Sumo Logic Service Release Notes

Create Credit Usage Alerts (Manage)

Mon, 06 Apr 2026 00:00:00 GMT

We’re excited to introduce the new Create Usage Alert button in our Accounts Overview page. This enhancement allows you to quickly create a monitor for 70% and 90% credit usage thresholds, improving proactive credit usage monitoring and helping you take timely action before usage reaches critical levels.

Apps, Solutions, and Collection Integrations - March Release

Tue, 31 Mar 2026 00:00:00 GMT

New Release

We’re excited to announce the release of the following apps for Sumo Logic.

Amazon SageMaker. The Amazon SageMaker app provide insights into CloudTrail, CloudWatch Logs, and performance metrics for your Amazon SageMaker service. Learn more.
Azure Firewall. The Azure Firewall app enables centralized visibility into firewall health, network and application rules, threat intelligence, and IDPS events. Learn more.
Azure Subscription. The Azure Subscription app centralizes the collection and analysis of activity logs, enhancing security, operational visibility, and compliance monitoring. Learn more.
Data Volume for MSSP. The Data Volume for MSSP app provides centralized visibility into data usage across child organizations by type, tier, category, and source. Learn more.
Apache Hadoop - OpenTelemetry. The Apache Hadoop - OpenTelemetry app delivers end-to-end visibility into cluster health, performance, and resource utilization through logs and metrics. Learn more.
OpenLLMetry. The OpenLLMetry app enables end-to-end observability of LLM applications by collecting traces, metrics, and events across prompts, responses, latency, and errors. Learn more.

Enhancements

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

Abnormal Security. Added monitor alerts to accelerate incident response and updated the existing dashboards to enhance panel queries. Learn more.
AWS Lambda Extension. The Sumo Logic AWS Lambda Extension v1.4.0 now supports Lambda managed instance runtime and adds deployment support for two new AWS regions: ca-west-1 and eusc-de-east-1. This update enhances runtime compatibility and expands regional availability, enabling more flexible and scalable deployments. Learn more.
Azure Security. Updated the Microsoft Defender for Cloud Apps and Microsoft Entra ID Protection apps with refreshed content and new monitor alerts.
Cato Networks. Updated the Cato Networks app with enhanced dashboard panels and monitor alerts to ensure rapid incident response and regulatory compliance. Learn more.
Cisco Meraki - C2C. Added monitor alerts along with the Network Traffic Overview dashboard to enable continuous tracking of network traffic patterns, insecure port usage, and geo-based risks in Cisco Meraki, helping quickly detect anomalies and strengthen network security. Learn more.
AWS CloudTrail. Added monitor alerts along with the Root User Monitoring dashboard to provide real-time visibility and detection of high-risk root user activities and critical security events in your AWS environment. Learn more.
Duo Security. Added monitor alerts along with the Activity Events dashboard and Users Overview dashboard to provide visibility into administrator activity and user security posture in Duo Security, helping strengthen overall access control. Learn more.
Google Workspace. Added monitor alerts along with the Google Workspace - Alert Center - Mobile Device Management dashboard and Google Workspace - Alert Center - Admin Actions dashboard to enable faster response and improved security posture n Google Workspace. Learn more.
Microsoft Graph Azure AD Reporting. Added monitor alerts along with the Sign-Ins Security Overview dashboard and Provisioning Error Analysis dashboard to provide comprehensive visibility into Azure AD authentication and provisioning activities, enabling faster detection and management of anomalies. Learn more.
Mimecast. Added monitor alerts along with Audit Events Overview, DLP Policy Monitoring, Hold Message Analysis, SIEM Logs - Overview, SIEM Logs - Threat Protection, and SIEM Logs - Email Processing and Delivery dashboards to enhance visibility into email traffic, threat detection, and data loss, strengthening Mimecast security posture. Learn more.
Microsoft Exchange Trace Logs. Updated the following documentations:
- Microsoft Exchange Trace Logs source. to use the Microsoft Graph API as the new data access endpoint, replacing the Office 365 reporting service that Microsoft will deprecate on April 8, 2026. Learn more.
- Microsoft Exchange Trace Logs app. Added monitor alerts along with the Security Overview dashboard to provide insights into email security to quickly detect risks and suspicious patterns within your Microsoft Exchange Trace Logs environment. Learn more.
Netskope. Added monitor alerts along with the Admin Audit & Compliance dashboard and Watchlist & Insider Threat dashboard to provide a deeper visibility into administrative activity and potential insider risks within your Netskope environment. Learn more.
Salesforce. Added monitor alerts to strengthen security and updated the existing dashboards to enhance panel queries. Learn more.
Sumo Logic Audit app. Added the Library Content - Monitors dashboard to the Sumo Logic Audit app to provide insights into monitors usage based on users working with monitors, deletions, and notifications. Learn more.
Workday. Added monitor alerts along with the Data Access and Exfiltration Risk dashboard, Security Posture dashboard, and Session Intelligence dashboard to enable visibility into data access risks, security posture, and user session behavior in Workday. Learn more.

Azure Subscription (Apps)

Thu, 26 Mar 2026 00:00:00 GMT

We're excited to introduce the new Sumo Logic app for Azure Subscription. This app enables you to collect, analyze, and monitor Azure cloud activity in a single, centralized platform. This integration enhances security visibility, operational monitoring, and compliance tracking across your Azure environment.

The app supports collection of key Azure Subscription metrics, including Latency (request response times) and Traffic (request volume), helping you better understand service performance and usage patterns across your Azure resources. Learn more.

Workday (Apps)

Tue, 24 Mar 2026 00:00:00 GMT

We’re excited to introduce new monitor alerts, along with the following dashboards, designed to provide deeper visibility into the authentication, user, and administrator activity within your Workday environment:

New Monitor Alerts and Dashboards for Netskope (Apps)

Fri, 20 Mar 2026 00:00:00 GMT

We’re excited to introduce new monitor alerts, along with the following dashboards, designed to provide deeper visibility into administrative activity and potential insider risks within your Netskope environment:

App Registration Authentication for Microsoft 365 Audit Source (Collection)

Fri, 20 Mar 2026 00:00:00 GMT

We are excited to introduce App Registration support as the recommended authentication method for the Microsoft Office 365 Audit Source. This enhancement enables a more secure and reliable way to collect Microsoft 365 audit logs by using Azure AD application-based authentication instead of user credentials.

With App Registration, you can authenticate using Tenant ID, Client ID, and Client Secret, allowing Sumo Logic collectors to securely access the Microsoft 365 Management Activity APIs. This approach aligns with Microsoft’s recommended best practices for service-to-service integrations. Learn more.

Expanded Capability for Searching Across Child Orgs (MSSPs)

Fri, 20 Mar 2026 00:00:00 GMT

We're excited to announce that you can now run search across child orgs with the View Organizations role capability. Previously, this functionality was limited to users only with Manage Organizations capability. Learn more.

Data Volume for MSSP (Apps)

Wed, 18 Mar 2026 00:00:00 GMT

We’re excited to introduce the new Sumo Logic Data Volume app for MSSPs, delivering detailed insights into data usage across all child orgs. With rich segmentation by data type, tier, category, collector, source, and host, the app enables precise analysis of ingest patterns at every level. Leveraging predefined dashboards it empowers MSSPs to efficiently monitor, analyze, and optimize ingest volume across their entire managed environment. Learn more.

Proofpoint TRAP Source (Collection)

Wed, 18 Mar 2026 00:00:00 GMT

We’re excited to introduce the new Sumo Logic source for Proofpoint TRAP, enabling seamless ingestion of message logs via the Proofpoint TRAP API. This integration provides enhanced visibility into email threats by delivering detailed insights on message disposition, detected threats, and policy actions. Security teams can now more efficiently identify, investigate, and respond to email-based attacks with improved context and analysis. Learn more.

Data Deletion Requests (Manage)

Mon, 16 Mar 2026 00:00:00 GMT

We're excited to announce that you can now delete the ingested data directly from Sumo Logic using deletion requests. This helps you to quickly remove unintentionally ingested sensitive data without contacting Sumo Logic Support. Deletion requests support multiple datasets, time ranges, customizable filters, and full audit tracking. Also, you can manage the requests programmatically using the Data Deletion Rules API. Learn more.

Manage Lookup Tables for MSSPs (Manage)

Thu, 12 Mar 2026 00:00:00 GMT

We are excited to introduce the ability to manage lookup tables within library content on our Manage Content tab. With this enhancement, MSSP administrators can conveniently push lookup table items in the Library folder to multiple child organizations at once, simplifying content distribution and management. Learn more.

Scheduled Report Support for Parent org Dashboards (MSSPs)

Thu, 05 Mar 2026 00:00:00 GMT

We're excited to introduce support for filtering the scheduled dashboard reports by child orgs. When setting up a scheduled report, select the required child org(s) from the Organization dropdown under the Select Variables section to receive a report that reflects data for your intended child organization. Learn more.

Sumo Logic Deployment in AWS Zurich Region

Tue, 03 Mar 2026 00:00:00 GMT

We are excited to announce the deployment of a new Sumo Logic service region in the Amazon Web Services (AWS) region located in Zurich, Switzerland, further expanding our global infrastructure to support customers across Europe. This new region enables organizations to deploy and operate their Sumo Logic environments with enhanced data residency, regulatory compliance, and reduced latency, while continuing to leverage the full capabilities of the Sumo Logic platform for log analytics, security monitoring, and observability. Learn more.

Apps, Solutions, and Collection Integrations - February Release

Fri, 27 Feb 2026 00:00:00 GMT

Enhancements

We’ve enhanced multiple Sumo Logic apps to improve visibility, usability, and proactive monitoring with refreshed queries, localized dashboards, and new monitor alerts.

Azure Security apps. Updated Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Graph Security with refreshed content and new monitor alerts to detect high-severity incidents, suspicious devices, and activity from embargoed or high-risk locations.
Data Volume. Added monitor alerts to track log ingestion, detect usage spikes or data gaps, and prevent unexpected credit overages. Learn more.
Enterprise Audit apps. Updated Enterprise Audit - Collector & Data Forwarding Management, Enterprise Audit - Content Management, Enterprise Audit – Cloud SIEM, Enterprise Audit - Security Management, and Enterprise Audit - User & Role Management with monitor alerts to improve compliance, detect misconfigurations, identify embargoed-location activity, and surface high-risk security events.
Enterprise Search Audit. Added the Enterprise Search Audit – Failures KPIs and Breakdowns dashboard and monitor alerts to track search reliability, performance, and cost-related risks. Learn more.
Flex. Added monitor alerts to help you detect ingestion spikes, prevent budget overruns, and control expensive queries by automatically flagging abnormal data usage and credit consumption before they impact costs or system stability. Learn more.
Infrequent Data Tier. Added monitor alerts that help you control costs and usage by detecting consumption spikes, expensive or failed queries, and abnormal user or module-level scan activity before they waste credits. Learn more.
SentinelOne. Added monitor alerts to help you detect high-risk threats, suspicious activity, and compliance violations in real-time, enabling faster response and stronger endpoint security. Learn more.

App deprecation

Security Analytics. The Security Analytics app has been deprecated and is no longer actively supported or recommended for use.

Macros (Manage)

Thu, 26 Feb 2026 00:00:00 GMT

We’re excited to introduce our new Macros feature, which enables you to define reusable query logic that can be referenced across multiple searches. This approach improves efficiency, promotes consistency, and makes complex queries easier to manage and maintain at scale.

Key features include:

Argument-based macros. Macros accepts arguments to dynamically adjust query behavior at runtime, enabling flexible and context-aware execution.
Nested macro support. Macros can call other macros within their definitions, allowing you to build modular, reusable query components.
Improved standardization of search logic. Macros help centralize commonly used filters, parsing rules, and aggregations, improving maintainability and ensuring consistent query behavior across teams.

Learn more.

Terraform Support of Token-Based Authentication for Secure HTTP Sources (Collection)

Mon, 23 Feb 2026 00:00:00 GMT

Previously, we announced token-based authentication for secure HTTP sources. Now we are happy to announce that the Terraform sumologic_http_source data source adds the token and base_url attributes to support token-based auth for HTTP sources. Learn more.

User-Based Role Assignment from the Parent Org (MSSPs)

Mon, 23 Feb 2026 00:00:00 GMT

We’re excited to announce that parent org administrators can now centrally manage default and user-specific role assignments for child organizations. This enhancement allows admins to assign custom roles for users accessing child orgs via SSO, reducing over-privileged access, eliminating per-org configuration overhead, and ensuring consistent role assignments across organizations. Learn more.

Manage Organizations for MSSPs - Source Template (Manage)

Fri, 13 Feb 2026 00:00:00 GMT

We're excited to announce the ability to manage source templates for enterprises with multiple organizations such as MSSPs (which typically have a parent organization with multiple child organizations). These source templates provide efficient, scalable data collection management by applying consistent setups across multiple collectors. Learn more.

Content Item Actions Available Directly From Navigation Menus (New UI)

Thu, 12 Feb 2026 00:00:00 GMT

We have reintroduced the ability to perform actions on content items directly from navigation menus in the new UI. You can now manage content more quickly without needing to open the Content Library first.

This enhancement reduces the number of clicks required to manage content, helping you work more efficiently and streamline everyday workflows. Learn more about our UI.

What’s new

Access actions from navigation menus. Perform actions directly from Recent, Library, and other navigation areas.
Edit content quickly. Open and modify items without additional navigation steps.
Delete without switching context. Remove content directly from where you are working.
Move items easily. Relocate content between folders without leaving the current view.
Share and export faster. Access common management options from the same menu.

Token-Based Authentication for Secure HTTP (Collection)

Tue, 10 Feb 2026 00:00:00 GMT

We're excited to introduce secure token-based authentication for HTTP sources. This new capability allows you to authenticate using a unique token in the request header, maintaining the existing HTTPS endpoint behavior while adding token validation per source.

Obtain the token to use in an auth header when you configure an HTTP source or regenerate the URL. To learn more, see:

note

Token-based authentication in the request header is supported for the following HTTP sources:

Token-based authentication in the request header is not supported for:

Sumo Logic Service Release Notes

Create Credit Usage Alerts (Manage)

Apps, Solutions, and Collection Integrations - March Release

New Release​

Enhancements​

Azure Subscription (Apps)

Workday (Apps)

New Monitor Alerts and Dashboards for Netskope (Apps)

App Registration Authentication for Microsoft 365 Audit Source (Collection)

Expanded Capability for Searching Across Child Orgs (MSSPs)

Data Volume for MSSP (Apps)

Proofpoint TRAP Source (Collection)

Data Deletion Requests (Manage)

Manage Lookup Tables for MSSPs (Manage)

Scheduled Report Support for Parent org Dashboards (MSSPs)

Sumo Logic Deployment in AWS Zurich Region

Apps, Solutions, and Collection Integrations - February Release

Enhancements​

App deprecation​

Macros (Manage)

Terraform Support of Token-Based Authentication for Secure HTTP Sources (Collection)

User-Based Role Assignment from the Parent Org (MSSPs)

Manage Organizations for MSSPs - Source Template (Manage)

Content Item Actions Available Directly From Navigation Menus (New UI)

What’s new​

Token-Based Authentication for Secure HTTP (Collection)

New Release

Enhancements

Enhancements

App deprecation

What’s new