AI built for the work your team actually does
DojoAI is embedded in your critical workflows. From alert triage to log analysis to platform optimization, here’s where teams see the difference.
Security operations
Investigate every alert, focus on real threats
In Sumo Logic’s own SOC, the SOC Analyst Agent automatically investigates 100% of Tier 1 alerts and delivers evidence-backed verdicts, reducing mean time to triage by 89%, and saving analysts 25 hours per week.
Build better threat response playbooks
Describe a workflow to Mobot and get a complete draft playbook in minutes. No node-by-node configuration or deep platform expertise required.
Hunt threats faster
Ask Mobot to search for suspicious activity in your environment using natural language. Just describe what you’re looking for and let Mobot surface the relevant evidence.
Observability
Investigate every alert automatically
Root Cause Agent starts investigating the moment an alert fires. It tests hypotheses across your logs and metrics and delivers an evidence-backed verdict, so on-call starts with the likely cause instead of a blank page.
Diagnose issues before users feel them
Ask Mobot to identify the source of slow applications, high error rates, or unexpected behavior. It guides you to the root cause and proactively surfaces anomalies your dashboards aren’t showing. No manual querying required.
Cut through the noise with machine learning
ML-powered anomaly detection continuously monitors for deviations. LogReduce and LogCompare group and compare log patterns across time to show what changed, and AI-driven alert grouping reduces noise so teams see the signal first.
Powered by DojoAI
Explore Sumo Logic’s multi-agent AI platform for intelligent security and cloud operations.
Additional resources
Understanding agentic AI for log analytics
AI platform thrives with huge data intake
Stop writing dumb AI security policies
The rise of shadow AIT
Stop writing dumb AI security policies: use threat models, not fear
AI in the SOC
FAQ
Still have questions?
Sumo Logic DojoAI is a multi-agent AI platform built to power intelligent security operations and incident response. It is designed to act autonomously while continuously adapting to evolving threats.
Mobot is the unified conversational interface of Sumo Logic DojoAI that connects users to specialized agents, turning natural language requests into actionable insights quickly and intuitively.
Yes. Mobot retains conversation and search history so users can resume investigations with full context and continuity.
SOC Analyst Agent, Mobot, and Sumo Logic MCP Server are available for these deployments.
However, because the Automation Service (playbooks) has not yet been introduced to FED, Conversational Playbooks via Mobot is not yet available for these deployments.
No. Customer data is never used to train AI models.
All Sumo Logic AI capabilities are designed to serve customer-specific outcomes within their own environment. Mobot uses a Large Language Model (LLM) via Amazon Bedrock, which processes data securely and does not retain or use customer information for training or other external purposes.
Traditional machine learning (ML) features, such as AI-driven alerts, generate models specific to each customer’s environment and are never shared or made public.
For more information, see the security and compliance page of our help docs.
Yes. DojoAI assists analysts with routine tasks and recommendations, but humans review, validate, and guide actions to ensure accuracy, compliance, and trust.
No.
All new AI capabilities undergo legal, compliance, and application security reviews prior to release. Reviews occur with every major update that introduces new analytics or processes previously unused data.
Yes. DojoAI leverages foundation models securely hosted through Amazon Bedrock.
Yes. Capabilities like Mobot and the SOC Analyst Agent process customer telemetry to perform investigations, run queries, and generate findings. All processing occurs securely within your platform context, and customer data is never used to train generalized AI models. Administrators can turn off DojoAI capabilities at any time through Feature Management or by submitting a support ticket.
Customers that previously opted out of Sumo Logic AI capabilities will not get access to these or future AI capabilities until they explicitly opt back in.
Sumo Logic AI capabilities follow strict legal, compliance, and security standards to ensure data minimization and fit-for-purpose processing.
- Customer data is never used to train AI models, shared externally, or used to improve global models.
- Data remains within the customer’s environment and is processed only to deliver results back to that customer.
- Sumo Logic applies strong safeguards and filtering to ensure sensitive data is handled securely and appropriately at all times.
Customers can opt out of capabilities that process customer data, including the SOC Analyst Agent and Mobot, at any time from Feature Management or by submitting a support ticket.
No. Customer data is never used to train AI models.
All Sumo Logic AI capabilities are designed to serve customer-specific outcomes within their own environment. Mobot uses a large language model (LLM) via Amazon Bedrock, which processes data securely and does not retain or use customer information for training or other external purposes.
Traditional ML features, such as AI-driven alerts, generate models specific to each customer’s environment and are never shared or made public.
For more information, see trust.sumologic.com.
No additional third parties have any access. DojoAI leverages foundation models securely hosted through Amazon Bedrock. When customer data is processed using Amazon Bedrock:
- Customer inputs and outputs are treated as Customer Content under AWS terms.
- AWS does not use Customer Content to train models or improve Amazon Bedrock.
- AWS may access Customer Content only as necessary to provide the service or comply with law.
- Third-party model providers do not have access to customer inputs or outputs.
- Customer inputs and outputs are not shared with model providers and are not used to train external models.
Customer data processed through DojoAI remains within Sumo Logic’s secure environment and is used only to deliver results for that customer. It is not shared with model providers.
DojoAI and classical ML features store data only temporarily to optimize performance:
- AI-driven alerts use a rolling 60-day data window, retraining weekly and expiring the oldest data automatically.
- Mobot may temporarily retain conversation history in a rolling window to improve conversational context and response accuracy.
All stored data follows Sumo Logic’s data retention and deletion policies, ensuring customer information is never retained longer than necessary.
Sumo Logic is currently reviewing AI compliance within a rapidly evolving framework, in particular ISO 42001, designed to help organizations implement AI responsibly.
Sumo Logic AI capabilities operate within our existing industry-recognized security and compliance framework, including FedRAMP Moderate, SOC 2 Type 2, HIPAA, PCI DSS 4.0.1, and ISO 27001:2022. These attestations govern the confidentiality, integrity, and protection of customer data.
Availability of specific AI capabilities may vary by deployment region (including FED) based on compliance boundary requirements.
The generative AI model is licensed and securely hosted via Amazon Bedrock, meaning it is not directly accessible by Sumo Logic, customers, or third parties.
All new AI capabilities and features undergo comprehensive legal, compliance, and application security reviews before release to ensure data protection, privacy, and regulatory alignment.
Recurring reviews are also conducted with every major update, particularly when a capability introduces new analytics or processes previously unused data types, to maintain ongoing trust and compliance.
AI features are on by default. We offer two methods for opting out.
In-product self opt-out: Beginning August 2026, platform administrators can opt out of all AI features directly within the product settings under Feature Management. Disabling AI at the admin level automatically exempts your tenant from any future AI feature rollouts.
Via your account team or support: You can opt out of specific AI features or all AI features by contacting your Sumo Logic account team or opening a support ticket. If you choose to opt out of all AI features, your tenant will automatically be exempted from future AI feature releases.
For a complete overview of everything included in Sumo Logic’s AI portfolio, click here.
Try it for yourself
Check out Sumo Logic for free today
