Dashboard Sections also help reduce visual clutter and improve focus by allowing you to expand only the information you need. In addition, panels within collapsed sections do not execute queries until expanded, helping reduce unnecessary query activity and scan consumption. Learn more.

• Stop Push. You can now stop an in-progress content push at any time. During an active push, click the Stop Push button on the push dialog and confirm in the pop-up to halt the operation immediately.
• View Results. After a push job is stopped or interrupted, a warning banner appears in the content search bar with a View Results link. This opens the Content Push Job Results page where you can review successfully pushed items alongside the failed and stopped items. If required, you can retry all unsuccessful updates at once using Retry All Updates, or selectively re-push specific items using Retry Failed/Stopped Updates.

Learn more.

Metrics Browser simplifies the entire metrics workflow by:

• Providing an intuitive way to discover what metrics exist and how they are structured.
• Showing metric names alongside their associated dimensions and values.
• Making it easy to select metrics and add them directly into metrics queries.

Metrics Browser significantly reduces time spent on exploratory queries, accelerates troubleshooting, improves accuracy of investigations, and lowers data consumption and cost.

Learn more.

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• CyberArk Audit. Updated existing monitor alerts and dashboards, and added two new dashboards for Identity Threat Detection and Privileged Access & Secrets. Learn more.
• CyberArk EPM. Enhanced the CyberArk EPM app with a dashboard-enriched experience for improved visibility into endpoint privilege management activities. Learn more.
• Duo Security. Added an IDP category for the Duo Security app in the app catalog. Learn more.
• Enterprise Audit - Cloud SIEM. Updated the queries in Cloud SIEM - Insights Overview and Cloud SIEM - Insights Closed dashboards. Learn more.
• Google Cloud - Security Command Center. Updated the log queries to add nodrop to the JSON field extraction, ensuring that findings with missing or incomplete fields are retained in the results rather than being dropped. Learn more.
• Microsoft Azure AD Inventory. Updated the existing queries and dashboards for Users Overview, Devices Overview, and Device Risk and Compliance, along with monitor alerts to strengthen security and device monitoring. Learn more.
• Microsoft Graph Azure AD Reporting. Added an IDP category for the Microsoft Graph Azure AD Reporting app in the app catalog. Learn more.
• Okta. Updated the existing queries and added new monitor alerts, along with six new dashboards for Application Activity Overview, Events Overview, Identity and Policy Management, Threat Detection and Protection, User and Groups Details, and User Account, Lifecycle and Activity Monitoring. Learn more.
• SailPoint. Updated existing dashboards and added an IDP category for the SailPoint app in the app catalog, along with seven new dashboards for Access Items, Access Requests & Provisioning, Identity Inventory, Identity Lifecycle and Governance, Privileged Access & Token Activity, Source Health & Configuration, and Workflow & Automation. Learn more.

Solution​

• AWS Observability v2.15.0. Updated the AWS Observability solution by improving app queries, fixing CVEs, and upgrading Lambda runtimes to Node.js v24.x and Python 3.14. Also upgraded SAM app versions:
  • sumologic-app-utils (2.0.23)
  • sumologic-s3-logging-auto-enable (1.0.19)
  • sumologic-loggroup-connector (1.0.16) Learn more.

Bug fixes​

• Flex. Bug fixes in queries. Learn.

Auto Refresh enhancements:

• Disable auto refresh entirely, or
• Set a minimum refresh interval (30 seconds to 1 day).

This helps minimize unnecessary panel reloads and reduce avoidable scan costs.

New: Auto Run

• Control whether panels execute automatically or only when Run is clicked.
• Ideal for fixed time ranges or when adjusting multiple variables before loading data.

Learn more.

We’re excited to announce the release of the following Sumo Logic apps.

• Azure SQL Managed Instance. Added a comprehensive set of dashboards and monitor alerts for the Azure SQL Managed Instance app, providing enhanced visibility into performance, security, operations, and workload health across all managed instances. Learn more.
• Enterprise Audit - Collection and Data Forwarding for MSSP. The Sumo Logic app for Enterprise Audit – Collector and Data Forwarding Management for MSSP provides centralized visibility into collector activity, source behavior, and data-forwarding trends across child organizations within an MSSP environment. Learn more.
• LiteLLM. The Sumo Logic app for LiteLLM provides a centralized visibility into LiteLLM usage, performance, reliability, and cost, helping teams monitor latency, tokens, spend, failures, and fallbacks across multiple LLM providers to keep AI workloads efficient and reliable. Learn more.
• Upwind. The Sumo Logic app for Upwind helps you send threat, configuration, and audit events to Sumo Logic via webhook for centralized monitoring. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• AWS CloudTrail. Added two new dashboards for Security Analytics - Data Exfiltration and Exposure and Security Analytics - Suspicious Indicators, along with monitor alerts to help ensure continuous visibility, protect critical security controls, and enable rapid response to high-impact threats. Learn more.
• Box. Added six new dashboards for Admin and Compliance, Collaboration and Sharing, Overview, Resource Monitoring, Security Threats and Anomalies, and User Monitoring, along with monitoring alerts for proactive threat detection and mitigation. Learn more.
• Citrix Cloud. Added three new dashboards for Network and Client Overview, Session Logon Performance, and User Experience and Session Health, along with monitor alerts to help ensure secure access, stable performance, and faster troubleshooting for Citrix Cloud environments.Learn more.
• Enterprise Audit - Collector & Data Forwarding Management. Added a new dashboard for Installed Collector Upgrade for detailed analysis, helping you track upgrade activity and troubleshoot failed upgrades by collector, requester, and version path. Learn more.
• Infrequent Data Tier. Updated the dashboard images for enhanced visibility and accuracy. Learn more.
• Microsoft Foundry:
  • Renamed the Azure OpenAI app to Microsoft Foundry to reflect expanded support for multiple models beyond OpenAI and a unified AI platform experience.
  • Added four new dashboards for Speech and Audio, Traffic and Payload, Translation and Document, and Usage and Token Consumption to provide deeper visibility into workload performance and resource utilization. Learn more.
• Slack. Added five new dashboards for App Overview, Files Overview, User Authentication and Security, Access Security Overview, and Workspace Security Overview, along with monitor alerts to detect and respond to data breaches and security threats. Learn more.
• Tenable. Added two new dashboards for Vulnerability Analysis and Asset Inventory, along with monitor alerts to detect and fix critical severity vulnerabilities. Learn more.

Collection Mechanism​

Azure Append Blob and Azure Block Blob v4.1.8. Forced fast-xml-parser to patched versions across BlockBlob and AppendBlob target builds, and updated the test requests dependency to resolve Dependabot alerts after rescan.

Solution​

AWS Observability v2.14.0. Updated the AWS Observability solution to support the Zurich deployment and enhanced nine AWS apps, including improvements to Load Balancer FERs for better monitoring and performance insights. Learn more.

Bug fixes​

• Removed hardcoded aws partition from ARN parse statements for Amazon Redshift ULM and Amazon SES.
• Fixed the ARN partition value in parse statements for Amazon Bedrock.

• LiteLLM. The Sumo Logic app for LiteLLM provides preconfigured dashboards and alerts to monitor usage, cost, performance, and infrastructure for reliable LLM proxy operations. Learn more.
• Upwind. The Sumo Logic app for Upwind helps you send threat, configuration, and audit events to Sumo Logic via webhook for centralized monitoring. Learn more.

What's changing​

Work with your account team to learn more about available Previews and to sign up for early access.

Why this matters​

The new Preview terminology provides:

• Clearer participation criteria. Understand who can access each tier.
• Better maturity signals. Know what level of production-readiness to expect.
• Consistent naming. The same terminology across all Sumo Logic products and features.

During the transition period, you may see both Beta and Preview labels active at the same time. All documentation, badges, and release notes will adopt the new terminology going forward. Learn more.

This app is designed to help Managed Security Service Providers (MSSPs) monitor and manage their distributed data collection infrastructure more effectively, ensuring operational transparency and control across multiple orgs. Learn more.

• Data Tiers - Learn more
• Flex - Learn more

We’re excited to announce the release of the following apps for Sumo Logic.

• Amazon SageMaker. The Amazon SageMaker app provide insights into CloudTrail, CloudWatch Logs, and performance metrics for your Amazon SageMaker service. Learn more.
• Azure Firewall. The Azure Firewall app enables centralized visibility into firewall health, network and application rules, threat intelligence, and IDPS events. Learn more.
• Azure Subscription. The Azure Subscription app centralizes the collection and analysis of activity logs, enhancing security, operational visibility, and compliance monitoring. Learn more.
• Data Volume for MSSP. The Data Volume for MSSP app provides centralized visibility into data usage across child organizations by type, tier, category, and source. Learn more.
• Apache Hadoop - OpenTelemetry. The Apache Hadoop - OpenTelemetry app delivers end-to-end visibility into cluster health, performance, and resource utilization through logs and metrics. Learn more.
• OpenLLMetry. The OpenLLMetry app enables end-to-end observability of LLM applications by collecting traces, metrics, and events across prompts, responses, latency, and errors. Learn more.

Enhancements​

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

• Abnormal Security. Added monitor alerts to accelerate incident response and updated the existing dashboards to enhance panel queries. Learn more.
• AWS Lambda Extension. The Sumo Logic AWS Lambda Extension v1.4.0 now supports Lambda managed instance runtime and adds deployment support for two new AWS regions: ca-west-1 and eusc-de-east-1. This update enhances runtime compatibility and expands regional availability, enabling more flexible and scalable deployments. Learn more.
• Azure Security. Updated the Microsoft Defender for Cloud Apps and Microsoft Entra ID Protection apps with refreshed content and new monitor alerts.
• Cato Networks. Updated the Cato Networks app with enhanced dashboard panels and monitor alerts to ensure rapid incident response and regulatory compliance. Learn more.
• Cisco Meraki - C2C. Added monitor alerts along with the Network Traffic Overview dashboard to enable continuous tracking of network traffic patterns, insecure port usage, and geo-based risks in Cisco Meraki, helping quickly detect anomalies and strengthen network security. Learn more.
• AWS CloudTrail. Added monitor alerts along with the Root User Monitoring dashboard to provide real-time visibility and detection of high-risk root user activities and critical security events in your AWS environment. Learn more.
• Duo Security. Added monitor alerts along with the Activity Events dashboard and Users Overview dashboard to provide visibility into administrator activity and user security posture in Duo Security, helping strengthen overall access control. Learn more.
• Google Workspace. Added monitor alerts along with the Google Workspace - Alert Center - Mobile Device Management dashboard and Google Workspace - Alert Center - Admin Actions dashboard to enable faster response and improved security posture n Google Workspace. Learn more.
• Microsoft Graph Azure AD Reporting. Added monitor alerts along with the Sign-Ins Security Overview dashboard and Provisioning Error Analysis dashboard to provide comprehensive visibility into Azure AD authentication and provisioning activities, enabling faster detection and management of anomalies. Learn more.
• Mimecast. Added monitor alerts along with Audit Events Overview, DLP Policy Monitoring, Hold Message Analysis, SIEM Logs - Overview, SIEM Logs - Threat Protection, and SIEM Logs - Email Processing and Delivery dashboards to enhance visibility into email traffic, threat detection, and data loss, strengthening Mimecast security posture. Learn more.
• Microsoft Exchange Trace Logs. Updated the following documentations:
  • Microsoft Exchange Trace Logs source. to use the Microsoft Graph API as the new data access endpoint, replacing the Office 365 reporting service that Microsoft will deprecate on April 8, 2026. Learn more.
  • Microsoft Exchange Trace Logs app. Added monitor alerts along with the Security Overview dashboard to provide insights into email security to quickly detect risks and suspicious patterns within your Microsoft Exchange Trace Logs environment. Learn more.
• Netskope. Added monitor alerts along with the Admin Audit & Compliance dashboard and Watchlist & Insider Threat dashboard to provide a deeper visibility into administrative activity and potential insider risks within your Netskope environment. Learn more.
• Salesforce. Added monitor alerts to strengthen security and updated the existing dashboards to enhance panel queries. Learn more.
• Sumo Logic Audit app. Added the Library Content - Monitors dashboard to the Sumo Logic Audit app to provide insights into monitors usage based on users working with monitors, deletions, and notifications. Learn more.
• Workday. Added monitor alerts along with the Data Access and Exfiltration Risk dashboard, Security Posture dashboard, and Session Intelligence dashboard to enable visibility into data access risks, security posture, and user session behavior in Workday. Learn more.

The app supports collection of key Azure Subscription metrics, including Latency (request response times) and Traffic (request volume), helping you better understand service performance and usage patterns across your Azure resources. Learn more.