Staff Threat Research Engineer

Sumo Logic turns SOC analysts into decision makers. March 25, 2026 Sumo Logic is showing what it can do with Dojo AI agents at RSA 2026. The company announced expanded capabilities for its Dojo AI agents. They will deliver active remediation actions to close the threat detection, investigation and remediation (TDIR) loop. The challenge for security teams is the number of point tools in their stacks. Cloud adoption, identity sprawl, and distributed architectures have created a surge in data. While traditional SIEM platforms flag suspicious behaviour, they don't tell analysts what to do next. That gap forces manual response planning under pressure, stretching mean time to remediation (MTTR) and increasing risk. Chas Clawson, VP of Security Strategy at Sumo Logic, said, "The industry is redefining what a SOC does. "It's no longer enough to surface context and say, 'here's a suspicious login, go figure it out.' Our Dojo AI SOC Analyst Agent can now recommend, for example, 'This user has suspicious logins to three apps from these two locations. Click to temporarily suspend access as I help you investigate.' "We're closing the loop on TDIR with agentic workflows that guide analysts to faster and more confident decisions." How is Sumo Logic addressing this with Dojo AI? Sumo Logic is consolidating the data and the decision layers into a single platform. Logs serve as the system of record. Those are enriched in the Cloud SIEM and then passed to Dojo AI, which then delivers contextual recommendations. Those are then passed to the SOC analyst. What the analyst gets is more than just a set of actions. Dojo AI adds the reasoning for each step along with the action. The analyst is then able to determine if that reasoning makes sense and either act or look for a more detailed analysis. This is a critical process. Analysts learn from what they do and how the answer is arrived at. By providing the reasoning, the analyst is able to understand why the action is recommended. It creates a continuous learning loop for the analyst, which improves their skills and understanding of threats. Four agents, one platform. Sumo Logic is not shipping a single AI feature. It is building an agent ecosystem. Four agents now operate within the platform. * SOC Analyst Agent (Preview): handles automated to human-led investigations and delivers context-aware response recommendations. * Query Agent (GA): converts natural language intent into precise log searches, removing the need for complex query writing. * Knowledge Agent (GA): answers product questions using official documentation without forcing analysts out of their workflow. * Sumo Logic MCP Server (Preview): extends AI assistance across tools, preventing product boundaries from becoming process boundaries. The MCP Server deserves particular attention. Security stacks are fragmented by design. Different tools handle endpoint, identity, cloud, and network telemetry. An AI layer that cannot cross those boundaries has limited value. The MCP Server addresses that directly. All four agents operate on Sumo Logic's Logs for Security and Cloud SIEM foundation. That grounding matters for trust. AI recommendations are only as reliable as the data beneath them. High-fidelity data and explainable logic are not optional extras. They are prerequisites for analyst adoption. The SOC Analyst Agent remains in preview. The MCP Server is also in the preview stage. Both represent significant capability additions when they reach general availability. Organisations evaluating Sumo Logic now should factor preview timelines into procurement decisions. The AI SOC tools market is getting crowded. The AI SOC tools market is incredibly crowded. In the last week, Datadog AI launched its AI SOC analyst, and Dropzone AI launched its autonomous threat hunter. Splunk, Microsoft Sentinel, and CrowdStrike Falcon all offer AI-assisted detection and response capabilities. The distinction Sumo Logic draws is the integration of the data layer and decision layer within a single platform. Many competitors bolt AI onto existing architectures. Sumo Logic argues its approach grounds recommendations in higher-fidelity data from the start. The agentic workflow model also separates Sumo Logic from traditional SOAR platforms. SOAR automates predefined playbooks. Dojo AI agents reason across context and recommend actions. The difference is flexibility. Playbooks break when environments change. Contextual reasoning adapts. For security leaders evaluating platforms, the questions to ask are practical. Does the AI recommendation include explainable reasoning? Can analysts override or modify recommendations easily? Does the platform maintain audit trails for compliance purposes? Sumo Logic's emphasis on explainable logic suggests it understands these requirements. Enterprise times: what does this mean? Sumo Logic's direction is clear. The company is building toward a fully integrated TDIR platform where AI handles investigation friction, and analysts handle decisions. Whether that vision delivers at scale depends on data quality, integration breadth, and analyst trust. The foundations look credible. The proof will come in production deployments. The company also needs to make sure that it stays ahead of the rest of the field. If it doesn't, then it will start to lose ground to those around it. March 19, 2026 March 11, 2026

Sumo Logic expands Dojo AI with SOC Analyst Agent that recommends actions, not just alerts. 2026-03-24 23:03 Sumo Logic is pushing its Dojo AI platform further into decision territory at RSAC 2026, announcing expanded AI agent capabilities that go beyond surfacing context to actually recommending what analysts should do next. The company's new SOC Analyst Agent, now in preview, addresses a gap that has frustrated security teams for years: traditional SIEMs are... Read the original article: Hacking & Cracking For a security analyst, the day begins and ends in the Sumo Logic Cloud SIEM. It's the central hub for unifying security and observability data, designed to turn a firehose of enterprise-wide events into clear, actionable Insights. But the platform's AI-driven analytics are only as good as the data they... July 31, 2025 September 22, 2025 Antivirus & Malware Security firm Sumo Logic disclosed a security breach after discovering the compromise of its AWS account compromised last week. Sumo Logic is a cybersecurity company that specializes in cloud-based log management and analytics. The company disclosed a security breach after discovering that its AWS account was compromised last week. The... November 9, 2023