Logs for Security (AWS Built-In)

My clients use Sumo Logic Security  depending on their needs. Some of my clients are looking for network visibility and observability, while others focus on the security aspects, utilizing the Sumo Logic SIEMs.

Sumo Logic Security  offers a single dashboard and customization, which are the most valuable features. Additionally, it has a cost-effective structure because it is based on data storage and the number of scans, rather than uploading data. This cost model impacts the customers positively by offering a more straightforward pricing structure.

In terms of improvement, feedback indicates there is a need for a local data center in my country. This is crucial to sell to the government and financial sectors as they require data retention within each country.

I have approximately three months of experience working with Sumo Logic Security.

The stability is quite high because it is maintained by the vendor.

The tool has high scalability because everything is based in the cloud.

The security solution is complex because it involves a lot of management. However, compared with other similar solutions, it is quite straightforward.

The pricing structure for Sumo Logic Security is based on two elements: data storage and the number of scans. This makes it more cost-effective because other solutions often include a third element in their pricing.

During this evaluation, I considered multiple criteria for the Sumo Logic Security solution. Based on these criteria, I rate the solution as an eight out of ten due to its effective features and pricing.

We primarily use Sumo Logic as a SIEM , Security information and event management tool. It serves as a Cloud SIEM  and is utilized for alert monitoring, insight monitoring, and as a continuous intelligence platform.

The Log Analytics platform is the most effective. If we cannot find the data in other tools, like email security or NDR, we can fetch those logs in the Log Analytics platform of Sumo Logic. That is the one best feature that I can suggest.

The correlation rules and log mapping are not as mature compared to other SIM tools like Splunk. Sometimes logs will not fetch, and there are issues if the log volume exceeds a threshold. Not every tool is integrated with Sumo Logic. The response time for their support could be better, and it is not very user-friendly.

I've been using hte solution for two years.

There are stability issues. Sometimes logs will not fetch, and if there are many records, the system may stop or the UI may become unresponsive.

The support team is not very good. They don't provide support on call and have a response time of forty-eight hours, which is not instant support.

Neutral

 I'm not sure about the pricing.

I don't recommend this product.

I'd rate the solution six out of ten.

We use Sumo Logic Security for logging purposes. We store and monitor application logs and VPC flow logs in the solution.

Sumo Logic Security is a good solution for searching the logs and identifying the issues. Sumo Logic Security searches the logs to identify issues easily. Suppose we got an issue related to the application 500 error. We store the application logs in Sumo Logic Security. We can easily search those logs to identify where exactly we are facing the application 500 error.

Sumo Logic Security is expensive, and its pricing could be improved.

I rate Sumo Logic Security a nine out of ten for stability.

Around ten users are using the solution in our organization.

I rate the solution an eight to nine out of ten for scalability.

We have two options for technical support. If we take the enterprise support, we get a reply within one or two hours. If you don't have enterprise support, you will get a reply in around one day or 12 hours, based on their availability.

The implementation process of the solution was good and not very difficult. You can easily integrate Sumo Logic Security with AWS or Kubernetes. Even new users who are aware of AWS can follow the documentation and easily deploy the solution.

The solution’s deployment doesn’t take more than 15 minutes for a knowledgeable person.

Storing logs in Sumo Logic Security is charged GB-wise, which is a little higher than other products.

We are mainly concentrating on networking. We use VPC products and application logs to monitor the genuineness of users who have logged in. We also store and monitor GuardDuty logs to see if someone is trying to access the same server multiple times. We are storing and monitoring WAF logs and GuardDuty logs. If someone faces any issues, we'll receive an email and take action based on it.

If someone tries to access one of the applications from a different country, we can search in Google and identify the location of that particular IP address. Sumo Logic Security identifies whether a particular IP address is low, medium, or high risk without the help of Google.

We can store logs in CloudWatch, but it is very difficult to search them in CloudWatch. We should know the query in order to do that. Searching for logs with Sumo Logic Security is very easy compared to CloudWatch. We have been using the solution for more than two years and haven't faced any issues with the solution's availability. I would recommend the solution to other users.

I would recommend Sumo Logic Security instead of AWS, CloudWatch, or CloudTrail. With Sumo Logic Security, you can capture and see all the logs in a single place. If some issues occur, you can log into the solution and verify all the logs. At an organizational level, we have multiple AWS accounts for different environments. Instead of logging in to all the AWS accounts, you can log in to Sumo Logic Security and verify everything.

Overall, I rate the solution a nine out of ten.

The product is a log aggregator of all the logs from all our environments, including AWS. Our infrastructure is deployed on AWS. We ship all logs to Sumo Logic. Based on the logs, we create alerts. These alerts are sent to an email ID, which creates tickets.

The solution is automated. It has a good number of extensions like CrowdStrike and AWS extensions. It is very useful. We can integrate threat intelligence solutions into the product.

The query of Sumo Logic is complex. It should be improved. The solution should improve its UI. FireEye, Splunk, and LogRhythm provide proper UIs. The solution should improve its scalability and stability.

Connecting the collector with Sumo is difficult if a collector or device is down. We have faced multiple challenges like this, and we are still facing these challenges. We recently raised a ticket to Sumo Logic to investigate the issue.

I have been using the solution for one and a half years. I am using the latest version of the solution.

I rate the tool’s stability a seven out of ten.

I rate the tool’s scalability a seven out of ten. In my current organization, there are around 18 people who have access to the product, including the security team. Apart from these, 30 people from different teams have access to the tool but do not have full admin access.

The support team is very cooperative. As soon as the team receives our tickets, a support person is assigned to us. They reach out to us and try to solve the problem.

Positive

The installation of the devices was good. The product is deployed on the cloud.

The product is costly. At the same cost, we can get other tools with better features and capabilities.

First-time users must decide how they want to use the tool. The product is very good as a log aggregator. If we want to use the solution as a SIEM console, it will not be that useful because it does not have the features a SIEM tool would have. It does not have analyzing or threat intel features. The product does provide the option of using extensions, but it does not have its own threat intel feature. Overall, I rate the solution a seven out of ten.

I use it for the log monitoring of our legacy site. We typically monitor the event timestamps.

The tool has key features like operability. It will alert the admins whenever a device is onboarded.

From the network segmentation side, there is some discrepancy in log onboarding. The tool needs to improve direct API integrations, login integration, native login integration, etc. 

I have been working with the product for three years. 

I would rate the tool's stability a nine point five out of ten. 

I would rate the product's scalability a nine out of ten. 

The support replies to us back within 24 hours of opening a ticket. 

Positive

The tool's setup is simple and straightforward.  A three-member team manages the solution. 

I would rate the solution a nine out of ten.