What is generative AI?
Generative AI refers to artificial intelligence systems, most often built on large language models (LLMs), that create new content rather than simply classifying or predicting from existing data. Instead of just labeling an email as spam or flagging an anomaly, a generative AI system can write a summary, draft code, translate a natural language question into a database query, or hold a conversation.
Key takeaways
- Generative AI creates new content, text, summaries, code, or queries, rather than only classifying or predicting from existing data.
- Generative AI creates content, while agentic AI reasons, plans, and takes action, often using generative AI as one of its components.
- In log analytics and security operations, generative AI commonly shows up as alert summarization, natural language to query translation, and conversational documentation search.
How does generative AI work?
Most generative AI systems in production today are built on large language models: neural networks trained on enormous amounts of text so they can predict and generate coherent language, code, or other structured output. When you give one of these models a prompt, whether that’s a question, a log excerpt, or a request to write a query, it generates a response based on patterns learned during training, not by looking up a stored answer.
This is what separates generative AI from more traditional machine learning. A traditional ML model trained to detect anomalies in log data outputs a normal or anomalous classification. A generative model can take that same anomaly and produce a plain-language explanation of what happened, why it’s suspicious, and what to do next.
Generative AI vs. agentic AI vs. traditional machine learning
These three terms get used interchangeably, but they describe different things:
- Traditional machine learning detects patterns and makes predictions from data.
- Generative AI creates new content from a prompt, such as a summary, an explanation, a query, or a draft response.
- Agentic AI goes a step further than either one. It reasons about a situation, plans a sequence of steps, and can take or recommend actions, often using a generative AI model as the reasoning engine underneath.
In practice, these build on each other. Traditional ML might detect that something unusual happened. Generative AI can turn that detection into a readable narrative. Agentic AI can take that narrative, reason about what it means, and propose or execute a response.
Generative AI in log analytics and security operations
In log analytics and SecOps specifically, generative AI turns a stream of fragmented alerts into a coherent incident narrative, translating a plain-language investigative question into the exact query syntax needed to search across large volumes of log data, and answering how-to questions about a platform using existing documentation instead of a static search index.
Each of these tasks used to require a human to either write complex query syntax by hand or manually correlate dozens of related alerts. Generative AI doesn’t replace that judgment, but it removes the mechanical work standing between a question and an answer.
Monitoring generative AI with LLM observability
As organizations adopt generative AI, they need visibility into how AI applications are being used, what prompts and responses are being generated, and how these systems perform over time. LLM observability helps teams monitor AI interactions, track usage patterns, evaluate model performance, and identify issues such as inaccurate responses, unexpected behavior, or security risks.
For security and operations teams, this visibility is critical for understanding how teams are using generative AI across the organization and ensuring AI-powered applications remain reliable, secure, and aligned with business needs.
Generative AI and Sumo Logic
Sumo Logic’s generative AI capabilities are part of Dojo AI, delivered through a conversational interface called Mobot and a set of specialized agents:
- The SOC Analyst Agent uses generative AI to condense the alerts and signals behind a SIEM Insight into a single, readable narrative that explains what triggered it and what it means.
- The Log Analysis Agent translates a natural language investigative question into precise, executable Sumo Logic query syntax without requiring the person asking to know the syntax.
- The Platform Optimization Agent answers product and setup questions using Sumo Logic’s own documentation, so the team gets a citable answer instead of adding to the support ticket queue.