Sumo Logic Service Release Notes

This release includes enhancements to automation service integrations, apps, and Cloud-to-Cloud (C2C) sources, with new actions, improved functionality, updated dashboards, and expanded data support.

Automation service integrations enhancements​

• ZeroFox V2. Added new CTI enrichment actions and improved existing actions.
• CrowdStrike Falcon. Expanded the integration with new Case Management actions and deprecated legacy Incident actions.
• Atlassian Jira Cloud.
  • Improved Jira Cloud issue creation and updates for multiline/HTML descriptions and due-date inputs.
  • Added custom priority support to the Jira Cloud integration used by Cloud SOAR playbooks.
• Atlassian Jira V2. Added custom priority support to the Atlassian Jira V2 integrations used by Cloud SOAR playbooks.
• ThreatConnect V3. Added tag modes to the Update Indicators action and fixed a bug in the Search Intelligence action.

App enhancements​

• Flex (v1.0.5). Updated monitor conditions for better alert notifications.
• GitHub Copilot (v1.0.1). Updated dashboards to reflect the new data schema and added user metrics dashboards.

C2C source enhancements​

• Claude Compliance (v2.0.6). Updated data format of local session messages.
• GitHub Copilot (v2.0.0). Migrated legacy endpoints and integrated support for user metrics.

We're excited to introduce the Manage Features capability for all paid customers. With this, you can opt in or opt out of specific Sumo Logic features for your organization directly from the Organizations UI without needing to raise a request with Sumo Logic support. Learn more.

Effective October 29, 2026, newly created standalone Sumo Logic accounts default to the Sumo Logic UI and no longer have the option to switch to the Classic UI. Parent organizations, their child organizations, and existing accounts are not affected and keep their current UI settings for now.

• New accounts default to the Sumo Logic UI. Standalone accounts created through self-service signup or partner provisioning no longer have the option to switch to the Classic UI.
• Other accounts are unaffected. Existing customers, parent organizations, and their child organizations keep their current UI settings at this stage.
• No data migration needed. Your data carries over automatically between the Classic UI and the New UI.
• Classic UI continues winding down. The Classic UI will eventually be retired for all accounts. We'll share the exact date as it's confirmed.

Learn more about the Sumo Logic UI, or see the Classic UI documentation if your account still has access to it.

In-app tabs now support Dashboards and Metrics in the New UI, in addition to Log Search. You can keep Log Search, Dashboard, and Metrics tabs open together in a single browser window and switch between them without losing context. This makes it easier to move between investigating logs, reviewing dashboards, and exploring metrics without opening extra browser tabs. In-app tabs are available if you have enabled the Enable in-app tabs preference. Learn more.

Metrics transformation rules now offer updated retention options. Retention for matching metrics is Do Not Store or 400 days, and aggregate retention for aggregated metrics is standardized to 400 days. Rules that already use 15-day retention get migrated to 400 days. Learn more.

The Sumo Logic app for Google Workspace Activities collects audit events from the Google Admin SDK Reports API to help monitor user and administrator activity across your Google Workspace environment. Explore predefined dashboards for productivity services, including Gmail, Drive, Calendar, Meet, and Gemini, as well as security, identity, and administration activities. Learn more.

The new Sumo Logic source for Google Workspace Activities, enabling seamless collection of Google Workspace activity data. This source helps you monitor user activities and analyze events for improved visibility and security. Learn more.

Dynamic timeslice drilldown for dashboard log panels. When you click and drag to zoom into a time range, Sumo Logic now automatically recalculates the query's timeslice and re-fetches the panel at that finer resolution, so you can drill into spikes and anomalies without editing the underlying query.

Learn more.

Two ways to run a search in the background, so you do not have to keep the Search page open while you wait. If a log search's elapsed time exceeds about a minute, a banner prompts you to click Run in Background, and you'll receive an email notification with a link to the results as soon as it completes. For searches that finish in under a minute, click the three-dot kebab icon and select Run in Background (Pin) to pin it yourself, no email needed since the search is already done. Learn more.

The new Sumo Logic source for OpenAI, enabling seamless collection of organization usage costs and audit logs to monitor API spending, user activity, project changes, and API key administration. Learn more.

V6 of the Sumo Logic Kubernetes Helm chart, which enables sourceless mode and metrics pipeline unification by default. Sourceless mode removes the Hosted Collector dependency, and a single metrics pipeline means fewer pods, lower latency, and simpler configuration. Learn more.

The new Sumo Logic app for OpenAI. This app provides visibility into your OpenAI organization's cost, usage, security, and audit activity. Pre-built dashboards help you monitor API spend by model and project, track authentication events and failed login patterns, analyze identity and access management changes, and surface geographic and threat intelligence insights. Learn more.

The ability to scope scan budgets to specific request sources, such as Search API, AI Search (MCP), or Mobot, and manage the Stop all scans action fully from the UI. Learn more.

Sumo Logic will enforce stricter validation for AND/OR Boolean expressions in search queries. Previously, Sumo Logic relied on proper user queries. The system accepted user queries with incomplete Boolean syntax, such as:

| where user_username = "root" and success
| where ip matches "192.*" or "1.*"

In the above examples, success and 1.* are not valid Boolean expressions on their own. These queries produced unexpected results because the system silently skipped the invalid expressions during evaluation. However, the user’s incomplete entry was not disclosed as faulty.

What's changing​

Sumo Logic now proactively validates that both sides of an AND or OR operator are valid Boolean expressions. Queries with invalid Boolean syntax will return a validation error when you create or update content such as monitors, scheduled searches, and scheduled views. This helps you identify and correct incomplete queries before saving them.

To fix affected queries, ensure each operand in an AND/OR expression is a complete Boolean expression. For example:

| where user_username = "root" and success = true
| where ip matches "192.*" or ip matches "1.*"

For more information, contact your account team.

Automation service integrations​

New release​

The release of the following Automation Service Integrations:

• AWS DynamoDB
• Intel 471 Verity
• Mimecast V2

Enhancements​

• 1Password. Migrated to 1Password v1 APIs, improved integration stability, and added filtering support to the List Users action.
• AWS CloudWatchLogs. Added new metric actions: Get Metric Data, List Metrics, and Get Metric Statistics.
• Azure AD.
  • Added Delegated (Device Code Flow) authentication support alongside existing Application (Client Credentials) auth.
  • Added new actions (Delegated auth only): Initiate Delegated Auth, Exchange Device Code, and Reset User Password With Writeback.
  • Added new integration resource fields: Authentication Type, Delegated Refresh Token.
• CrowdStrike Falcon Sandbox. Added OAuth 2.0 (Client Credentials) authentication support and new Check Submission Status action.
• Microsoft Graph Security.
  • Migrated Get Alert, Search Alerts, and Update Alert actions to the new Microsoft Graph Security alerts_v2 API. The legacy /security/alerts endpoint is deprecated and will be retired on October 15, 2026.
  • Legacy actions Search Into Alerts and Update Security Alert are retained for backward compatibility, as the alerts_v2 API is not a one-to-one replacement for the legacy API and some alerts may be unavailable through the new endpoint.
• Sumo Logic Cloud SIEM. Added new actions: Get Insight Triage and Check Insight Triage Schedule.

App enhancements​

• LiteLLM v1.0.2. Updated the app to handle better index filter handling.
• Claude Compliance v2.0.5. Added support for a new local session endpoint and updated the chat endpoint for cost optimization.

The new Sumo Logic app for Amazon Security Lake. This app provides unified visibility into AWS security activity across accounts and regions using OCSF-normalized events. Pre-built dashboards help security teams monitor network, identity, application, and host activity to detect threats, investigate anomalies, and assess their AWS security posture. Learn more.

Mobot can now answer natural-language questions about your Sumo Logic ingest volume. The Data Volume skill is part of Mobot's Platform Optimization Agent and is available to all users with no separate opt-in required. Admins can use it to identify noisy sources and explain month-over-month fluctuations, and finance teams can use it to attribute spend, reconcile credits, and forecast renewals.

Ask questions like What are my top 10 source categories by daily ingest volume? or How much data went to the Infrequent tier last month? and Mobot queries the Data Volume Index and returns a structured answer in the unit and breakdown you asked for — no manual query writing or support ticket required. Learn more.

You can now migrate your existing AWS Observability Solution deployment from v2.x to v3.0.0 using new step-by-step guides. Whether you deploy with AWS CloudFormation or Terraform, and whether you prefer a manual walkthrough or an automation script, there's a documented path to get your stack onto the latest version.

What's new​

• Migration guide for CloudFormation deployments, with both a manual, step-by-step path and an automated script option.
• Migration guide for Terraform deployments.
• New v3.0.0 deployment documentation, published alongside the existing v2.15.0 docs so you can reference either version depending on which release you're running.

Learn more.

AWSO v3.0.0 with the following enhancements:

• Complete rewrite of the AWSO solution.
• Expanded AWS region support, including non-SAM regions and newly supported regions: Asia Pacific (Melbourne), Asia Pacific (New Zealand), and Europe (Zurich).
• Support for AWS regions launched after August 2022, with the appropriate Load Balancer policies configured automatically.
• Terraform Module support for solution deployment, including release versioning.
• Next-generation application support with out-of-the-box dashboards, monitors, FERs, and metric rules.

Learn more.

The Search Job Management API is now fully OpenAPI-compliant and no longer relies on session cookies, so you can run search jobs across complex environments and AI frameworks with zero cookie-management overhead. It also adds parent-child org support for multi-tenant automation.

What's new​

• OpenAPI compliance. A standardized schema lets you auto-generate SDKs in any language and integrate natively with Postman and CI/CD pipelines.
• Stateless architecture. The Search Job Management API no longer uses session cookies. Each request is addressed by the search job's jobId, so scripts don't need to store or send cookies.
• AI and MCP readiness. Long-running search jobs can be polled without session cookies, which suits AI agents and Model Context Protocol (MCP) frameworks. See the Sumo Logic MCP Server for details on connecting AI tools to Sumo Logic.
• Optimized Execution Defaults. Queries are now more performant and efficient, with reduced data transfer and better compatibility with other internal optimizations.
• Parent-child org support (MSSP). MSSPs and enterprise admins can now automate parent-child and cross-org searches via the API, which were previously only available through the UI.

For more information, see Search Job Management API.

Global Intelligence AWS apps - Deprecating in the coming weeks​

The following Global Intelligence Service apps will be deprecated and removed from the App Catalog:

• Global Intelligence for Amazon GuardDuty
• Global Intelligence for AWS CloudTrail DevOps
• Global Intelligence for AWS CloudTrail SecOps

Additionally, Global Intelligence for AWS CloudTrail DevOps will also be removed from the AWS Observability Solution.

Opsgenie - Deprecating April 5, 2027​

The following Opsgenie-related services will be deprecated on April 5, 2027:

• Opsgenie App. Removed from the App Catalog and no longer available as a standalone experience after this date.
• Atlassian Opsgenie Automation Service integration. Deprecated on this date.

The Content and Configuration Management (C3M) APIs are now generally available. As a Managed Security Service Provider (MSSP) parent org user, you can push and sync Cloud SIEM rules, rule tuning expressions, Library content, monitors, and source templates across your child orgs programmatically, instead of doing it manually from the Organizations UI. Learn more.

New release​

The release of the following Sumo Logic apps:

• Druva - Platform Events. This app helps you monitor Druva via a webhook-based integration. Learn more.
• AWS Observability Terraform Module for AWSO 3.0.0. This Terraform module deploys the Sumo Logic AWS Observability Solution, a full-stack observability solution for AWS environments. It configures AWS collection infrastructure and installs Sumo Logic apps, monitors, dashboards, and field extraction rules for supported AWS services.

Automation service integrations​

The following Automation Service Integrations are now generally available:

• AWS Lambda
• DFIR-IRIS
• Google Cloud Functions
• LaunchDarkly

Enhancements​

• Akamai SIEM API v1.2.26. Added parser path support. For more information, see Akamai SIEM API Source.
• Google Cloud SQL. Added support for PostgreSQL instances. For more information, see Google Cloud SQL.
• Miro. Aligned the Miro app with the latest Miro Cloud-to-Cloud source, added new out-of-the-box monitors, and included additional fixes. The Miro source also completed a smooth transition to a new API version Audit Log v2 API. For more information, see Miro App and Miro Source.
• SumoLogic Terraform Provider v3.3.0. Released with the following resources:
  • sumologic_async_aws_lambda_invocation. This resource asynchronously invokes an AWS Lambda function with support for AWS named profiles, enabling multi-account deployments.
  • sumologic_s3_logging_lambda_enable. Renamed from sumologic_lambda_invoke_action and enhanced with region and aws_profile arguments to support explicit AWS region configuration and named AWS credential profiles, enabling multi-account deployments. If you use sumologic_lambda_invoke_action in an existing configuration, update it to sumologic_s3_logging_lambda_enable.

Bug fixes​

• Google Workspace and Azure Audit. Bug fixes were released for these apps.

The below new guardrails to dashboard auto-refresh:

• Hidden tab pause. Auto-refresh pauses when you switch away from a dashboard tab for more than 10 minutes, and resumes automatically when you return.
• Panel failure exclusion. A panel is excluded from auto-refresh after 5 consecutive query failures, so it stops disrupting other healthy panels.

Learn more.

You can now provision the SOC Analyst Agent as part of a child org's baseline. When creating or editing a child org, enable the SOC Analyst Agent checkbox, set the Number of investigation per day, and optionally allow overage, alongside your existing Logs, Metrics, Traces, and Cloud SIEM Enterprise baselines. Learn more.

Sumo Logic now supports a maximum log message size of 256KB, up from 64KB, so large single-line logs are ingested without being split as often.

Some Sumo Logic platform features and downstream webhook connections handle messages larger than 64KB differently. See Known limitations for details.

Learn more.

The support for longer dashboard time ranges. Previously, dashboard queries could exceed the 32-day maximum time range only when using aggregate scheduled views. Currently, dashboard queries will be allowed to run beyond the 32-day time range when using aggregate scheduled views, aggregate scheduled searches, or a combination of both. Learn more.

What's changing​

For scheduled searches using the Save to Index alert type, Sumo Logic has made the following related changes:

• The Message (_raw) field will be empty. Previously, for aggregate queries (for example, ... | timeslice 1m | count by batch, parsedfield), the Message (_raw) field was populated with a synthesized, comma-separated string of the row's values (for example, Count=1,batch=3,parsedfield=testlog_HwMoOdtQ00), in addition to the individual named fields.
  Going forward, the _raw field will be empty for these results. No data is lost, and every value remains fully available in its own named field (_count, batch, parsedfield, etc.). Only the synthesized message string is no longer generated. Learn more.
• The 512-result limit is being removed. Previously, no more than 512 results could be saved to a view each time a scheduled search ran. That cap no longer applies and a scheduled search can now save every result it returns on each run.

Who is affected​

This affects you if you're running scheduled searches with an aggregate query and the Save to Index alert type, saving results to a view (typically a ScheduledSearchView, created when you type a new view name rather than selecting an existing one).

• For the _raw change, you're affected if any search queries or other content reading that view does one of the following:
  • Pulls values out of _raw using parse (or similar).
  • Searches for plain text/keywords that only exist in the message body, not in a named field.
  • Shows or reads the Message column to get field values.
    If your queries already use the named fields directly, you don't need to make any changes for this part.
• For the 512-result limit change, you likely don't need to do anything. It's only worth reviewing if you're concerned about increased data volume. For example, if your scheduled search runs frequently (such as every 15 minutes) and doesn't already cap its results with a limit operator or similar. Without the previous cap, a run like that can now save more results, and more data, than it did before.

What you need to do​

• For the _raw change, review your scheduled searches and any downstream content that reads from Save to Index views for reliance on _raw/Message. Update those queries to reference the named fields directly instead of parsing them from the message body. If you're unsure whether a query depends on _raw, check for parse operators run against _raw, or keyword terms in the source expression that aren't tied to a specific field name.
• For the 512-result limit change, no action is required. If you'd rather bound the amount of data a scheduled search saves per run, add a limit operator (or otherwise bound the result set) to that query. Otherwise, keep an eye on your data volume after rollout, since more results may now be saved per run than before.

Contact Sumo Logic Support if you need help identifying or updating affected queries.

Multiple notification support for Scheduled Searches. Previously limited to one alert type, you can now add up to 10 notifications to a single Scheduled Search. These alerts share the same trigger condition and fire from the same search execution, with each alert configured independently. Learn more.

AI Parse Assist, which automatically generates a parse statement and field names from any text you highlight in a log message. This eliminates the need to manually identify and label fields, helping you build parse queries faster, especially when working with complex or unfamiliar log formats. Learn more.

A new Mobot skill that lets you create dashboard panels from plain-language prompts, instead of configuring them manually. Describe what you want to see, and Mobot drafts the query, picks a visualization, and adds it to a new or existing dashboard. Learn more.

You can now create and manage AWS S3 archive destinations for Installed Collectors using a new public API, in addition to the UI flow, for automating destination setup at scale. Learn more.

One-click drill-down for map charts. Shift+click a point or line on the map to drill down into that location's data. Sumo Logic redirects you to the Log Search page with the query already updated with the corresponding latitude and longitude values.

Previously, you needed to manually find the IP address, or the latitude and longitude, for a location and then edit the query yourself to drill down into that location's data. Shift+click now does this for you automatically. Learn more.

Improvements to how threat intelligence indicators are searched:

• By default, only active threat intelligence indicators are available for search and Cloud SIEM entity enrichment. Learn more.
• You can now use the threatlookup operator to search threat intelligence indicators in your log data. Learn more.

This is in the rollout phase and will be available in all regions shortly.

That you can now build and update playbooks by chatting with Mobot instead of wiring up nodes by hand. Describe the automation you want in plain language, and Mobot checks your org's available integrations, asks clarifying questions, proposes a plan, and configures each step for you. Once you approve, it saves the playbook as a draft.

To make changes, just send a follow-up request and Mobot updates the plan and rebuilds the playbook automatically. Review the finished flow on the canvas, then publish when you're ready. Learn more.

Mid-subscription upgrades no longer reset burn rates on your existing credits. When you purchase additional credits at a different rate, Sumo Logic now tracks them as a separate credit block, so your original credits continue burning at their original rate instead of being repriced. Learn more.

Multi-child-org search results now include an _orgName field alongside _orgId, so MSSP users can identify which child org a result came from without having to remember its _orgId. For example, * | count by _orgId, _orgName.

You can also run these searches programmatically instead of using the Search UI, by setting childOrgIds or includeAllChildOrgs when you create a search job with the Search Job Management API.

Learn more.

Enhancements​

We've enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with new and updated dashboards, monitors, and field extraction rules (FERs), built on the latest collection mechanism.

• Added new and updated dashboards, FERs, and monitors for the following apps:
  • Active Directory 2012+ (JSON)
  • Amazon GuardDuty
  • Artifactory 7
  • AWS WAF
  • AWS WAF CSMA
  • Azure Audit
  • ChatGPT Compliance
  • Cisco Meraki
  • Cisco Umbrella
  • Cloudflare
  • Enterprise Audit - Cloud SIEM
  • Heroku
  • Host and Process Metrics
  • Host Metrics
  • Linux
  • LiteLLM
  • Microsoft Office 365
  • Palo Alto Firewall 10
  • PCI Compliance for Amazon VPC Flow
  • PCI Compliance for AWS Cloudtrail
  • Windows 2012+ (JSON)
  • Windows 7+2008 (Legacy)
  • Windows CSMA
  • Windows Performance
  • Zscaler Internet Access
  • Zscaler Private Access
• Amazon ECS(With Container Insights and Traces). This app has been migrated from version 1 to version 2. Learn more.
• Claude Compliance C2C v2.0.1. The Claude Compliance C2C v2.0.1 adds Activity Feed collection alongside chat messages, with independent checkpoints and two new checkboxes in the source UI to control which data streams are collected (Collect Chat Messages and Collect Activities). Existing sources can be upgraded in place with no new collector setup needed. For more information, see Claude Compliance Source and Claude Compliance App.
• ChatGPT Compliance C2C v2.0.2. The ChatGPT Compliance C2C v2.0.2 expands event coverage with 6 new event types (AUDIT_LOG, AUTH_LOG, APP_AUTH_LOG, APP_LOG, CODEX_LOG, and CODEX_SECURITY_LOG), and widens the configurable polling interval from 5 minutes to 24 hours. Existing sources remain fully compatible; no upgrade is required. For more information, see ChatGPT Compliance Source and ChatGPT Compliance App.
• SumoLogic Terraform Provider v3.2.9. Released with new resource sumologic_lambda_invoke_action.
• Updated 18 setup guide apps. Legacy ARM-based Azure Metrics Collection has been changed to the latest Azure Metrics Source.

The ability to create and update logs monitors from plain-language prompts in Mobot, instead of filling out the monitor form. Describe the monitor you want, review the suggested configuration, and confirm to create it. Learn more.

Mobot, Sumo Logic's AI-powered conversational assistant, is now generally available with a unified conversational interface. Learn more.

In a single conversation, ask questions in plain language to investigate your log data or learn how to use the platform, with no agent selection or query syntax required. Mobot determines your intent and responds accordingly:

• Log analysis. Mobot plans and runs multi-step analysis across your logs, returns inline results with notable findings, and recommends next steps.
• How-to answers. Mobot answers platform questions with information and reference links from official Sumo Logic documentation.
• Content creation. Create and manage monitors and dashboards through conversation, with a confirmation before anything goes live. Conversational playbook management for Automation Service is rolling out as well.
• Cloud SIEM investigations. Continue a SOC Analyst Agent investigation in Mobot with an insight's full context.

The former Query Agent and Knowledge Agent now work behind the scenes as the Log Analysis Agent and Platform Optimization Agent, and Mobot routes each prompt to the right one automatically.

You can now also use Searchable Time for Monitors, evaluating logs based on when they became searchable in Sumo Logic. Learn more.

More control over your dashboard exporting and scheduled reports. When you export a dashboard to PDF or PNG or create a scheduled report, you can now:

• Pick a Light or Dark theme for the output.
• Set the resolution from 1,500 to 6,000 pixels for a sharper image on large displays.
• Export panels with their own time range. If you've overridden the time range for a panel, the exported file now uses that panel's time range instead of the dashboard time range (PDF and PNG only).

Learn more.

The includeQuery and includeResultSet flags in monitor email notifications. This helps you include the search query and search results directly in the email. Learn more.

The Notification Settings Standards policy, which lets you choose the date and time format (Legacy or ISO) used in your alert and recovery notification payloads. Learn more.

Copy to Dashboard, a new way to copy an existing panel from one dashboard to another, or to a new dashboard, without rebuilding the query. Learn more.

The Go To search bar now searches across a broader set of content in addition to navigation pages:

• Library content. Search dashboards, searches, and folders saved in your Library.
• Monitors. Find monitors by name directly from the search bar.
• SLOs. Locate SLOs without navigating to the SLO page.
• No-match behavior. If no results meet the relevance threshold, the search returns 0 results instead of showing unrelated suggestions.

Learn more

Scan estimates for dashboards, now available at both the dashboard and section levels. At the dashboard level, click the meter icon to view the estimated scan data broken down by active and collapsed panels giving you clear visibility into scan estimate across your entire dashboard. For section level scan estimate, click the meter icon on any section header to view the estimated scan data for panels within that section. Learn more.

When you install a Next-Gen app, you can subscribe to receive email notifications about future app upgrades.

Each notification includes:

• The app name and new version.
• Release notes detailing what has changed.
• A direct link to the app in the App Catalog.

Additionally:

• You can unsubscribe at any time by navigating to the app within the Sumo Logic App Catalog.
• Uninstalling an app automatically removes all upgrade notifications for it.
• Users with the Manage Apps capability can subscribe or unsubscribe from notifications for apps installed by others.

Learn more.

New Sumo Logic users and organizations are now onboarded directly into the New UI by default, replacing the previous Classic UI onboarding experience.

Who is affected​

• All new users signing up for Sumo Logic.
• All new organizations created after this change.
• Existing users are not affected. Your current UI experience remains unchanged.

New Release​

The release of the Sumo Logic app for Amazon Overview. This app provides unified visibility into AWS service activity, performance, and health metrics across your cloud environment. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

Added new dashboards, monitor alerts, and an IDP category for the following apps:

• Active Directory 2012+ - OpenTelemetry. Removed the deprecated batch processor from the OpenTelemetry configuration. Batching is now enabled by default with the Sumo Logic exporter. The updated OpenTelemetry configuration is compatible with Sumo Logic OpenTelemetry Agent version 0.153 and later.
• Active Directory 2012+ (JSON)
• Auth0
• Azure Active Directory
• ChatGPT Compliance. Updated dashboard queries to align with the latest log format, and added a custom_gpt selection variable to the dashboard for easier filtering.
• JumpCloud Directory Insights
• OneLogin
• Updated 14 Source Templates with the following improvements:
  • Batch processor deprecation handling. Removed deprecated batch processor configurations to ensure compatibility with current collector versions.
  • Field table validation. Added validation for field tables in filelog receiver-based source templates to prevent misconfiguration.
  • Hashing functionality. Introduced hashing support for fields in filelog receiver-based source templates.
• Migrated the following Classic Apps to Next-Gen Apps:
  • Amazon DynamoDB
  • Amazon ECS without Container Insights and Traces
  • Amazon ElastiCache
  • Amazon RDS
  • Amazon SNS
  • Amazon SQS
  • AWS Application Load Balancer
  • AWS API Gateway
  • AWS Classic Load Balancer
  • AWS EC2 CW Metrics
  • AWS EC2 Host Metrics
  • AWS Lambda
  • AWS Network Load Balancer

Collection Mechanism​

• AWS Lambda Extension v1.4.1.
  • Released the security patch addressing Denial of Service vulnerabilities in the AWS SDK EventStream Decoder (CVE fixes for s3 and eventstream protocol).
  • Updated AWS SDK Go v2 dependencies to the latest stable versions. Learn more.
• VMware Tanzu Integration v1.0.9.
  • Upgraded Golang to v1.26.4 and updated dependencies to address 7 CVEs in golang.org/x/net.
  • Updated deprecated HttpStart/HttpStop event types.
  • Now compatible with VMware Tanzu Application Service 10.4.0 Small Footprint Elastic Application Runtime. Learn more.
• Azure Append Blob and Azure Block Blob v4.1.9.
  • Resolved CVE alerts in package dependencies.
  • Fixed AppendBlobTaskProducer TableNotFound error occurring on initial timer fire.
  • Added SCM_COMMAND_IDLE_TIMEOUT=600 to all ARM templates to improve deployment reliability. Learn more.

We've streamlined the Threat Intelligence workflow by bringing source configuration and manual indicator uploads into a single, unified experience. Instead of switching between multiple pages, you can now perform both tasks from one centralized location, reducing navigation and simplifying administration.

Threat Intelligence is now accessible under Data Management > Threat Intelligence, making it easier to discover and manage your threat intel sources.

Key improvements include:

• A new Add Source flow that lets you select from available threat intelligence sources, choose a collector, and complete configuration in a streamlined workflow.
• A new option to manually upload indicators.
• An updated Sources listing page showing Status, Source Name, Description, Storage Consumed, and Number of Indicators.

Learn more.

The Manage Features capability for MSSP administrators. With this, you can opt in or opt out individual child organizations from specific Sumo Logic features directly from the Organizations UI without needing to raise a request with Sumo Logic support. Learn more.

The deployment of a new Sumo Logic service region in the AWS European Sovereign Cloud, further expanding our global infrastructure to support customers with strict data residency and regulatory requirements in Europe. This new region enables organizations to deploy and operate their Sumo Logic environments with enhanced data sovereignty, compliance controls, and reduced latency, while continuing to leverage the full capabilities of the Sumo Logic platform for log analytics, security monitoring, and observability. Learn more.

Dashboard Sections, a new way to organize complex dashboards by grouping related panels into collapsible sections. You can name each section, configure its default state (expanded or collapsed), and customize its appearance to create a more structured and easier-to-navigate dashboard experience.

Dashboard Sections also help reduce visual clutter and improve focus by allowing you to expand only the information you need. In addition, panels within collapsed sections do not execute queries until expanded, helping reduce unnecessary query activity and scan consumption. Learn more.

You can now copy a JSON value name or the entire JSON structure directly from your search results by clicking the Copy icon next to an array or JSON value, or by highlighting the text, right-clicking, and selecting Copy field value. Learn more.

Two enhancements to the C3M content push workflow for MSSP administrators:

• Stop Push. You can now stop an in-progress content push at any time. During an active push, click the Stop Push button on the push dialog and confirm in the pop-up to halt the operation immediately.
• View Results. After a push job is stopped or interrupted, a warning banner appears in the content search bar with a View Results link. This opens the Content Push Job Results page where you can review successfully pushed items alongside the failed and stopped items. If required, you can retry all unsuccessful updates at once using Retry All Updates, or selectively re-push specific items using Retry Failed/Stopped Updates.

Learn more.

The Metrics Browser, an interactive catalog that lets you quickly search and explore all available metrics, dimensions, and dimension values in your environment, without running a query.

Metrics Browser simplifies the entire metrics workflow by:

• Providing an intuitive way to discover what metrics exist and how they are structured.
• Showing metric names alongside their associated dimensions and values.
• Making it easy to select metrics and add them directly into metrics queries.

Metrics Browser significantly reduces time spent on exploratory queries, accelerates troubleshooting, improves accuracy of investigations, and lowers data consumption and cost.

Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• CyberArk Audit. Updated existing monitor alerts and dashboards, and added two new dashboards for Identity Threat Detection and Privileged Access & Secrets. Learn more.
• CyberArk EPM. Enhanced the CyberArk EPM app with a dashboard-enriched experience for improved visibility into endpoint privilege management activities. Learn more.
• Duo Security. Added an IDP category for the Duo Security app in the app catalog. Learn more.
• Enterprise Audit - Cloud SIEM. Updated the queries in Cloud SIEM - Insights Overview and Cloud SIEM - Insights Closed dashboards. Learn more.
• Google Cloud - Security Command Center. Updated the log queries to add nodrop to the JSON field extraction, ensuring that findings with missing or incomplete fields are retained in the results rather than being dropped. Learn more.
• Microsoft Azure AD Inventory. Updated the existing queries and dashboards for Users Overview, Devices Overview, and Device Risk and Compliance, along with monitor alerts to strengthen security and device monitoring. Learn more.
• Microsoft Graph Azure AD Reporting. Added an IDP category for the Microsoft Graph Azure AD Reporting app in the app catalog. Learn more.
• Okta. Updated the existing queries and added new monitor alerts, along with six new dashboards for Application Activity Overview, Events Overview, Identity and Policy Management, Threat Detection and Protection, User and Groups Details, and User Account, Lifecycle and Activity Monitoring. Learn more.
• SailPoint. Updated existing dashboards and added an IDP category for the SailPoint app in the app catalog, along with seven new dashboards for Access Items, Access Requests & Provisioning, Identity Inventory, Identity Lifecycle and Governance, Privileged Access & Token Activity, Source Health & Configuration, and Workflow & Automation. Learn more.

Solution​

• AWS Observability v2.15.0. Updated the AWS Observability solution by improving app queries, fixing CVEs, and upgrading Lambda runtimes to Node.js v24.x and Python 3.14. Also upgraded SAM app versions:
  • sumologic-app-utils (2.0.23)
  • sumologic-s3-logging-auto-enable (1.0.19)
  • sumologic-loggroup-connector (1.0.16) Learn more.

Bug fixes​

• Flex. Bug fixes in queries. Learn.

Enhancements to dashboard execution controls with updates to Auto Refresh and the introduction of Auto Run, providing administrators with more flexibility and helping reduce unnecessary compute usage.

Auto Refresh enhancements:

• Disable auto refresh entirely, or
• Set a minimum refresh interval (30 seconds to 1 day).

This helps minimize unnecessary panel reloads and reduce avoidable scan costs.

New: Auto Run

• Control whether panels execute automatically or only when Run is clicked.
• Ideal for fixed time ranges or when adjusting multiple variables before loading data.

Learn more.

MSSP administrators can now push scheduled searches and monitors with lookup table dependencies to target organizations. Previously, attempting to push these items would result in an error. Learn more.

The new Sumo Logic app for Claude Compliance. This app delivers centralized visibility into Claude platform activities, including API usage, authentication, integrations, billing, user lifecycle events, and organizational changes. It enables security, compliance, and operations teams to detect threats, investigate suspicious behavior, and maintain governance through real-time dashboards, analytics, and event correlation across Claude environments. Learn more.

The new Sumo Logic source for Claude Compliance. This source enables organizations to ingest Claude chat logs and metadata into Sumo Logic for centralized monitoring and analysis. Using Claude’s Compliance API, you can support auditing, security, and regulatory compliance with structured access to conversational AI activity. Learn more.

The new Sumo Logic app for Proofpoint TRAP. This app helps you monitor and investigate email threats detected and handled by Proofpoint, such as phishing, malware, business email compromise (BEC), impersonation attempts, and suspicious emails. Learn more.

New Release​

The release of the following Sumo Logic apps.

• Azure SQL Managed Instance. Added a comprehensive set of dashboards and monitor alerts for the Azure SQL Managed Instance app, providing enhanced visibility into performance, security, operations, and workload health across all managed instances. Learn more.
• Enterprise Audit - Collection and Data Forwarding for MSSP. The Sumo Logic app for Enterprise Audit – Collector and Data Forwarding Management for MSSP provides centralized visibility into collector activity, source behavior, and data-forwarding trends across child organizations within an MSSP environment. Learn more.
• LiteLLM. The Sumo Logic app for LiteLLM provides a centralized visibility into LiteLLM usage, performance, reliability, and cost, helping teams monitor latency, tokens, spend, failures, and fallbacks across multiple LLM providers to keep AI workloads efficient and reliable. Learn more.
• Upwind. The Sumo Logic app for Upwind helps you send threat, configuration, and audit events to Sumo Logic via webhook for centralized monitoring. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• AWS CloudTrail. Added two new dashboards for Security Analytics - Data Exfiltration and Exposure and Security Analytics - Suspicious Indicators, along with monitor alerts to help ensure continuous visibility, protect critical security controls, and enable rapid response to high-impact threats. Learn more.
• Box. Added six new dashboards for Admin and Compliance, Collaboration and Sharing, Overview, Resource Monitoring, Security Threats and Anomalies, and User Monitoring, along with monitoring alerts for proactive threat detection and mitigation. Learn more.
• Citrix Cloud. Added three new dashboards for Network and Client Overview, Session Logon Performance, and User Experience and Session Health, along with monitor alerts to help ensure secure access, stable performance, and faster troubleshooting for Citrix Cloud environments.Learn more.
• Enterprise Audit - Collector & Data Forwarding Management. Added a new dashboard for Installed Collector Upgrade for detailed analysis, helping you track upgrade activity and troubleshoot failed upgrades by collector, requester, and version path. Learn more.
• Infrequent Data Tier. Updated the dashboard images for enhanced visibility and accuracy. Learn more.
• Microsoft Foundry:
  • Renamed the Azure OpenAI app to Microsoft Foundry to reflect expanded support for multiple models beyond OpenAI and a unified AI platform experience.
  • Added four new dashboards for Speech and Audio, Traffic and Payload, Translation and Document, and Usage and Token Consumption to provide deeper visibility into workload performance and resource utilization. Learn more.
• Slack. Added five new dashboards for App Overview, Files Overview, User Authentication and Security, Access Security Overview, and Workspace Security Overview, along with monitor alerts to detect and respond to data breaches and security threats. Learn more.
• Tenable. Added two new dashboards for Vulnerability Analysis and Asset Inventory, along with monitor alerts to detect and fix critical severity vulnerabilities. Learn more.

Collection Mechanism​

Azure Append Blob and Azure Block Blob v4.1.8. Forced fast-xml-parser to patched versions across BlockBlob and AppendBlob target builds, and updated the test requests dependency to resolve Dependabot alerts after rescan.

Solution​

AWS Observability v2.14.0. Updated the AWS Observability solution to support the Zurich deployment and enhanced nine AWS apps, including improvements to Load Balancer FERs for better monitoring and performance insights. Learn more.

Bug fixes​

• Removed hardcoded aws partition from ARN parse statements for Amazon Redshift ULM and Amazon SES.
• Fixed the ARN partition value in parse statements for Amazon Bedrock.

We're exicted to introduce the dark and light theme support across the Sumo Logic platform in the New UI, allowing you to personalize your viewing experience. Switch themes instantly from anywhere in the platform using the global theme button in the top toolbar (adjacent to the Go to... button), or set your preference in Account Preferences. Learn more.

The following new Sumo Logic apps:

• LiteLLM. The Sumo Logic app for LiteLLM provides preconfigured dashboards and alerts to monitor usage, cost, performance, and infrastructure for reliable LLM proxy operations. Learn more.
• Upwind. The Sumo Logic app for Upwind helps you send threat, configuration, and audit events to Sumo Logic via webhook for centralized monitoring. Learn more.

We're simplifying the terminology we use to describe features in development and validation stages. Starting today, we're replacing Beta with Customer Preview to help you better understand the state of new features and how they fit into your environment.

What's changing​

Work with your account team to learn more about available Previews and to sign up for early access.

Why this matters​

The new Preview terminology provides:

• Clearer participation criteria. Understand who can access each tier.
• Better maturity signals. Know what level of production-readiness to expect.
• Consistent naming. The same terminology across all Sumo Logic products and features.

During the transition period, you may see both Beta and Preview labels active at the same time. All documentation, badges, and release notes will adopt the new terminology going forward. Learn more.

In-app tabs to our Search page, making it easier to manage multiple searches side-by-side within a single browser window. With this enhancement, you can open multiple searches in separate in-app tabs, switch between queries without losing context, compare results more efficiently, and keep long-running or reference searches open while continuing your workflow. This update streamlines investigations by eliminating the need to recreate searches or rely on multiple browser tabs, helping you stay organized and move faster during troubleshooting and analysis. Learn more.

The new Sumo Logic Enterprise Audit – Collector and Data Forwarding Management app for MSSP, providing centralized visibility into collector activity, source behavior, and data forwarding trends across child organizations within a MSSP environment.

This app is designed to help Managed Security Service Providers (MSSPs) monitor and manage their distributed data collection infrastructure more effectively, ensuring operational transparency and control across multiple orgs. Learn more.

The new Create Usage Alert button in our Accounts Overview page. This enhancement allows you to quickly create a monitor for 70% and 90% credit usage thresholds, improving proactive credit usage monitoring and helping you take timely action before usage reaches critical levels.

• Data Tiers - Learn more
• Flex - Learn more

New Release​

The release of the following apps for Sumo Logic.

• Amazon SageMaker. The Amazon SageMaker app provide insights into CloudTrail, CloudWatch Logs, and performance metrics for your Amazon SageMaker service. Learn more.
• Azure Firewall. The Azure Firewall app enables centralized visibility into firewall health, network and application rules, threat intelligence, and IDPS events. Learn more.
• Azure Subscription. The Azure Subscription app centralizes the collection and analysis of activity logs, enhancing security, operational visibility, and compliance monitoring. Learn more.
• Data Volume for MSSP. The Data Volume for MSSP app provides centralized visibility into data usage across child organizations by type, tier, category, and source. Learn more.
• Apache Hadoop - OpenTelemetry. The Apache Hadoop - OpenTelemetry app delivers end-to-end visibility into cluster health, performance, and resource utilization through logs and metrics. Learn more.
• OpenLLMetry. The OpenLLMetry app enables end-to-end observability of LLM applications by collecting traces, metrics, and events across prompts, responses, latency, and errors. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• Abnormal Security. Added monitor alerts to accelerate incident response and updated the existing dashboards to enhance panel queries. Learn more.
• AWS Lambda Extension. The Sumo Logic AWS Lambda Extension v1.4.0 now supports Lambda managed instance runtime and adds deployment support for two new AWS regions: ca-west-1 and eusc-de-east-1. This update enhances runtime compatibility and expands regional availability, enabling more flexible and scalable deployments. Learn more.
• Azure Security. Updated the Microsoft Defender for Cloud Apps and Microsoft Entra ID Protection apps with refreshed content and new monitor alerts.
• Cato Networks. Updated the Cato Networks app with enhanced dashboard panels and monitor alerts to ensure rapid incident response and regulatory compliance. Learn more.
• Cisco Meraki - C2C. Added monitor alerts along with the Network Traffic Overview dashboard to enable continuous tracking of network traffic patterns, insecure port usage, and geo-based risks in Cisco Meraki, helping quickly detect anomalies and strengthen network security. Learn more.
• AWS CloudTrail. Added monitor alerts along with the Root User Monitoring dashboard to provide real-time visibility and detection of high-risk root user activities and critical security events in your AWS environment. Learn more.
• Duo Security. Added monitor alerts along with the Activity Events dashboard and Users Overview dashboard to provide visibility into administrator activity and user security posture in Duo Security, helping strengthen overall access control. Learn more.
• Google Workspace. Added monitor alerts along with the Google Workspace - Alert Center - Mobile Device Management dashboard and Google Workspace - Alert Center - Admin Actions dashboard to enable faster response and improved security posture n Google Workspace. Learn more.
• Microsoft Graph Azure AD Reporting. Added monitor alerts along with the Sign-Ins Security Overview dashboard and Provisioning Error Analysis dashboard to provide comprehensive visibility into Azure AD authentication and provisioning activities, enabling faster detection and management of anomalies. Learn more.
• Mimecast. Added monitor alerts along with Audit Events Overview, DLP Policy Monitoring, Hold Message Analysis, SIEM Logs - Overview, SIEM Logs - Threat Protection, and SIEM Logs - Email Processing and Delivery dashboards to enhance visibility into email traffic, threat detection, and data loss, strengthening Mimecast security posture. Learn more.
• Microsoft Exchange Trace Logs. Updated the following documentations:
  • Microsoft Exchange Trace Logs source. to use the Microsoft Graph API as the new data access endpoint, replacing the Office 365 reporting service that Microsoft will deprecate on April 8, 2026. Learn more.
  • Microsoft Exchange Trace Logs app. Added monitor alerts along with the Security Overview dashboard to provide insights into email security to quickly detect risks and suspicious patterns within your Microsoft Exchange Trace Logs environment. Learn more.
• Netskope. Added monitor alerts along with the Admin Audit & Compliance dashboard and Watchlist & Insider Threat dashboard to provide a deeper visibility into administrative activity and potential insider risks within your Netskope environment. Learn more.
• Salesforce. Added monitor alerts to strengthen security and updated the existing dashboards to enhance panel queries. Learn more.
• Sumo Logic Audit app. Added the Library Content - Monitors dashboard to the Sumo Logic Audit app to provide insights into monitors usage based on users working with monitors, deletions, and notifications. Learn more.
• Workday. Added monitor alerts along with the Data Access and Exfiltration Risk dashboard, Security Posture dashboard, and Session Intelligence dashboard to enable visibility into data access risks, security posture, and user session behavior in Workday. Learn more.

The new Sumo Logic app for Azure Subscription. This app enables you to collect, analyze, and monitor Azure cloud activity in a single, centralized platform. This integration enhances security visibility, operational monitoring, and compliance tracking across your Azure environment.

The app supports collection of key Azure Subscription metrics, including Latency (request response times) and Traffic (request volume), helping you better understand service performance and usage patterns across your Azure resources. Learn more.

New monitor alerts, along with the following dashboards, designed to provide deeper visibility into the authentication, user, and administrator activity within your Workday environment:

• Data Access and Exfiltration Risk
• Security Posture
• Session Intelligence

New monitor alerts, along with the following dashboards, designed to provide deeper visibility into administrative activity and potential insider risks within your Netskope environment:

• Admin Audit & Compliance
• Watchlist & Insider Threat

App Registration support as the recommended authentication method for the Microsoft Office 365 Audit Source. This enhancement enables a more secure and reliable way to collect Microsoft 365 audit logs by using Azure AD application-based authentication instead of user credentials.

With App Registration, you can authenticate using Tenant ID, Client ID, and Client Secret, allowing Sumo Logic collectors to securely access the Microsoft 365 Management Activity APIs. This approach aligns with Microsoft’s recommended best practices for service-to-service integrations. Learn more.

You can now run search across child orgs with the View Organizations role capability. Previously, this functionality was limited to users only with Manage Organizations capability. Learn more.

The new Sumo Logic Data Volume app for MSSPs, delivering detailed insights into data usage across all child orgs. With rich segmentation by data type, tier, category, collector, source, and host, the app enables precise analysis of ingest patterns at every level. Leveraging predefined dashboards it empowers MSSPs to efficiently monitor, analyze, and optimize ingest volume across their entire managed environment. Learn more.

The new Sumo Logic source for Proofpoint TRAP, enabling seamless ingestion of message logs via the Proofpoint TRAP API. This integration provides enhanced visibility into email threats by delivering detailed insights on message disposition, detected threats, and policy actions. Security teams can now more efficiently identify, investigate, and respond to email-based attacks with improved context and analysis. Learn more.

You can now delete the ingested data directly from Sumo Logic using deletion requests. This helps you to quickly remove unintentionally ingested sensitive data without contacting Sumo Logic Support. Deletion requests support multiple datasets, time ranges, customizable filters, and full audit tracking. Also, you can manage the requests programmatically using the Data Deletion Rules API. Learn more.

The ability to manage lookup tables within library content on our Manage Content tab. With this enhancement, MSSP administrators can conveniently push lookup table items in the Library folder to multiple child organizations at once, simplifying content distribution and management. Learn more.

Support for filtering the scheduled dashboard reports by child orgs. When setting up a scheduled report, select the required child org(s) from the Organization dropdown under the Select Variables section to receive a report that reflects data for your intended child organization. Learn more.

The deployment of a new Sumo Logic service region in the Amazon Web Services (AWS) region located in Zurich, Switzerland, further expanding our global infrastructure to support customers across Europe. This new region enables organizations to deploy and operate their Sumo Logic environments with enhanced data residency, regulatory compliance, and reduced latency, while continuing to leverage the full capabilities of the Sumo Logic platform for log analytics, security monitoring, and observability. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• Azure Security apps. Updated Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Graph Security with refreshed content and new monitor alerts to detect high-severity incidents, suspicious devices, and activity from embargoed or high-risk locations.
• Data Volume. Added monitor alerts to track log ingestion, detect usage spikes or data gaps, and prevent unexpected credit overages. Learn more.
• Enterprise Audit apps. Updated Enterprise Audit - Collector & Data Forwarding Management, Enterprise Audit - Content Management, Enterprise Audit – Cloud SIEM, Enterprise Audit - Security Management, and Enterprise Audit - User & Role Management with monitor alerts to improve compliance, detect misconfigurations, identify embargoed-location activity, and surface high-risk security events.
• Enterprise Search Audit. Added the Enterprise Search Audit – Failures KPIs and Breakdowns dashboard and monitor alerts to track search reliability, performance, and cost-related risks. Learn more.
• Flex. Added monitor alerts to help you detect ingestion spikes, prevent budget overruns, and control expensive queries by automatically flagging abnormal data usage and credit consumption before they impact costs or system stability. Learn more.
• Infrequent Data Tier. Added monitor alerts that help you control costs and usage by detecting consumption spikes, expensive or failed queries, and abnormal user or module-level scan activity before they waste credits. Learn more.
• SentinelOne. Added monitor alerts to help you detect high-risk threats, suspicious activity, and compliance violations in real-time, enabling faster response and stronger endpoint security. Learn more.

App deprecation​

• Security Analytics. The Security Analytics app has been deprecated and is no longer actively supported or recommended for use.

Our new Macros feature, which enables you to define reusable query logic that can be referenced across multiple searches. This approach improves efficiency, promotes consistency, and makes complex queries easier to manage and maintain at scale.

Key features include:

• Argument-based macros. Macros accepts arguments to dynamically adjust query behavior at runtime, enabling flexible and context-aware execution.
• Nested macro support. Macros can call other macros within their definitions, allowing you to build modular, reusable query components.
• Improved standardization of search logic. Macros help centralize commonly used filters, parsing rules, and aggregations, improving maintainability and ensuring consistent query behavior across teams.

Learn more.

Previously, we announced token-based authentication for secure HTTP sources. The Terraform sumologic_http_source data source now adds the token and base_url attributes to support token-based auth for HTTP sources. Learn more.

Parent org administrators can now centrally manage default and user-specific role assignments for child organizations. This enhancement allows admins to assign custom roles for users accessing child orgs via SSO, reducing over-privileged access, eliminating per-org configuration overhead, and ensuring consistent role assignments across organizations. Learn more.

The ability to manage source templates for enterprises with multiple organizations such as MSSPs (which typically have a parent organization with multiple child organizations). These source templates provide efficient, scalable data collection management by applying consistent setups across multiple collectors. Learn more.

We have reintroduced the ability to perform actions on content items directly from navigation menus in the new UI. You can now manage content more quickly without needing to open the Content Library first.

This enhancement reduces the number of clicks required to manage content, helping you work more efficiently and streamline everyday workflows. Learn more about our UI.

What’s new​

• Access actions from navigation menus. Perform actions directly from Recent, Library, and other navigation areas.
• Edit content quickly. Open and modify items without additional navigation steps.
• Delete without switching context. Remove content directly from where you are working.
• Move items easily. Relocate content between folders without leaving the current view.
• Share and export faster. Access common management options from the same menu.

Secure token-based authentication for HTTP sources. This new capability allows you to authenticate using a unique token in the request header, maintaining the existing HTTPS endpoint behavior while adding token validation per source.

Obtain the token to use in an auth header when you configure an HTTP source or regenerate the URL. To learn more, see:

• Configure an HTTP Logs and Metrics Source
• Create an OTLP/HTTP Source
• Generate a New URL for an HTTP Source

Our new Searchable Time timestamp in Log Search, which indicates when ingested logs are fully processed and ready for search. Running queries using this timestamp helps you to eliminate errors caused by ingestion latency and non-linear indexing, ensuring non-overlapping time-range queries return complete results without gaps or duplication. Learn more.

Enhancements​

• Azure SQL Managed Instance app. Updated documentation for the Azure SQL Managed Instance app, including detailed steps for collecting logs, audit logs, and metrics.
• Sumo Logic Audit app. Added monitor alerts for the Sumo Logic Audit app.
• CrowdStrike - Falcon Endpoint Protection app. Updated the sample log messages, dashboards, and monitor alerts for CrowdStrike - Falcon Endpoint Protection app to coordinate it with EppDetectionSummaryEvent data type.
• Azure Container Instances app. Updated the Azure Container Instances app to set the default value for resource_type to CONTAINERGROUPS and added the !category field in log query scope.
• Windows Source Template. Released the Windows Source Template version 9.1.0, which tags the default _parser for logs forwarded to Cloud SIEM. For detailed version information, refer to the changelog file.
• Updated OpenTelemetry apps. Redis and HAProxy.

Auto Parse Mode is now enabled for MSSPs customers. This feature automatically extracts fields from JSON log messages at search time, reducing manual parsing effort and accelerating analysis. Learn more.

We’ve updated the Webhook Connections setup flow and all related subdirectories (such as Slack, Datadog, Jira, and others) in the Sumo Logic documentations to align with the new Connections page experience. Learn more.

Signing in to Sumo Logic is now even more convenient using your Google account credentials. If your email address is associated with a Google account, simply select Continue with Google on the sign-in page to access Sumo Logic with no additional setup required.

You can also use Google SSO when signing up for a new Sumo Logic account. Organizations that use SAML or other identity providers can continue to sign in using their existing authentication methods. Learn more.

New release​

LiteLLM​

The addition of a native Sumo Logic HTTP Source webhook integration for collecting LiteLLM usage and proxy log data in Sumo Logic. Learn more.

Enhancements​

• VMware Tanzu Application Service. Released Sumo Logic Nozzle for VMware Tanzu versions 1.0.7 and 1.0.8, which add support for Tanzu v10.2. For detailed version information, refer to the changelog file.
• AWS Serverless Application Models (SAM). Released the following two SAMs:
  • sumologic-aws-cloudtrail-benchmark 1.0.22
  • sumologic-guardduty-benchmark 1.0.19

This is an archive of the 2025 Sumo Logic Service Release Notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.

This is an archive of the 2024 Sumo Logic Service Release Notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.

This is an archive of the 2023 Sumo Logic Service Release Notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.

This is an archive of the 2022 Sumo Logic Service Release Notes. To view the full archive, click here. Release notes are available on our website for a rolling multi-year period. For information about older releases, contact Support.