twitter.com/intent/tweet?text=Resolve%20incidents%20faster%20with%20AI-driven%20investigations%2C%20Claude%20monitoring%2C%20and%20query%20macros&url=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fresolve-incidents-faster-log-analytics-updates "X")[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fresolve-incidents-faster-log-analytics-updates "Facebook")[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fresolve-incidents-faster-log-analytics-updates "Linkedin") [Previous blog NIST SP 800-53: what auditors actually want from your logs](https://www.sumologic.com/blog/nist-800-53-audit-readiness)[Next blog LLM Observability: Using AI to monitor systems and AI usage](https://www.sumologic.com/blog/llm-observability-monitor-ai) People who read this also enjoyed [ The logs you need to investigate a phishing incident July 2, 2026 ](https://www.sumologic.com/blog/ai-phishing-logs-you-need)[ AI across the security lifecycle June 18, 2026 ](https://www.sumologic.com/blog/ai-across-security-lifecycle)[ Balance AI innovation and governance with Sumo Logic AI and ML apps June 10, 2026 ](https://www.sumologic.com/blog/sumo-logic-ai-ml-apps-governance)[ Meet the new Mobot: Your log analysis partner May 21, 2026 ](https://www.sumologic.com/blog/mobot-your-log-analysis-partner) [AI Instructions](https://www.sumologic.com/ai-instructions.md)