Sumo Logic Cloud SOAR Release Notes

July release​

The following are the updates made in July 2026.

Manage Playbooks with Mobot​

Build, edit, explain, and validate Automation playbooks conversationally, directly from Mobot on any playbook details page.

• Create from scratch. Describe the playbook you want, and the agent plans the topology, confirms each node, and builds the complete graph.
• Edit incrementally. Add, remove, or update nodes and links with automatic version management and layout.
• Explain. Get a plain-language walkthrough of a playbook’s flow and logic.
• Validate. Identify structural errors, missing fields, and broken references before publishing.
• Discover integrations. Browse installed integrations and their available action schemas while building a playbook.

The playbook assistant asks for clarification when needed and always works with drafts, never published revisions.

Playbook pages UI revamp​

Alongside the new agent, the Playbook pages have also been refreshed:

• Redesigned details page. A refreshed header now includes playbook metadata and revision history.
• New filtering. Filter playbooks directly from the listing page.
• Permanent deletion. Permanently delete playbooks from the listing page.
• Consistent UI. Updated UI patterns to align with the rest of the Sumo Logic platform.

Integrations​

This section includes upgrades to the existing integrations.

• Atlassian Jira Cloud
• Atlassian Jira V2
• Azure AD
• CrowdStrike Falcon Intelligence. Implemented a schedule action in the CrowdStrike Falcon Intelligence integration.
• Sumo Logic Cloud (SIEM)
• VirusTotal V3

Automation Bridge​

The Automation Bridge now supports Red Hat Enterprise Linux (RHEL) 9 in addition to RHEL 8. See Hardware Requirements for details.

Bug Fixes​

Incidents​

Fixed intermittent internal service error in public API to add attachments to an incident.

June release​

The following are the updates made in June 2026.

Integrations​

This section includes new integrations and upgrades to existing ones.

• Google Cloud Armor. Added new integration for Google Cloud Armor.
• Google Cloud Composer. Added new integration for Google Cloud Composer.
• Google Cloud Run. Added new integration for Google Cloud Run.
• Google Cloud Service Mesh. Added new integration for Google Cloud Service Mesh.
• Google Compute Engine. Added new integration for Google Compute Engine.
• Google Kubernetes Engine. Added new integration for Google Kubernetes Engine.
• Slack. Updated the Send Message action in Slack to support the link preview configuration.
• 1Password. Modified the user field in 1Password header.
• Atlassian Jira V2. Added the new Search User action to search for Jira users by displaying the name, email address, or account ID in Atlassian Jira V2 integration.

May release​

The following are the updates made in May 2026.

Integrations​

This section includes new integrations and upgrades to existing ones.

• Azure AD. Added the Reset User MFA action. Learn more.
• Delinea Secret Server. Added new integration for Delinea Secret Server. Learn more.

Platform​

Updated the UI design of checkbox and switch components to ensure consistency across the platform.

Bug Fixes​

Integrations​

• Azure AD. Resolved an issue in the Reset User Password and Remove Member From Group actions that caused errors while processing responses. Learn more.
• Microsoft Defender ATP. Fixed the List Machine Actions issue where the machine name filter was not applied correctly. Learn more.

Playbooks​

• Fixed an issue where the node side drawer in the Playbook Result Graph View would close unexpectedly.
• Resolved a UI issue where the Playbook Enable/Disable icon was slightly overlapping on the listing page.
• Fixed inconsistent behavior in Playbook import and export operations.

April release​

The following are the updates made in April 2026.

Integrations​

This section includes new integrations and upgrades to existing ones.

• We are excited to introduce the new ZeroFox V2 integration. Learn more.
• Upgraded integrations from the python3_generic Docker image (Python 3.8) to python3_12_generic (Python 3.12) to address Python 3.8 end-of-life while improving security and performance.

Platform​

Updated toast notifications, tooltips, and button components in both UI design and behavior to ensure consistency with the platform.

Triage​

• Improved the performance of the Get Triage Event Details Public API. Learn more.

Playbooks​

• Improved the performance of the task approve/close APIs.

Incidents​

• Added a new UI option to view or copy the Incident Label ID directly from the interface for improved accessibility and usability.

Bug Fixes​

• Fixed an issue where the No Result state briefly remained visible after clicking Reset Search on listing pages before the updated results were rendered correctly.
• Added character limits for Playbook titles, node titles, and other modules to maintain UI consistency and prevent layout issues caused by excessively long names.

Playbooks​

• Optimized the Playbook Executions list view to improve performance when handling large volumes of action results.

March release​

Following are the updates made in March 2026.

Changes and enhancements​

New integrations​

We are excited to introduce new integrations for the following services:

• 1Password
• Sumo Logic Cloud Monitor
• Sumo Logic Lookup Table
• Sumo Logic Rules Tuning
• Upwind

Enhancements​

Upgraded the python3_generic (Python 3.8) Docker image to python3_12_generic (Python 3.12) across the following integrations to address Python 3.8 end-of-life and enhance security and performance:

• Abuse.ch SSLBL Feed
• AbuseIPDB
• Airtable
• Atlassian Jira Cloud
• Atlassian Jira V2
• Atlassian Opsgenie
• Censys V3
• Cloudflare
• CrowdStrike Falcon
• CrowdStrike Falcon Discover
• CrowdStrike Falcon Intelligence
• CrowdStrike Falcon Sandbox
• Microsoft OneDrive
• ThreatConnect V3
• URLScan.io

Platform​

• Reduced initial page load times to improve the performance of Cloud SOAR and Automation pages.
• Introduced a redesigned delete confirmation modal with clearer messaging to help prevent accidental deletions across playbooks, playbook executions, incident templates, integrations, rules, and the Automation Bridge.
• Enhanced “no results” states on listing pages by adding a Clear Filters option when no results are found.
• Updated search behavior on listing pages (such as the Playbooks page) to exclude deleted records unless the Deleted filter is explicitly applied.

Bug Fixes​

General​

• Fixed the search URL to display the entered search text instead of encoded suggestion metadata.

Integrations​

• Incident Tools. Set the default start time to the current time when it is not specified in the Create Incident From Template action. Learn more.
• Microsoft Azure Security Center. Updated the integration to use Microsoft’s recommended app-only authentication. Learn more.

Playbooks​

• Fixed an issue that prevented playbook paths from appearing in App Central playbook previews.

February release​

Following are the updates made in February 2026.

Changes and enhancements​

Integrations​

• [Added] Sumo Logic Automation Tools - Added "Count Occurrence Of Value" action to count the occurrence of a specified value in texts.
• [Updated] ThreatConnect V3 - Added observations parameter to the Update Intelligence action to enable recording observation counts for indicators.
• [Updated] Atlassian Opsgenie - Added a retry mechanism to the Create Alert action of Atlassian Opsgenie.
• [Updated] Microsoft SharePoint (Graph) - Improved the Folder Relative URL hint to provide clearer guidance on entering the correct relative path format.

Platform​

• Improved the sorting UX experience on all tables in Cloud SOAR and the Automation Service to align with other Sumo Logic modules.
• Deleted records will no longer be fetched during table searches unless the Deleted filter is applied.

Bug Fixes​

Fixed an issue where query filters were being applied incorrectly during search.

Playbooks​

Fixed issues while selecting variables containing the period character in textarea fields and test node input.

January release​

Following are the updates made in January, 2026.

Changes and enhancements​

Automation Bridge​

We're delighted to announce Automation Bridge version 3.3.0, which:

• Ensures stability while scaling.
• Improves observability into bridge instances reducing dependence on customer logs for debugging common issues.

Playbooks​

• Added a Playbook Executions page that lets you monitor the outcome of playbook runs.
• Implemented a confirmation prompt when terminating a playbook on the incidents and Automation Services pages to prevent accidental terminations.

Integrations​

Added an explicit button for testing Integration actions upon hovering over the action, making it easier for users to discover the test action functionality.

Bug fixes​

Playbooks​

• Fixed an issue where the child playbook execution status was displayed incorrectly in the detail view.
• Resolved issue where clicking the task node title in playbook execution resulted in a 404 error.
• Fixed the issue where newly created playbooks did not immediately appear in the UI.

New feature: Playbook Executions​

We are excited to announce that you can now monitor the outcome of playbook runs on the new Playbook Executions screen. The screen shows both currently running and completed playbook executions, with clear status and timestamps. The screen makes it easier to monitor automation health and troubleshoot playbook issues. Learn more.

December release​

Following are the updates made in December, 2025.

Changes and enhancements​

Integrations​

Added a new integration for Google Identity Platform.

Platform​

Added new public APIs:

• Add playbooks to an incident.
• Retrieve all playbooks attached to a specific incident.
• List all playbooks with their metadata.

Learn more.

Bug Fixes​

Playbooks​

Fixed an issue where results and errors were not displaying for containment type actions in the list view.

Integrations​

• In the Microsoft EWS (Graph) integration, removed the default values for the has_attachments and un_read fields in the Search Emails Extended action. The change allows users to search for emails without being forced to filter by attachment status or read/unread status.
• In the Freshservice integration, the Create Ticket and Update Ticket actions now support an optional Workspace ID. Also updated existing custom ticket fields.

This is an archive of 2025 Cloud SOAR release notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.

This is an archive of 2024 Cloud SOAR release notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.

This is an archive of 2023 Cloud SOAR release notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.