Sumo Logic this week announced it is making a security information event management (SIEM) platform available on the Amazon Web Services (AWS) cloud.

Jabari Norton, vice president of partners and alliances for Sumo Logic, said the Sumo Logic Cloud SIEM Powered by AWS extends the reach of the Sumo Logic Continuous Intelligence Platform for analyzing data into the realm of cybersecurity.

The Sumo Logic Continuous Intelligence Platform is already hosted on AWS. The challenge the company faced was extending the reach of that platform to create a SIEM that can collect data from multiple third-party data sources spanning everything from on-premises IT environments to software-as-a-service (SaaS) applications, said Norton. Those capabilities make it possible to now analyze security data using machine learning algorithms to detect threats and correlate security intelligence, noted Norton.

The Sumo Logic Cloud SIEM is also tightly integrated with AWS security services such as Amazon GuardDuty and AWS CloudTrail in addition to all the cloud services that AWS continuously updates, added Norton. While the relationship with AWS is not exclusive, Norton said Sumo Logic has no plans to host of a version of its SIEM on any other public cloud at this time.

In effect, Sumo Logic is now applying the same observability capabilities it provides to IT operations and DevOps teams to analyzing security data. In theory, that approach should make it easier for all those teams to collaborate around a platform that aggregates data from across the extended enterprise. That’s critical because while security teams are mainly tasked with discovering vulnerabilities they typically need to rely on DevOps and IT operations teams to remediate them.

In the meantime, the rate at which security platforms are shifting to the cloud continues to accelerate in the wake of the COVID-19 pandemic. Security teams that now need to work from anywhere are finding it simpler and more cost effective to employ cloud platforms to analyze security data. In many cases, the rise of cybersecurity AI will soon force the cloud migration issue. Few organizations have the infrastructure resources required to aggregate the volume of data that is required to train an AI model. The need for those AI models is becoming increasingly pressing because the rate at which cybersecurity attacks are being launched is increasing beyond the abilities of any cybersecurity team, on their own, to analyze.

Of course, there is no shortage of SIEM platforms available in the cloud. Sumo Logic is betting many organizations will simply extend their existing subscriptions to now include a SIEM service.

It may still be some time before the bulk of security platforms employed by any organization reside in the cloud. However, at this juncture, it’s now more a question of time. The less time understaffed cybersecurity teams spend managing infrastructure themselves, the more time they should have available to uncover threats. The issue, of course, is finding the time and resources to make transition in the middle of what is now often a daily cybersecurity firefight.

An annual report published today by Sumo Logic, a provider of security tools delivered as a cloud service, highlights the degree to which security has fundamentally shifted in the age of the cloud.

Based on an analysis of data culled from more than 2,100 Sumo Logic customers, the report finds the attack surface has expanded considering as more organizations employ multiple clouds. The use of multiple clouds by organizations has grown 70% year over year, the report finds.

A full 59% of respondents are still only using Amazon Web Services (AWS), but the number of organizations employing multiple clouds now stands at 18%, with another 15% relying on both public clouds and on-premises IT environments.

Bruno Kurtic, vice president of strategy and solutions at Sumo Logic, said organizations clearly are relying more on the cloud, especially as IT teams continue to work from home to help combat the spread of the COVID-19 pandemic. Most digital business transformation initiatives revolve around a cloud application deployment, he noted.

While AWS remains the most dominant cloud platform, there has been a significant increase adoption of the Microsoft Azure cloud, according to the report. In fact, 8% of respondents said they are using Microsoft Azure only.

The report also notes that the use of multiple services within each cloud is expanding. A typical application running on Amazon Web Services (AWS), for example, can now access as many as 26 services, up from 15 last year. The top 10 adopted services in AWS are AWS Security Token Service, Amazon S3, AWS Key Management Service, AWS Identity Access Management, Sign In, AWS EC2, logs, AWS CloudTrail, SNS and AWS Lambda.

Most customers are making use of at least two AWS regions and have two AWS accounts, according to the report.

Kurtic noted the use of cloud-native technologies on these platforms has risen sharply as well. Over 85% of businesses are choosing Kubernetes to build and operate applications across multiple clouds, with more than 40% of the company’s customers using AWS employing some type of container orchestration capability. Overall, usage of Docker containers grew 9% in the last year, according to the report.

The adoption of serverless computing platforms has also grown sharply—37% of organizations employing AWS also make use of AWS Lambda.

In terms of tools employed by AWS customers, CloudTrail (60%), VPC Flow Logs (34%) and GuardDuty (22%) are the most widely employed.

Kurtic said the report also surfaced a slight shift in cyberattack patterns, especially since the beginning of the pandemic. More attacks originated in Russia and India. Overall, AWS regional centers in the U.S. and European Union (EU) were the top targets for cyberattacks.

As the attack surface continues to expand, the report suggests that organizations are evolving their approach to cybersecurity in response. Over 41% of Sumo Logic customers are using the company’s platform to monitor their source code repository, build/continuous integration, artifact repository, test, continuous delivery/pipeline, automation or release automation tools. That suggests there is more focus on employing best DevSecOps practices.

Less clear is to what degree those efforts will result in more secure IT environments. However, given the scope of the challenge at hand, more organizations are embracing best DevSecOps practices to secure cloud applications if they hope to have any chance of success.

What Is Amazon Detective?

Amazon Detective is an AWS security service that automates the heavy lifting of security investigations. Rather than requiring analysts to manually collect, correlate, and visualize log data from multiple sources, Detective continuously ingests that data, applies machine learning and graph theory, and surfaces an interactive model showing how your AWS resources behave and interact with each other.

The service moved from preview—where it debuted at AWS re:Invent 2019—to general availability in early 2020. Its goal is to cut the time it takes to identify the root cause of a security alert from hours or days down to minutes.

The Problem It Solves

Security tools such as AWS Security Hub and Amazon GuardDuty are effective at detecting anomalies and raising alerts. The harder challenge is investigating those alerts: tracing an unexpected API call, an unusual login, or a spike in traffic back to its origin.

Traditionally, a security team investigating a cloud incident has to:

• Identify all relevant log sources (CloudTrail, VPC Flow Logs, GuardDuty findings, etc.).
• Extract and normalize potentially terabytes of log data.
• Build custom dashboards or queries to correlate events across those sources.
• Repeat the process iteratively as new leads emerge.

For smaller organizations, this process is often simply out of reach—they lack the staffing and tooling. For larger organizations, the sheer data volume becomes the bottleneck. Dan Plastina, then VP for security services at AWS, described the situation plainly at launch:

“Gathering the information necessary to conduct effective security investigations has traditionally been a burdensome process, which can put crucial in-depth analysis out of reach for smaller organizations, and strain resources for larger teams. Amazon Detective takes all of that extra work off the customer’s plate, allowing them to focus on finding the root cause of an issue and ensuring it doesn’t happen again.”

Dan Plastina, VP Security Services, AWS

How Amazon Detective Works

Data Sources

Amazon Detective automatically ingests and processes log data from three primary AWS sources:

• AWS CloudTrail – API call history across your AWS infrastructure.
• Amazon VPC Flow Logs – Network traffic metadata at the VPC level.
• Amazon GuardDuty findings – Threat intelligence and anomaly detections already raised by GuardDuty.

No manual log pipeline setup is required. Detective handles ingestion continuously, and retains up to one year of aggregated data to support historical analysis.

Graph-Based Behavioral Analysis

Detective applies machine learning, statistical analysis, and graph theory to the ingested data. The output is an interactive graph model that maps relationships between entities—IAM roles, EC2 instances, IP addresses, user accounts, and API calls—and shows how their behavior changes over time.

This behavioral baseline is what distinguishes a genuine threat from a false positive. For example, if GuardDuty flags an unusual ConsoleLogin API call, Detective can immediately surface:

• Historical trends for that API call over days or weeks.
• A geolocation map of login attempts associated with that user or role.
• Related IP addresses, AWS accounts, and resources linked to the finding.

Multi-Account Aggregation

Amazon Detective is designed for enterprise-scale environments. According to Sebastien Stormacq, senior developer advocate at Amazon, the service aggregates data from up to 1,000 AWS accounts into a single security-owned master account:

“It is a multi-account solution that aggregates data and findings from up to 1,000 AWS accounts into a single security-owned ‘master’ account, making it easy to view behavioral patterns and connections across your entire AWS environment.”

Sebastien Stormacq, Senior Developer Advocate, Amazon

This is particularly valuable for organizations using AWS Organizations or running separate accounts per business unit, environment, or product line.

Key Capabilities at a Glance

Pricing

AWS confirmed at launch that there is no additional service charge to enable Amazon Detective. Customers pay only for the volume of data ingested from CloudTrail logs, GuardDuty findings, and VPC Flow Logs. Organizations already ingesting these data sources for other purposes should review the cumulative cost impact, as Detective adds an additional consumer of that data.

Real-World Perspective

Chris Farris, who led public cloud security at WarnerMedia and participated in the early access program, highlighted benefits for both large and small teams:

“It does the hard work of aggregating and analyzing high-volume telemetry sources. Larger organizations will see major efficiencies, and small teams will have access to information and tooling that they’d have a hard time collecting and building on their own.”

Chris Farris, Head of Public Cloud Security, WarnerMedia

Who Should Use Amazon Detective?

Amazon Detective is a strong fit for any organization running workloads on AWS that needs to investigate security alerts faster and with less manual effort. Specific use cases include:

• Security operations centers (SOCs) that triage GuardDuty findings at scale.
• Small security teams that cannot build and maintain custom log aggregation pipelines.
• Multi-account AWS environments where cross-account correlation is otherwise complex.
• Incident response teams needing rapid root-cause analysis with historical context.

If your organization already uses GuardDuty and CloudTrail—both of which are AWS best-practice recommendations—enabling Detective adds significant investigative depth with minimal additional configuration.

Summary

Amazon Detective addresses one of the most time-consuming tasks in cloud security: turning a raw alert into a confirmed finding with a clear chain of evidence. By automating log aggregation, applying graph-based behavioral analysis, and retaining a year of data across up to 1,000 accounts, Detective brings enterprise-grade investigative capability to organizations of all sizes—without requiring them to build the underlying data infrastructure themselves.

For teams already invested in the AWS security ecosystem, it is a logical complement to GuardDuty and Security Hub, shifting focus from detecting problems to understanding them.