Sumo Logic Extends SOC Analyst Agent to Recommend Remediation Actions, Accelerating and Enhancing Threat Detection, Investigation, and Response

News provided by

Mar 23, 2026, 12:05 ET

Live demonstrations of Sumo Logic Dojo AI Agents and MCP Server will be showcased at the RSA Conference, booth #6465

SAN FRANCISCO, March 23, 2026 /PRNewswire/ -- RSA Conference — Sumo Logic, the Intelligent Security Operations Platform, today expanded how AI agents can help reduce investigation friction and accelerate security decisions. At RSAC 2026, the company will demonstrate Dojo AI agents that go beyond surfacing context. The agents recommend specific remediation actions that can help close the loop on the full threat detection, investigation, and response (TDIR) lifecycle. These AI innovations will be on display at booth #6465 at the RSA Conference this week.

Security teams are drowning in telemetry, with more than half of security leaders surveyed reporting they have too many point tools in their stacks. Cloud adoption, identity sprawl, and distributed architectures have created a new challenge: data abundance without decision clarity. Traditional SIEM platforms excel at surfacing context, highlighting suspicious login patterns or flagging anomalous behavior, but stop short of guiding analysts on what to do next. That gap forces analysts to manually piece together response plans, slowing mean time to remediation and leaving critical decisions to human interpretation under pressure.

Sumo Logic is reimagining the SOC by consolidating the data layer and the decision layer. The platform starts with logs as the system of record, enriches signals through Cloud SIEM correlation, and applies Dojo AI to transform SIEM from a detection tool into a contextual recommendation engine to facilitate decisions. Instead of just alerting analysts, the SOC Analyst Agent actively recommends the next-best action with explainable reasoning.

"The industry is redefining what a SOC does," said Chas Clawson, VP of Security Strategy at Sumo Logic. "It's no longer enough to surface context and say, 'here's a suspicious login, go figure it out.' Our Dojo AI SOC Analyst Agent can now recommend, for example, 'This user has suspicious logins to three apps from these two locations. Click to temporarily suspend access as I help you investigate.' We're closing the loop on TDIR with agentic workflows that guide analysts to faster and more confident decisions."

AI that acts, not just detects

Sumo Logic will showcase how Dojo AI agents reduce friction and accelerate decision-making across the TDIR lifecycle. Those agents include:

SOC Analyst Agent (Preview) – helps analysts reduce MTTR with automated to human-led investigations, to context-aware response actions and recommendations.
Query Agent (GA) – converts intent into precise searches, eliminating complex query writing
Knowledge Agent (GA) – answers how the product works using official documentation inside the workflow
Sumo Logic MCP Server (Preview) – extends AI assistance across tools to avoid product boundaries becoming process boundaries

These agents operate on a trusted foundation of Sumo Logic's Logs for Security and Cloud SIEM, ensuring AI-driven recommendations are grounded in high-fidelity data and explainable logic.

"Sumo Logic's Dojo AI is transforming our Security Operations team by enabling natural language log analysis and delivering contextual insights that accelerate investigations," explained Scott Steenhoek, Sr. IT Cybersecurity Engineer, Sammons Financial. "The platform reduces noise, improves detection precision, and allows our analysts to focus on response rather than manual query building."

Sumo Logic wins two Global Infosec Awards

Today, Sumo Logic was also recognized by Cyber Defence Magazine's (CDM) 14th annual Global Infosec Awards for Next Gen SIEM and Pioneering AI SOC. These awards identify and honor "best of breed" and next-generation cybersecurity solutions from companies of all sizes, from startups to large enterprises.

RSA 2026 Activities

Live demonstrations of Dojo AI agents across TDIR workflows
Sponsored session: "Agentic AI in SecOps: What's Real, What's Noise"
Presented by Chas Clawson – Wednesday, March 25 @ 2:40 PM
Book signing: Allie Mellen, author of Code War: How nations hack, spy and shape the digital battlefield. Wednesday, March 25 @ 3:30-4:30 PM at Booth 6465

Resources

About Sumo Logic
Sumo Logic, Inc. helps make the digital world secure, fast, and reliable by unifying critical security and operational data through its intelligent platform. Built to address the increasing complexity of modern cybersecurity and cloud operations challenges, we empower digital teams to move from reaction to readiness—combining agentic AI-powered SIEM and log analytics into a single platform to detect, investigate, and resolve modern challenges. Customers around the world rely on Sumo Logic for trusted insights to protect against security threats, ensure reliability, and gain powerful insights into their digital environments. For more information, visit www.sumologic.com.

Any information regarding offerings, updates, functionality, or other modifications, including release dates, is subject to change without notice. The development, release, and timing of any offering, update, functionality, or modification described herein remains at the sole discretion of Sumo Logic and should not be relied upon in making a purchase decision, nor as a representation, warranty, or commitment to deliver specific offerings, updates, functionalities, or modifications in the future.

SOURCE Sumo Logic, Inc.