Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

From weeks to minutes: How Sumo Logic's historic baselining supercharges UEBA

Spotting threats fast and knowing whether they really matter is the name of the game in cybersecurity. That’s where user and entity behavior analytics (UEBA) comes in, and why Sumo Logic’s latest innovation, historic baselining, is a big deal. With this release, Sumo Logic has turned the old UEBA model on its head, delivering insights that used to take weeks of learning time in just minutes. Here’s how and why that’s a game changer.

SharePoint "ToolShell" zero day

Hats off to the great work the community and industry has done regarding the “ToolShell” attack against Microsoft’s On-Premise SharePoint servers. The goal of this article is to build on that great work and help Sumo Logic customers with on-prem SharePoint servers investigate and identify evidence within their environments.

Model Context Protocol (MCP) vs Model Control Plane (MoCoP): Why your AI security is screwed if you only have one

If you’re building AI systems with agents, plugins, and orchestration layers and you’re only thinking about how to route traffic, you’re halfway to being pwned. Everyone’s rushing to build a Model Context Protocol (MCP) — and that’s great. But almost no one’s talking about MoCoP — the Model Control Plane, which is just as important and arguably where the riskiest stuff happens. (Also, side note, who the hell keeps making these damn acronyms so confusing?

Enhance your cloud security visibility with the updated AWS CloudTrail app

For organizations operating in the cloud, visibility is everything. You need a reliable source of truth to answer “who did what, when, and where,” whether you’re investigating a security incident, chasing compliance goals, or monitoring operational activity. Enter the Sumo Logic CloudTrail App, your go-to solution for transforming raw AWS CloudTrail logs into meaningful, actionable insights.

So you're buying your first SIEM... here's how not to suck at it

Welcome to the chaos. You’ve been told you need a SIEM. Maybe it was your CISO. Maybe it was your auditor. Maybe your SOC is tired of stitching together logs with duct tape and Python scripts. Doesn’t matter — you’re now on the SIEM buying journey. Congratulations… and condolences. Let’s walk through how to actually buy your first SIEM without lighting your budget (and your team’s morale) on fire.

Ten new and updated apps for securing and monitoring your environments

Whether you rely on Sumo Logic for securing your systems, monitoring your infrastructure, or maximizing application performance, connecting to your tech stack is essential. That’s why we continuously release new apps and upgrade existing ones, ensuring you can easily connect to your stack and visualize key data with out-of-the-box dashboards. Let’s dive into some of the latest additions to our app catalog, designed to help you monitor, secure, and optimize your environment.

Lessons from the 2025 Security Operations Insights report

Sumo Logic’s 2025 Security Operations Insights report doesn’t just survey the field—it speaks for the SOC. From stacked queues and stale alerts to automation that never fires and dashboards that scroll but don’t inform, this report puts numbers behind what every analyst and CISO has felt for years: the system needs a reset. But this isn’t a story about failure. It’s a wake-up call—and a blueprint.

Why your DevSecOps team needs a log management solution

Not all log management and log analysis tools are created equal. With organizations like yours generating large amounts of log data, understanding how to manage, analyze, and secure these log files is key for maintaining system performance, meeting compliance requirements, detecting performance issues, and responding to incidents faster.

Stop writing dumb AI security policies: use threat models, not fear

Every time someone asks me about building their AI policy, I die a little inside. Not because it’s a bad question, but because my answer is always the same: “Can we not build it off pure fear for once?” Most people don’t understand how AI architecture works, so their first instinct is to panic. And, we’ve seen this movie before: cloud, mobile, bring your own device (BYOD).

Balancing act: Sumo Logic vs. Splunk in the high-wire world of modern security

Trying to stay ahead in cybersecurity can feel a bit like juggling gas-powered chainsaws while riding a unicycle across a tightrope—dangerous, noisy, and not for the faint of heart. Thankfully, security information and event management (SIEM) tools are your safety harness—keeping you steady, secure, and just far enough from the edge that you’re not plunging headfirst into the abyss of breached data, regulatory fines, and sleepless nights.