https://cybertoolchain.io/tools/sumo-logic New releases and features in Sumo Logic, tracked by The Cyber Toolchain. en Fri, 30 Oct 2026 00:00:00 GMT https://www.sumologic.com/help/release-notes-service/2026/10/30/apps/ https://www.sumologic.com/help/release-notes-service/2026/10/30/apps/ Fri, 30 Oct 2026 00:00:00 GMT Sumo Logic adds CTI enrichment actions for ZeroFox V2, Case Management actions for CrowdStrike Falcon, and user metrics dashboards for GitHub Copilot⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Sumo Logic's GitHub Copilot app (v1.0.1) now adds user metrics dashboards and reflects the updated data schema. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/30/apps/ https://www.sumologic.com/help/release-notes-service/2026/10/30/apps/ Fri, 30 Oct 2026 00:00:00 GMT Sumo Logic adds CTI enrichment actions, CrowdStrike Case Management actions, and custom Jira priority support across five Automation service integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • ZeroFox V2 now adds new CTI enrichment actions to the integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Atlassian Jira Cloud integration now adds custom priority support for Cloud SOAR playbooks. • Atlassian Jira V2 integration now adds custom priority support for Cloud SOAR playbooks. • ThreatConnect V3 now adds tag modes to the Update Indicators action. • Claude Compliance v2.0.6 updates the Chats dashboard with tool information. Breaking changes: • CrowdStrike Falcon legacy Incident actions are deprecated and may be removed in a future release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/30/manage/ https://www.sumologic.com/help/release-notes-service/2026/10/30/manage/ Fri, 30 Oct 2026 00:00:00 GMT Sumo Logic adds self-service feature opt-in and opt-out controls for organizations directly in the Organizations UI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/28/collection/ https://www.sumologic.com/help/release-notes-service/2026/10/28/collection/ Wed, 28 Oct 2026 00:00:00 GMT Sumo Logic adds JSON Unroll for HTTP log sources, automatically splitting JSON arrays into individual log messages while preserving top-level metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • HTTP log sources now automatically split JSON arrays into individual log messages while preserving top-level metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/22/search/ https://www.sumologic.com/help/release-notes-service/2026/10/22/search/ Thu, 22 Oct 2026 00:00:00 GMT Sumo Logic in-app tabs now support Dashboards and Metrics alongside Log Search in the New UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends in-app tabs in the New UI to support Dashboard and Metrics tabs alongside Log Search, enabling all three to stay open in a single browser window without losing context — requires the `Enable in-app tabs` preference to be turned on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/19/manage/ https://www.sumologic.com/help/release-notes-service/2026/10/19/manage/ Mon, 19 Oct 2026 00:00:00 GMT Sumo Logic adds a Manage Features capability letting paid customers opt in or out of features from the Organizations UI without contacting support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Opt in or out of specific Sumo Logic features for your organization directly from the Organizations UI, without raising a support request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/16/manage/ https://www.sumologic.com/help/release-notes-service/2026/10/16/manage/ Fri, 16 Oct 2026 00:00:00 GMT Metrics transformation rules now support 400-day retention and 'Do Not Store', replacing the previous 15-day option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Metrics transformation rules now offer `Do Not Store` or `400 days` as retention options for matching metrics, and standardize aggregate retention for aggregated metrics to `400 days`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Existing metrics transformation rules configured with 15-day retention are automatically migrated to 400-day retention. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/14/apps/ https://www.sumologic.com/help/release-notes-service/2026/10/14/apps/ Wed, 14 Oct 2026 00:00:00 GMT New Sumo Logic app for Google Workspace Activities adds predefined dashboards for Gmail, Drive, Calendar, Meet, Gemini, and security activities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Sumo Logic app for Google Workspace Activities, collecting audit events via the Google Admin SDK Reports API to monitor user and administrator activity across Google Workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Provides predefined dashboards for Gmail, Drive, Calendar, Meet, and Gemini productivity services, plus security, identity, and administration activities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/12/collection/ https://www.sumologic.com/help/release-notes-service/2026/10/12/collection/ Mon, 12 Oct 2026 00:00:00 GMT Sumo Logic adds a new source for Google Workspace Activities, enabling collection and monitoring of Google Workspace activity data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new Sumo Logic source for Google Workspace Activities to collect Google Workspace activity data and monitor user events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/09/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/10/09/dashboards/ Fri, 09 Oct 2026 00:00:00 GMT Sumo Logic dashboards now auto-recalculate timeslice resolution when you zoom into a log panel time range.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds dynamic timeslice drilldown to dashboard log panels: click and drag to zoom into a time range and Sumo Logic automatically recalculates the query's timeslice and re-fetches the panel at finer resolution, enabling spike and anomaly investigation without editing the underlying query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/08/collection/ https://www.sumologic.com/help/release-notes-service/2026/10/08/collection/ Thu, 08 Oct 2026 00:00:00 GMT Sumo Logic adds a native OpenAI source to collect organization usage costs and audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new Sumo Logic source for OpenAI that collects organization usage costs and audit logs, covering API spending, user activity, project changes, and API key administration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/10/06/manage/ https://www.sumologic.com/help/release-notes-service/2026/10/06/manage/ Tue, 06 Oct 2026 00:00:00 GMT Sumo Logic scan budgets can now be scoped to specific request sources — Search API, AI Search (MCP), or Mobot — and managed via UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables scoping scan budgets to specific request sources, including `Search API`, AI Search (MCP), and `Mobot`, to control query cost per source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds full UI management of the `Stop all scans` action within scan budget configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Sat, 03 Oct 2026 13:01:58 GMT API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /v1/sourceTemplate: param platform (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /v1/sourceTemplates: param platform (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/30/apps/ https://www.sumologic.com/help/release-notes-service/2026/09/30/apps/ Wed, 30 Sep 2026 00:00:00 GMT Sumo Logic adds four new Automation Service integrations and expands Azure AD, CrowdStrike, and Cloud SIEM actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Initiate Delegated Auth`, `Exchange Device Code`, and `Reset User Password With Writeback` actions to the Azure AD integration under Delegated (Device Code Flow) auth, plus new resource fields `Authentication Type` and `Delegated Refresh Token`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Delegated (Device Code Flow) authentication support to the Azure AD integration alongside existing Application (Client Credentials) auth. • Adds `Get Insight Triage` and `Check Insight Triage Schedule` actions to the Sumo Logic Cloud SIEM Automation Service integration. • Adds `Check Submission Status` action and OAuth 2.0 (Client Credentials) authentication support to the CrowdStrike Falcon Sandbox integration. • Adds `Get Metric Data`, `List Metrics`, and `Get Metric Statistics` metric actions to the AWS CloudWatchLogs integration. • Migrates `Get Alert`, `Search Alerts`, and `Update Alert` actions in the Microsoft Graph Security integration to the new `alerts_v2` API. • Adds four new Automation Service integrations: AWS DynamoDB, Intel 471, Verity, and Mimecast V2. • Adds filtering support to the `List Users` action in the 1Password integration. Breaking changes: • The Microsoft Graph Security legacy `/security/alerts` endpoint is deprecated and will be retired on October 15, 2026; `Get Alert`, `Search Alerts`, and `Update Alert` now call `alerts_v2`, which is not a one-to-one replacement — some alerts may be unavailable through the new endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/29/apps/ https://www.sumologic.com/help/release-notes-service/2026/09/29/apps/ Tue, 29 Sep 2026 00:00:00 GMT New Sumo Logic app for Amazon Security Lake delivers unified AWS security visibility via OCSF-normalized events and pre-built dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new Sumo Logic app for Amazon Security Lake that provides unified visibility into AWS security activity across accounts and regions using OCSF-normalized events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Includes pre-built dashboards covering network, identity, application, and host activity to detect threats, investigate anomalies, and assess AWS security posture. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Sat, 26 Sep 2026 12:53:17 GMT API surface changed: −2 endpoints, 1 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Removed endpoint GET /v1/threatIntel/datastore/retentionPeriod • Removed endpoint POST /v1/threatIntel/datastore/retentionPeriod Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/25/search/ https://www.sumologic.com/help/release-notes-service/2026/09/25/search/ Fri, 25 Sep 2026 00:00:00 GMT Mobot gains a Data Volume skill to answer natural-language ingest and billing questions without manual queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the 'Data Volume' skill to Mobot's Platform Optimization Agent, enabling natural-language questions about ingest volume, tier usage, source-category breakdowns, and spend attribution — available to all users with no opt-in required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/22/apps/ https://www.sumologic.com/help/release-notes-service/2026/09/22/apps/ Tue, 22 Sep 2026 00:00:00 GMT AWS Observability v3.0.0 delivers a full rewrite with expanded region coverage, Terraform Module deployment, and next-gen app dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Terraform Module support for AWSO solution deployment, including release versioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands AWS region support to non-SAM regions and three newly supported regions: Asia Pacific (Melbourne), Asia Pacific (New Zealand), and Europe (Zurich). • Automatically configures appropriate Load Balancer policies for AWS regions launched after August 2022. • Adds next-generation application support with out-of-the-box dashboards, monitors, FERs, and metric rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/21/search/ https://www.sumologic.com/help/release-notes-service/2026/09/21/search/ Mon, 21 Sep 2026 00:00:00 GMT Search Job Management API goes OpenAPI-compliant, stateless, and adds parent-child org support for MSSP automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Search Job Management API is now fully OpenAPI-compliant, enabling auto-generated SDKs in any language and native integration with Postman and CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Long-running search jobs can now be polled via the Search Job Management API without session cookies, making them compatible with AI agents and Model Context Protocol (MCP) frameworks. • MSSPs and enterprise admins can now automate parent-child and cross-org searches via the Search Job Management API, a capability previously limited to the UI. Breaking changes: • The Search Job Management API no longer uses session cookies — any client that stored or sent cookies to authenticate requests must migrate to the `jobId`-based stateless request model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/09/10/manage/ https://www.sumologic.com/help/release-notes-service/2026/09/10/manage/ Thu, 10 Sep 2026 00:00:00 GMT Sumo Logic C3M APIs now GA, letting MSSP parent orgs programmatically push Cloud SIEM rules, monitors, and templates to child orgs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces the Content and Configuration Management (C3M) APIs (GA) for MSSP parent org users to programmatically push and sync Cloud SIEM rules, rule tuning expressions, Library content, monitors, and source templates across child orgs — replacing manual distribution through the Organizations UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Mon, 31 Aug 2026 20:48:30 GMT API surface changed: +7 endpoints, 5 modified • New endpoint GET /v1/multi-account-management/content/sync • New endpoint GET /v1/multi-account-management/content/sync/{jobId}/info • New endpoint GET /v1/multi-account-management/content/sync/{jobId}/result • New endpoint GET /v1/multi-account-management/content/sync/{jobId}/status • New endpoint POST /v1/multi-account-management/content/sync • New endpoint POST /v1/multi-account-management/content/sync/{jobId}/cancel • New endpoint POST /v1/multi-account-management/content/sync/{jobId}/retry • GET /v1/sourceTemplate: param fleetIds (query) added • GET /v1/sourceTemplates: param fleetIds (query) added • POST /v1/budgets: request body changed • POST /v1/otCollectors: request body changed • PUT /v1/budgets/{budgetId}: request body changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/31/manage/ https://www.sumologic.com/help/release-notes-service/2026/08/31/manage/ Mon, 31 Aug 2026 00:00:00 GMT Sumo Logic lets you provision the SOC Analyst Agent as part of a child org baseline, with configurable daily investigation limits. • Enables provisioning of the SOC Analyst Agent when creating or editing a child org baseline, with controls for 'Number of investigations per day' and optional overage alongside existing Logs, Metrics, Traces, and Cloud SIEM Enterprise baselines. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/31/apps/ https://www.sumologic.com/help/release-notes-service/2026/08/31/apps/ Mon, 31 Aug 2026 00:00:00 GMT Sumo Logic adds Druva app, four GA automation integrations, PostgreSQL support for Cloud SQL, and two new Terraform resources. • Adds two new resources to the SumoLogic Terraform Provider v3.3.0: `sumologic_async_aws_lambda_invocation` and `sumologic_s3_logging_lambda_enable`. • New Sumo Logic app for Druva - Platform Events enables monitoring of Druva via a webhook-based integration. • Four Automation Service Integrations are now generally available: AWS Lambda, DFIR-IRIS, Google Cloud Functions, and LaunchDarkly. • Google Cloud SQL source adds support for PostgreSQL instances. • Akamai SIEM API v1.2.26 adds parser path support. • Miro app and source updated to a new API version, removing dependency on the deprecated Audit Log API v2, with new out-of-the-box monitors added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/31/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/08/31/dashboards/ Mon, 31 Aug 2026 00:00:00 GMT Sumo Logic dashboards gain auto-refresh guardrails: hidden-tab pause after 10 min and panel exclusion after 5 consecutive failures. • Adds hidden tab pause guardrail: auto-refresh pauses when you navigate away from a dashboard tab for more than 10 minutes and resumes automatically on return. • Adds panel failure exclusion guardrail: a panel is dropped from auto-refresh after 5 consecutive query failures, preventing it from disrupting other healthy panels. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/25/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/08/25/dashboards/ Tue, 25 Aug 2026 00:00:00 GMT Sumo Logic dashboards now support time ranges beyond 32 days when backed by aggregate scheduled views or aggregate scheduled searches. • Extends dashboard query time ranges beyond the previous 32-day limit when using aggregate scheduled searches, aggregate scheduled views, or a combination of both. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/24/alerts/ https://www.sumologic.com/help/release-notes-service/2026/08/24/alerts/ Mon, 24 Aug 2026 00:00:00 GMT Scheduled searches with Save to Index now save unlimited results per run; the 512-result cap is removed. • Removes the 512-result-per-run cap for scheduled searches using the `Save to Index` alert type, so every result returned by a run is now saved to the view. • The `_raw` field is now empty for aggregate query results saved to a `ScheduledSearchView`; all values remain accessible in their individual named fields (e.g. `_count`, `batch`, `parsedfield`). Breaking changes: • For scheduled searches using the `Save to Index` alert type with aggregate queries, the `_raw` (Message) field is now empty — any downstream query that uses `parse` against `_raw`, searches plain-text keywords from the message body, or reads the Message column to get field values will break and must be updated to reference named fields directly. • The 512-result-per-run limit for `Save to Index` scheduled searches is removed; searches that run frequently (e.g. every 15 minutes) without a `limit` operator may now save significantly more data per run than before. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Sun, 23 Aug 2026 17:14:02 GMT API surface changed: 1 modified • POST /v2/search/jobs: request body changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Thu, 20 Aug 2026 14:12:23 GMT API surface changed: +5 endpoints, 12 modified • New endpoint DELETE /v2/search/jobs/{jobId} • New endpoint GET /v2/search/jobs/{jobId} • New endpoint GET /v2/search/jobs/{jobId}/messages • New endpoint GET /v2/search/jobs/{jobId}/records • New endpoint POST /v2/search/jobs • GET /v1/sourceTemplate: response schema changed • GET /v1/sourceTemplate/{id}: response schema changed • GET /v1/sourceTemplates: response schema changed • GET /v1/sourceTemplates/{id}: response schema changed • POST /v1/sourceTemplate: request body changed; response schema changed • POST /v1/sourceTemplate/{id}: request body changed; response schema changed • POST /v1/sourceTemplates: request body changed; response schema changed • POST /v1/sourceTemplates/{id}: request body changed; response schema changed • POST /v1/sourceTemplates/{id}/upgrade: response schema changed • POST /v1/upgrade/sourceTemplate/{id}: response schema changed • PUT /v1/sourceTemplate/{id}/status: response schema changed • PUT /v1/sourceTemplates/{id}/status: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/19/alerts/ https://www.sumologic.com/help/release-notes-service/2026/08/19/alerts/ Wed, 19 Aug 2026 00:00:00 GMT Scheduled Searches now support up to 10 independent notifications per search, all sharing one trigger condition. • Scheduled Searches now support up to 10 notifications per search, each configured independently, all sharing the same trigger condition and firing from the same search execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/17/search/ https://www.sumologic.com/help/release-notes-service/2026/08/17/search/ Mon, 17 Aug 2026 00:00:00 GMT Sumo Logic adds AI Parse Assist to auto-generate parse statements and field names from highlighted log text. • New AI Parse Assist feature automatically generates a parse statement and field names from any text highlighted in a log message, accelerating query building for complex or unfamiliar log formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Fri, 14 Aug 2026 09:48:36 GMT API surface changed: 6 modified • GET /v1/otCollectors/otCollectorsByName: response schema changed • GET /v1/otCollectors/{id}: response schema changed • GET /v1/plan/pendingUpdateRequest: response schema changed • POST /v1/otCollectors: response schema changed • POST /v1/sourceTemplate: param dryRun (query) added • POST /v1/sourceTemplates: param dryRun (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/13/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/08/13/dashboards/ Thu, 13 Aug 2026 00:00:00 GMT Sumo Logic Mobot gains a new skill to create dashboard panels from plain-language prompts. • New Mobot skill lets practitioners describe a desired panel in plain language, after which Mobot drafts the query, selects a visualization, and adds the panel to a new or existing dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/13/manage/ https://www.sumologic.com/help/release-notes-service/2026/08/13/manage/ Thu, 13 Aug 2026 00:00:00 GMT Sumo Logic adds a public API for creating and managing AWS S3 archive destinations for Installed Collectors. • New public API enables creating and managing AWS S3 archive destinations for Installed Collectors programmatically, complementing the existing UI flow for at-scale automation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/11/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/08/11/dashboards/ Tue, 11 Aug 2026 00:00:00 GMT Sumo Logic dashboards gain Shift+click drill-down on map charts, auto-populating Log Search with lat/long values. • Adds `Shift+click` on map chart points or lines in dashboards to drill down into that location's data, automatically redirecting to Log Search with the query updated with the corresponding latitude and longitude values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://api.sumologic.com/docs/sumologic-api.yaml https://api.sumologic.com/docs/sumologic-api.yaml Sat, 08 Aug 2026 05:27:07 GMT API surface changed: +2 endpoints, 3 modified • New endpoint GET /v1/featureSettings • New endpoint PUT /v1/featureSettings • POST /v1/oauth/clients: request body changed; response schema changed • PUT /v1/oauth/clients/{id}: request body changed • PUT /v1/oauth/clients/{id}/rotate: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/06/security/ https://www.sumologic.com/help/release-notes-service/2026/08/06/security/ Thu, 06 Aug 2026 00:00:00 GMT Sumo Logic adds `threatlookup` operator for searching threat intelligence indicators directly in log data. • New `threatlookup` operator enables searching threat intelligence indicators against log data in Sumo Logic queries. • Threat intelligence indicator search and Cloud SIEM entity enrichment now default to active indicators only. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/05/automation-service/ https://www.sumologic.com/help/release-notes-service/2026/08/05/automation-service/ Wed, 05 Aug 2026 00:00:00 GMT Sumo Logic lets you build and update Automation Service playbooks by describing them in plain language to Mobot. • Mobot now supports playbook creation and editing via natural-language chat: describe the automation you want, Mobot checks available integrations, asks clarifying questions, proposes a plan, configures each step, and saves the result as a draft for review and publishing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/08/03/manage/ https://www.sumologic.com/help/release-notes-service/2026/08/03/manage/ Mon, 03 Aug 2026 00:00:00 GMT Sumo Logic now tracks mid-subscription credit purchases as separate blocks, preserving original burn rates. • Tracks additional credits purchased mid-subscription as a separate credit block, so original credits continue burning at their original rate without being repriced. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/31/apps/ https://www.sumologic.com/help/release-notes-service/2026/07/31/apps/ Fri, 31 Jul 2026 00:00:00 GMT Sumo Logic adds new dashboards, FERs, and monitors across 18+ apps, plus a new Terraform resource for Lambda invoke actions. • Adds new and updated dashboards, field extraction rules (FERs), and monitors for Active Directory 2012+ (JSON), Artifactory 7, Azure Audit, ChatGPT Compliance, Cisco Meraki, Cloudflare Enterprise Audit - Cloud SIEM, Heroku, Host and Process Metrics, Host Metrics Linux, LiteLLM, Microsoft Office 365, Windows 2012+ (JSON), Windows 7+2008 (Legacy), Windows CSMA, Windows Performance, Zscaler Internet Access, and Zscaler Private Access. • Migrates Azure Metrics collection from legacy ARM-based collection to the latest Azure Metrics Source. • Adds new Terraform resource `sumologic_lambda_invoke_action` in SumoLogic Terraform Provider v3.2.9. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/31/search/ https://www.sumologic.com/help/release-notes-service/2026/07/31/search/ Fri, 31 Jul 2026 00:00:00 GMT Sumo Logic's Mobot can now create and update logs monitors from plain-language prompts, skipping the monitor form entirely. • Enables creation and updating of logs monitors in Mobot via plain-language prompts, with a review-and-confirm workflow before saving. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/30/search/ https://www.sumologic.com/help/release-notes-service/2026/07/30/search/ Thu, 30 Jul 2026 00:00:00 GMT Mobot, Sumo Logic's AI conversational assistant, is now GA with unified log analysis, content creation, and Cloud SIEM investigation in one interface. • Mobot is now generally available as a unified conversational interface — ask plain-language questions across log investigation, platform how-tos, and Cloud SIEM without selecting an agent or writing query syntax. • Log Analysis Agent performs multi-step log analysis, returns inline results with notable findings, and recommends next steps automatically. • Enables creation and management of monitors and dashboards through conversation, with a confirmation step before any changes go live. • Conversational playbook management for Automation Service is rolling out within Mobot. • Cloud SIEM integration lets SOC analysts continue a SOC Analyst Agent investigation inside Mobot with full insight context. • Automatic intent routing replaces manual agent selection — Mobot internally routes each prompt to the Log Analysis Agent or Platform Optimization Agent as appropriate. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/22/alerts/ https://www.sumologic.com/help/release-notes-service/2026/07/22/alerts/ Wed, 22 Jul 2026 00:00:00 GMT Sumo Logic Monitors now support Searchable Time, letting alerts evaluate logs based on when they became searchable. • Supports Searchable Time for Monitors, enabling alert evaluation based on when logs became searchable in Sumo Logic rather than event time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/10/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/07/10/dashboards/ Fri, 10 Jul 2026 00:00:00 GMT Sumo Logic dashboard PDF/PNG exports gain theme selection, up-to-6000px resolution, and per-panel time range support. • Adds Light or Dark theme selection when exporting dashboards to PDF or PNG and in scheduled reports. • Supports configurable export resolution from 1,500 to 6,000 pixels for sharper output on large displays. • Enables per-panel time range in PDF/PNG exports — panels with overridden time ranges now use their own range instead of the dashboard-level range. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/09/manage/ https://www.sumologic.com/help/release-notes-service/2026/07/09/manage/ Thu, 09 Jul 2026 00:00:00 GMT Sumo Logic monitor email notifications can now embed the triggering search query and result set inline. • Adds `includeQuery` and `includeResultSet` flags to monitor email notifications, embedding the search query and results directly in alert emails. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/08/manage/ https://www.sumologic.com/help/release-notes-service/2026/07/08/manage/ Wed, 08 Jul 2026 00:00:00 GMT Sumo Logic adds Notification Settings Standards policy to control timestamp format (Legacy or ISO) in alert payloads. • New Notification Settings Standards policy lets org admins choose between Legacy and ISO date/time formats for alert and recovery notification payloads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/07/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/07/07/dashboards/ Tue, 07 Jul 2026 00:00:00 GMT Sumo Logic Dashboards now lets you copy any panel to another dashboard without rebuilding the query. • New 'Copy to Dashboard' action enables copying an existing dashboard panel to another dashboard or a new dashboard, preserving the original query. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/07/platform/ https://www.sumologic.com/help/release-notes-service/2026/07/07/platform/ Tue, 07 Jul 2026 00:00:00 GMT Sumo Logic's Go To search bar now surfaces Library content, Monitors, and SLOs alongside navigation pages. • Enables Go To search bar to find dashboards, searches, and folders saved in the Library. • Adds Monitor discovery by name directly from the Go To search bar. • Adds SLO lookup from the Go To search bar without navigating to the SLO page. • Introduces no-match behavior: returns 0 results instead of unrelated suggestions when nothing meets the relevance threshold. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/03/dashboards/ https://www.sumologic.com/help/release-notes-service/2026/07/03/dashboards/ Fri, 03 Jul 2026 00:00:00 GMT Sumo Logic Dashboards now show scan estimates at both dashboard and section levels for clearer cost/data visibility. • Adds dashboard-level scan estimates: click the meter icon to view estimated scan data broken down by active and collapsed panels. • Adds section-level scan estimates: click the meter icon on any section header to view estimated scan data for panels within that section. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/02/apps/ https://www.sumologic.com/help/release-notes-service/2026/07/02/apps/ Thu, 02 Jul 2026 00:00:00 GMT Sumo Logic Next-Gen apps now support email notifications for future app upgrades, with self-service subscribe/unsubscribe. • Adds opt-in email notifications for Next-Gen app upgrades, including app name, new version, release notes, and a direct App Catalog link. • Enables users with the Manage Apps capability to subscribe or unsubscribe from upgrade notifications for apps installed by others. • Automatically removes upgrade notifications when a Next-Gen app is uninstalled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic https://www.sumologic.com/help/release-notes-service/2026/07/02/platform/ https://www.sumologic.com/help/release-notes-service/2026/07/02/platform/ Thu, 02 Jul 2026 00:00:00 GMT New Sumo Logic users and orgs now onboard directly into the New UI by default. • New UI is now the default onboarding experience for all new Sumo Logic users and organizations; Classic UI remains accessible via 'Switch to classic UI' in the left navigation menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sumo-logic