Sumo Logic Security Solutions

Sumo Logic security solutions support the entire spectrum of security use cases, from security analytics to SIEM and SOAR:

• Logs for Security
  Provides enhanced insight into threat activity via logs. Collect security log and event data from your infrastructure and applications, on-premises and in-cloud. Analyze your security data with pre-built and custom dashboards, out-of-the-box security apps, and robust queries.
• Threat detection, investigation, and response
  After you have collected logs for security, you can use them with the following solutions for threat detection, investigation, and response:
  • Cloud SIEM
    Gives security operations center (SOC) analysts prioritized and contextualized actionable threats with automated security workflows. Out-of-the-box automated detection reduces manual work, saving valuable resource time and enabling your team to be more effective by allowing them to focus on higher-value security functions.
  • Cloud SOAR
    Fully automates triage, investigation, and remediation of threats for any security professional. The open integrations framework allows you to connect to a multitude of third-party applications. The platform provides full incident response lifecycle management with machine learning and threat hunting, accelerating mean time to respond (MTTR).

Sumo Logic Academy

Sumo Logic Academy offers free training courses covering these concepts that allow you to practice in a lab environment and level up your knowledge. Check out self-paced and free live instructor-led offerings today! (To access our self-paced courses, first sign in to our learning portal.)

• Self-paced: Security courses
• Instructor-led virtual classes:
  • Workshops: Essential Cloud SIEM Skills for SOC Analysts
  • Workshops: Automation Workshop
  • Certifications: Logs for Security
  • Certifications: Cloud SIEM

How do Sumo Logic's security solutions compare?

Following are features available with our security solutions. If you have any questions on availability or a free trial, you can reach out to your Sumo Logic account team.

Feature	Logs for Security	Cloud SIEM	Cloud SOAR
Log collection	✓	✓	✓
App catalog (out-of-the-box analytics)	✓	✓	✓
Dashboard	✓	✓	✓
Deep search (Sumo Logic Search Query Language)	✓	✓	✓
Advanced analytics with machine learning (Global Intelligence Service)	✓	✓	✓
Monitoring	✓	✓	✓
Alerts	✓	✓	✓
Threat Intelligence (threat intel feed and threat analysis app)	✓	✓	✓
Normalization with parsing of unstructured data and Field Extraction Rules	✓	✓	✓
Normalization with parsing, mapping, and enrichment		✓
Streaming processing		✓
Out-of-the-box detection contents		✓
Advanced analytics for user behavior		✓
Rules Engine (built-in, types, custom, criticality, Rule Expression tuning)		✓
Correlation of Signals to an Entity		✓
Insight Engine (including case management)		✓
Entity Types (Entity Normalization, Related Entities, Entity Criticality)		✓
Entity Relationship Graph		✓
Entity Timeline		✓
Machine learning capabilities (Global Confidence Score for Insights, Insight Trainer)		✓
Tags (MITRE ATT&CK, custom tag schema, network blocks)		✓
Automation Service	✓	✓
Open Integration Framework (OIF)	✓	✓	✓
App Central	✓	✓	✓
Playbook	✓	✓	✓
SecOps dashboard			✓
Case Manager			✓
War Room			✓
Progressive automation			✓
Highly customizable dashboards and KPIs			✓
Automatic incident reports			✓

Additional resources

• Blogs:
  • Lessons from the 2025 Security Operations Insights report
  • Balancing act: Sumo Logic vs. Splunk in the high-wire world of modern security
• Demos:
  • Cloud SIEM: Complete threat detection, investigation and response demo
  • Cloud SIEM: Heads up display (HUD)
  • Cloud SIEM: Insight investigation
  • Cloud SIEM: Cloud insights triaging and investigation
  • Cloud SIEM: MITRE ATT&CK™ coverage explorer

FAQ

What security solutions does Sumo Logic offer?

Sumo Logic offers three security solutions that work together: Logs for Security for security analytics and log-based threat detection, Cloud SIEM for prioritized and contextualized threat investigation, and Cloud SOAR for automated incident triage, investigation, and remediation.

What's the difference between Cloud SIEM and Cloud SOAR?

Cloud SIEM focuses on the investigation phase, giving SOC analysts prioritized, contextualized threats with automated detection. Cloud SOAR focuses on the response phase, automating triage, investigation, and remediation through playbooks. You can use either solution independently or together.

Do I need Logs for Security before I can use Cloud SIEM or Cloud SOAR?

Yes. You collect logs for security first, then use that data with Cloud SIEM and Cloud SOAR for threat detection, investigation, and response.

Which Sumo Logic security solution should I use for automated incident response?

Use Cloud SOAR. It fully automates triage, investigation, and remediation with an open integrations framework and full incident response lifecycle management, accelerating mean time to respond (MTTR).

Does Sumo Logic offer out-of-the-box threat detection?

Yes. All three solutions, Logs for Security, Cloud SIEM, and Cloud SOAR, include a threat intelligence feed and threat analysis app. Cloud SIEM adds out-of-the-box detection content and a rules engine on top of that.