We're excited to announce the release of the following Sumo Logic apps:

• Druva - Platform Events. This app helps you monitor Druva via a webhook-based integration. Learn more.
• AWS Observability Terraform Module for AWSO 3.0.0. This Terraform module deploys the Sumo Logic AWS Observability Solution, a full-stack observability solution for AWS environments. It configures AWS collection infrastructure and installs Sumo Logic apps, monitors, dashboards, and field extraction rules for supported AWS services.

Automation service integrations​

The following Automation Service Integrations are now generally available:

• AWS Lambda
• DFIR-IRIS
• Google Cloud Functions
• LaunchDarkly

Enhancements​

• Akamai SIEM API v1.2.26. Added parser path support. For more information, see Akamai SIEM API Source.
• Google Cloud SQL. Added support for PostgreSQL instances. For more information, see Google Cloud SQL.
• Miro. Aligned the Miro app with the latest Miro Cloud-to-Cloud source, added new out-of-the-box monitors, and included additional fixes. The Miro source also completed a smooth transition to a new API version Audit Log v2 API. For more information, see Miro App and Miro Source.
• SumoLogic Terraform Provider v3.3.0. Released with the following resources:
  • sumologic_async_aws_lambda_invocation. This resource asynchronously invokes an AWS Lambda function with support for AWS named profiles, enabling multi-account deployments.
  • sumologic_s3_logging_lambda_enable. Renamed from sumologic_lambda_invoke_action and enhanced with region and aws_profile arguments to support explicit AWS region configuration and named AWS credential profiles, enabling multi-account deployments. If you use sumologic_lambda_invoke_action in an existing configuration, update it to sumologic_s3_logging_lambda_enable.

Bug fixes​

• Google Workspace and Azure Audit. Bug fixes were released for these apps.

• Hidden tab pause. Auto-refresh pauses when you switch away from a dashboard tab for more than 10 minutes, and resumes automatically when you return.
• Panel failure exclusion. A panel is excluded from auto-refresh after 5 consecutive query failures, so it stops disrupting other healthy panels.

Learn more.

Some Sumo Logic platform features and downstream webhook connections handle messages larger than 64KB differently. See Known limitations for details.

Learn more.

For scheduled searches using the Save to Index alert type, Sumo Logic has made the following related changes:

• The Message (_raw) field will be empty. Previously, for aggregate queries (for example, ... | timeslice 1m | count by batch, parsedfield), the Message (_raw) field was populated with a synthesized, comma-separated string of the row's values (for example, Count=1,batch=3,parsedfield=testlog_HwMoOdtQ00), in addition to the individual named fields.
  Going forward, the _raw field will be empty for these results. No data is lost, and every value remains fully available in its own named field (_count, batch, parsedfield, etc.). Only the synthesized message string is no longer generated. Learn more.
• The 512-result limit is being removed. Previously, no more than 512 results could be saved to a view each time a scheduled search ran. That cap no longer applies and a scheduled search can now save every result it returns on each run.

Who is affected​

This affects you if you're running scheduled searches with an aggregate query and the Save to Index alert type, saving results to a view (typically a ScheduledSearchView, created when you type a new view name rather than selecting an existing one).

• For the _raw change, you're affected if any search queries or other content reading that view does one of the following:
  • Pulls values out of _raw using parse (or similar).
  • Searches for plain text/keywords that only exist in the message body, not in a named field.
  • Shows or reads the Message column to get field values.
    If your queries already use the named fields directly, you don't need to make any changes for this part.
• For the 512-result limit change, you likely don't need to do anything. It's only worth reviewing if you're concerned about increased data volume. For example, if your scheduled search runs frequently (such as every 15 minutes) and doesn't already cap its results with a limit operator or similar. Without the previous cap, a run like that can now save more results, and more data, than it did before.

What you need to do​

• For the _raw change, review your scheduled searches and any downstream content that reads from Save to Index views for reliance on _raw/Message. Update those queries to reference the named fields directly instead of parsing them from the message body. If you're unsure whether a query depends on _raw, check for parse operators run against _raw, or keyword terms in the source expression that aren't tied to a specific field name.
• For the 512-result limit change, no action is required. If you'd rather bound the amount of data a scheduled search saves per run, add a limit operator (or otherwise bound the result set) to that query. Otherwise, keep an eye on your data volume after rollout, since more results may now be saved per run than before.

Contact Sumo Logic Support if you need help identifying or updating affected queries.

Previously, you needed to manually find the IP address, or the latitude and longitude, for a location and then edit the query yourself to drill down into that location's data. Shift+click now does this for you automatically. Learn more.

• By default, only active threat intelligence indicators are available for search and Cloud SIEM entity enrichment. Learn more.
• You can now use the threatlookup operator to search threat intelligence indicators in your log data. Learn more.

This is in the rollout phase and will be available in all regions shortly.

To make changes, just send a follow-up request and Mobot updates the plan and rebuilds the playbook automatically. Review the finished flow on the canvas, then publish when you're ready. Learn more.

You can also run these searches programmatically instead of using the Search UI, by setting childOrgIds or includeAllChildOrgs when you create a search job with the Search Job Management API.

Learn more.

We've enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with new and updated dashboards, monitors, and field extraction rules (FERs), built on the latest collection mechanism.

• Added new and updated dashboards, FERs, and monitors for the following apps:
  • Active Directory 2012+ (JSON)
  • Amazon GuardDuty
  • Artifactory 7
  • AWS WAF
  • AWS WAF CSMA
  • Azure Audit
  • ChatGPT Compliance
  • Cisco Meraki
  • Cisco Umbrella
  • Cloudflare
  • Enterprise Audit - Cloud SIEM
  • Heroku
  • Host and Process Metrics
  • Host Metrics
  • Linux
  • LiteLLM
  • Microsoft Office 365
  • Palo Alto Firewall 10
  • PCI Compliance for Amazon VPC Flow
  • PCI Compliance for AWS Cloudtrail
  • Windows 2012+ (JSON)
  • Windows 7+2008 (Legacy)
  • Windows CSMA
  • Windows Performance
  • Zscaler Internet Access
  • Zscaler Private Access
• Amazon ECS(With Container Insights and Traces). This app has been migrated from version 1 to version 2. Learn more.
• Claude Compliance C2C v2.0.1. The Claude Compliance C2C v2.0.1 adds Activity Feed collection alongside chat messages, with independent checkpoints and two new checkboxes in the source UI to control which data streams are collected (Collect Chat Messages and Collect Activities). Existing sources can be upgraded in place with no new collector setup needed. For more information, see Claude Compliance Source and Claude Compliance App.
• ChatGPT Compliance C2C v2.0.2. The ChatGPT Compliance C2C v2.0.2 expands event coverage with 6 new event types (AUDIT_LOG, AUTH_LOG, APP_AUTH_LOG, APP_LOG, CODEX_LOG, and CODEX_SECURITY_LOG), and widens the configurable polling interval from 5 minutes to 24 hours. Existing sources remain fully compatible; no upgrade is required. For more information, see ChatGPT Compliance Source and ChatGPT Compliance App.
• SumoLogic Terraform Provider v3.2.9. Released with new resource sumologic_lambda_invoke_action.
• Updated 18 setup guide apps. Legacy ARM-based Azure Metrics Collection has been changed to the latest Azure Metrics Source.

In a single conversation, ask questions in plain language to investigate your log data or learn how to use the platform, with no agent selection or query syntax required. Mobot determines your intent and responds accordingly:

• Log analysis. Mobot plans and runs multi-step analysis across your logs, returns inline results with notable findings, and recommends next steps.
• How-to answers. Mobot answers platform questions with information and reference links from official Sumo Logic documentation.
• Content creation. Create and manage monitors and dashboards through conversation, with a confirmation before anything goes live. Conversational playbook management for Automation Service is rolling out as well.
• Cloud SIEM investigations. Continue a SOC Analyst Agent investigation in Mobot with an insight's full context.

The former Query Agent and Knowledge Agent now work behind the scenes as the Log Analysis Agent and Platform Optimization Agent, and Mobot routes each prompt to the right one automatically.

• Pick a Light or Dark theme for the output.
• Set the resolution from 1,500 to 6,000 pixels for a sharper image on large displays.
• Export panels with their own time range. If you've overridden the time range for a panel, the exported file now uses that panel's time range instead of the dashboard time range (PDF and PNG only).

Learn more.