I really appreciate how Sumo Logic correlates incidents from different platforms into insightful signals, giving analysts a comprehensive view for incident investigation, especially on the SIEM side. Its strongest feature for me is the integration, particularly with the MCP server and the SOC analyst agent, which embeds smoothly into our workflow to provide new insights and correlated activities. I also like the detection engineering and rule set fine-tuning capabilities with MCP integration. The cloud-first model makes setup easy, with minimal maintenance since there's nothing on-premise. The fact that everything ultimately got delivered, like custom parsers, is definitely a plus.

Many of the applications that we use is supported by Sumo

Setting up data collections and reading the logs is pretty intuitive. So is the UI