book

Security Intelligence with Sumo Logic

Name: Security Intelligence with Sumo Logic
ISBN: 9781835889763

by Bogdan Kireeve, Chas Clawson

January 2026

Intermediate to advanced

568 pages

15h 33m

English

Packt Publishing

Read now

Unlock full access

Preface
Free benefits with your book
Part 1: Understanding Sumo Logic and the Convergence of Security and Observability
Chapter 1: Introduction to Sumo Logic
Overview of Sumo LogicDigital transformationComplexity and attack surfaceNoiseControls and mitigationsGrowing attack surfaceCore features and capabilities of Sumo LogicThe modern architecture of Sumo LogicSummaryGet this book's PDF version and more
Chapter 2: The Role of DevSecOps
in Modern SecurityDefinition and principles of DevSecOpsOverview of the six DevSecOps principlesPrinciple 1: Shift left security with Security as CodePrinciple 2: Continuous monitoring and continuous deploymentPrinciple 3: Collaboration and shared responsibilityPrinciple 4: Automated security testingPrinciple 5: Compliance automation and vulnerability trackingPrinciple 6: Security awareness and transparencyFirst-principle thinking for DevSecOpsWhy DevSecOps matters and what happens when it's missingAdapting to an evolving threat landscapeSecurity as a business enablerExample: SolarTech CorpHow does Sumo Logic help make security a business enabler?Risk mitigation and cost efficiencyHow does Sumo Logic help mitigate risk in a cost-effective way?Speed without sacrificing securityWhere does Sumo Logic help with increased speed of development?AIOpsBuilding a security-first cultureWhere does Sumo Logic help?Adapting to an evolving threat landscapeWhere does Sumo Logic help?Improving collaboration across teamsSummaryReferencesGet this book's PDF version and more
Chapter 3: Measuring Security Outcomes and Performance
Why does measuring performance matter?The impact of security investments and metricsAligning security with business goalsDiffering views – two examplesContinuous securityStart-leftKPIs, SLIs, SLOs, what? How to define your performance criteriaSecOps KPI examplesDevSecOps KPI examplesSLIs and SLOsDefining the measurement process for your KPIs, SLIs, and SLOsStep-by-step guideMeasuring these criteria with Sumo LogicSummaryReferencesGet this book’s PDF version and more
Part 2: Getting Started with Sumo Logic
Chapter 4: Setting Up Your First Collector
Creating a Sumo Logic instance and basic setupIngesting operating system logsSetting up a Linux Installed CollectorChoosing the operating systemRunning the install commandAdding our first sourceConfiguring the sourceViewing the logsSetting up a Windows Installed CollectorAdding our Windows sourceConfiguring the Windows Event Log sourceViewing the Windows logsIngesting operating system metricsFinding the metrics sourceConfiguring the metrics sourceViewing the metricsThe App CatalogQuick Linux app setupSummaryGet this book’s PDF version and more
Chapter 5: Ingesting Data
Data collection methodsHosted CollectorsSetting up AWS CloudTrailSetting up Microsoft Office 365The Universal CollectorInfrastructure as Code (IaC) collectionAWS ObservabilityOpenTelemetry collectionSetting up an OpenTelemetry CollectorSetting up an OpenTelemetry Collector through an app in the App CatalogSetting up Application Performance Management (APM) for a Python applicationInstrumentationSetting up a Real User Monitoring (RUM) collectionSetting up an OTLP/HTTP sourceBringing it all togetherParsingField Extraction Rules (FERs)FER best practicesBest practices for data ingestionUsing source categories properlyWhen and why to use partitionsHow to use Role-Based Access Control (RBAC)How to pre-process your dataHow to use ingest budgetsChoosing your ingestion strategySmall organizations (1–50 devices)Mid-sized organization (50–2,000 devices)Large enterprises (2,000–100,000+ devices)Highly regulated or air-gapped environmentsSummaryReferencesGet this book's PDF version and more
Chapter 6: Analyzing Data
Querying logs deep diveNavigating Log SearchLog results in the UIAggregation results in the UIProblems with queryingQueryingQuery basicsQuerying problems resolved?...Different queries for different teamsLogReduce/LogCompareLive TailLookup tablesSubqueriesMobotLog search optimizationWhy is search optimization important?Key conceptsScanRetrievalComputeUsing scopes to reduce scanUsing keywords to reduce retrievalUsing extracted fields to reduce retrievalUsing scheduled views to speed up searchesCompute time: best practicesSummaryReferencesGet this book's PDF version and more
Chapter 7: Metrics
What are metrics and how do you collect them?Querying metrics deep diveAre metrics that important for security?Benefits to a security team and examplesBest practices for combining metrics and logsNavigating Metrics SearchQuerying metricsExample 1 – server CPU spikeExample 2 – application spans and tracesSummaryReferencesGet this book’s PDF version and more

Chapter 8: Alerting, Monitoring, and Visualizing Data
Monitor overviewBuilding an alert monitorMonitoring security logsThe ARPVisualizing dataBuilding our first dashboardPanel #1 – top 10 usersPanel #2 – outliers in failed loginsDashboard configurationSummaryReferencesGet this book’s PDF version and more
Part 3: Cloud SIEM and the Security Ecosystem
Chapter 9: Cloud SIEM
What does Cloud SIEM do?VisibilityContextNoiseNext-gen SIEM architectureThe data modelGetting data into Cloud SIEMThe data pipelineParsing versus mappingEnrichmentRecords, signals, and insightsWhat's a record?Record typesWhat's a signal?The importance of entities and tracking "Bob"SuppressionWhat's an insight?SIEM rules – configuration and usageRules ready to goSearch versus ruleMatch rulesAuthentication with MFAAlerting on traffic to certain countriesIdentifying a phishing emailThreshold rulesAggregation rulesOutlier rulesFirst-seen rulesChain rulesCreating the signalOn EntitySeverityTagsRule tuningThe MITRE ATT&CK coverage matrixThe foundation – rulesThe matrixSummaryReferencesGet this book's PDF version and more
Chapter 10: The Insight Engine
From signals to insightsDeduplication and suppressionSuppressed lists: Fine-tuning signal suppressionSignal clusteringSetting the severityCriticalityEntity activity scoreNavigating an insight: Deep diveThe Insights UIMetadataAI investigationInsight timelineThe storyCloud SIEM audit app: Deep-dive analytics on your SIEM solution's DNAReal insights and use casesA phishing scenarioA ransomware scenarioCustom insightsCloud SIEM best practicesSummaryReferencesGet this book’s PDF version and more
Chapter 11: The Automation Service and Playbooks
Why automation mattersAutomation in Sumo LogicCreating and managing playbooksApp CentralIntegrationsPlaybook templatesCreating a playbookTesting your playbooksHow to Connect PlaybooksReal-world examples of automated responsesGmail phishingChanges in user accountsSummaryReferencesGet this book’s PDF version and more
Part 4: Advanced Topics and Future Trends
Chapter 12: Bringing a Security Intelligence Program to Life with Sumo Logic
Cyber threat intelligence: beyond feeds and PDFsTypes of threat intelligenceTacticalOperationalStrategicPriority information requirementsDecision-making with threat intelligenceOODA loopCyber Kill ChainF3EADSumo Logic as the nucleus of actionable intelligenceBuilding a security intelligence program with Sumo Logic: a cross-team modelEstablishing intelligence flowOperationalizing intelligence across teamsEvolving intelligence maturityImplementationIntelligence feeds ready to goBring your own feedSTIX/TAXII collectionIntelligence APICloud SIEM rulesDashboards and disseminationSummaryReferencesGet this book’s PDF version and more
Chapter 13: Compliance and Reporting
Using Sumo Logic for compliance managementHolding yourself and vendors accountable‘Show me’ culture: turning promises into proofPractical accountability checklistGenerating reports and audit logsStep 1: Don't reinvent the wheel, raid the App CatalogDeploying a hosted collectorAdding a Microsoft Office 365 sourceChecking that logs are coming inInstalling the appStep 2: Build auditor-ready master dashboards (by mixing panels)Step 3: If required, schedule the evidence so proof shows up on timeStep 4: Log the logger to prove SIEM governanceStep 5: Align retention with the rules you're underStep 6: Share broadly, safelyEnsuring regulatory (continuous) complianceSummaryReferencesGet this book's PDF version and more
Chapter 14: The Future of Security Intelligence
The future of intelligent securityThe intelligent SOCWhat actually makes an SOC intelligentWhy an intelligent SOC matters nowThe evolving role of AI in securityThe new frontiers of risk: shifts in attacker strategyNon-human identities (NHIs)Shadow AISupply chain and CI/CDDeepfakesCognitive overloadAI as a co-analystWhere AI actually helps todayWhat AI should not be asked to doExplainabilityThe economics of defenseHow Sumo Logic applies AI to modern security operationsPreparing for what comes nextInstrumenting decisions, not actionsAssume non-human activity dominatesFocus on correlation, not signalsKeep humans in the loop, but reduce loadMeasure what mattersOther emerging trends and technologiesInternet of Things (IoT)Multi-agent AI attacksAutomated vulnerability research and exploit development (VRED)SummaryReferencesGet this book's PDF version and more
Chapter 15: Unlock Your Exclusive Benefits
Unlock this Book's Free Benefits in 3 Easy StepsStep 1Step 2Step 3Need Help
Other Books You May Enjoy
Index

Content preview from Security Intelligence with Sumo Logic

8 Alerting, Monitoring, and Visualizing Data

Collecting telemetry is easy. Doing something useful with it is where most organizations fall over.

By this point in the book, we've covered how to ingest and structure logs, metrics, and supporting telemetry into Sumo Logic. That data now lives in a centralized, highly scalable data lake, queryable in real time, enriched, and ready to work. This chapter concerns the moment when observability stops being passive and starts earning its keep.

Monitors, alerts, and dashboards are how raw telemetry becomes operational awareness. In Sumo Logic, monitoring is not bolted onto a single data type or locked into rigid, pre-defined thresholds. Instead, monitors can be created across logs, metrics, and Service ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781835889763

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Security Intelligence with Sumo Logic

by Bogdan Kireeve, Chas Clawson

8

Alerting, Monitoring, and Visualizing Data

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.