Sumo Logic this week announced it is making a security information event management (SIEM) platform available on the Amazon Web Services (AWS) cloud.

Jabari Norton, vice president of partners and alliances for Sumo Logic, said the Sumo Logic Cloud SIEM Powered by AWS extends the reach of the Sumo Logic Continuous Intelligence Platform for analyzing data into the realm of cybersecurity.

The Sumo Logic Continuous Intelligence Platform is already hosted on AWS. The challenge the company faced was extending the reach of that platform to create a SIEM that can collect data from multiple third-party data sources spanning everything from on-premises IT environments to software-as-a-service (SaaS) applications, said Norton. Those capabilities make it possible to now analyze security data using machine learning algorithms to detect threats and correlate security intelligence, noted Norton.

The Sumo Logic Cloud SIEM is also tightly integrated with AWS security services such as Amazon GuardDuty and AWS CloudTrail in addition to all the cloud services that AWS continuously updates, added Norton. While the relationship with AWS is not exclusive, Norton said Sumo Logic has no plans to host of a version of its SIEM on any other public cloud at this time.

In effect, Sumo Logic is now applying the same observability capabilities it provides to IT operations and DevOps teams to analyzing security data. In theory, that approach should make it easier for all those teams to collaborate around a platform that aggregates data from across the extended enterprise. That’s critical because while security teams are mainly tasked with discovering vulnerabilities they typically need to rely on DevOps and IT operations teams to remediate them.

In the meantime, the rate at which security platforms are shifting to the cloud continues to accelerate in the wake of the COVID-19 pandemic. Security teams that now need to work from anywhere are finding it simpler and more cost effective to employ cloud platforms to analyze security data. In many cases, the rise of cybersecurity AI will soon force the cloud migration issue. Few organizations have the infrastructure resources required to aggregate the volume of data that is required to train an AI model. The need for those AI models is becoming increasingly pressing because the rate at which cybersecurity attacks are being launched is increasing beyond the abilities of any cybersecurity team, on their own, to analyze.

Of course, there is no shortage of SIEM platforms available in the cloud. Sumo Logic is betting many organizations will simply extend their existing subscriptions to now include a SIEM service.

It may still be some time before the bulk of security platforms employed by any organization reside in the cloud. However, at this juncture, it’s now more a question of time. The less time understaffed cybersecurity teams spend managing infrastructure themselves, the more time they should have available to uncover threats. The issue, of course, is finding the time and resources to make transition in the middle of what is now often a daily cybersecurity firefight.

Sumo Logic Brings SaaS Monitoring to Kubernetes

Sumo Logic announced its Continuous Intelligence Solution for Kubernetes at the company’s Illuminate 2019 conference, marking the first delivery of its monitoring toolset as a software-as-a-service (SaaS) application purpose-built for Kubernetes environments. The solution analyzes machine data — logs, metrics, and events — to help engineering teams identify the root cause of performance bottlenecks across containerized workloads.

Google Anthos and Istio Integration

Alongside the Kubernetes announcement, Sumo Logic extended its existing partnership with Google to include support for Anthos, Google’s multi-cloud platform built on Kubernetes, and Istio, the open-source service mesh that Google has promoted as a standard for cloud-native networking. The integration positions Sumo Logic as an observability layer for organizations running workloads across multiple cloud providers via Anthos-managed clusters.

Out-of-the-Box DevSecOps Integrations

The Kubernetes offering ships with pre-built integrations covering both security and CI/CD tooling, reflecting the industry push toward DevSecOps. Supported tools at launch include:

• Security: Aqua Security, StackRox, Tigera, Prisma, and open-source Falco container runtime security
• Artifact management: JFrog
• Continuous delivery: Armory, CircleCI, Codefresh, and Harness

Built-in Falco support is notable because it provides runtime threat detection at the kernel level without requiring additional licensing, lowering the barrier for teams adopting container security practices.

Restructured Product Tiers

Sumo Logic also announced a repackaging of its Continuous Intelligence Suite into four distinct offerings:

1. Essentials Edition — Core observability capabilities for teams getting started.
2. Enterprise Operations Intelligence — Focused on monitoring and troubleshooting at scale.
3. Enterprise Security Intelligence — Targeting security analytics and compliance workflows.
4. Enterprise Suite — An all-encompassing tier combining operations and security intelligence.

All three enterprise-class packages were announced with volume discount availability. The new tiers were in beta at the time of the announcement.

Kubernetes Adoption Correlates Strongly with Multi-Cloud Strategy

Sumo Logic’s own customer research, published alongside the announcement, highlighted a clear correlation between multi-cloud adoption and Kubernetes usage among its customer base:

• 20% of customers using only AWS had deployed Kubernetes.
• 23% of customers using both AWS and Microsoft Azure used Kubernetes.
• 59% of customers using both AWS and Google Cloud Platform used Kubernetes.
• 80% of customers using all three major clouds (AWS, Azure, GCP) used Kubernetes.

The data suggests that Kubernetes adoption accelerates as organizations add cloud providers — consistent with the industry understanding that Kubernetes provides a workload-portability abstraction that reduces lock-in to any single cloud’s proprietary compute and orchestration services.

AWS Service Breadth vs. Depth, and the Lambda Inflection Point

The same Sumo Logic research report noted two additional findings about AWS usage patterns in enterprise IT:

• Enterprise organizations consumed an average of approximately 15 AWS services, out of more than 150 available — indicating that most organizations use a relatively narrow slice of the AWS catalog despite its breadth.
• Adoption of AWS Lambda reached 36% among Sumo Logic customers in 2019, suggesting that serverless computing had reached a meaningful adoption threshold.

Monitoring as a Requirement, Not an Option, in Microservices Architectures

Bruno Kurtic, Vice President of Product and Strategy at Sumo Logic, framed the Kubernetes monitoring announcement around a broader architectural shift. He noted that organizations are adopting Kubernetes partly to avoid cloud vendor lock-in, and that the same organizations are moving beyond traditional DevOps toward DevSecOps practices that embed security throughout the delivery pipeline.

Kurtic also pointed to the operational complexity introduced by microservices architectures. In monolithic application environments, teams could selectively monitor only their most critical systems. In cloud-native architectures, the inter-service dependencies mean that an unmonitored service can cascade failures across an entire application. Observability, Kurtic argued, becomes a baseline operational requirement rather than a best-practice add-on.

Kubernetes as the Foundation of Hybrid Cloud

The broader industry context underpinning the announcement is that Kubernetes has emerged as the de facto orchestration standard for containers, and as organizations mature their multi-cloud strategies toward true hybrid cloud architectures, Kubernetes is widely expected to serve as the common control plane. Sumo Logic’s SaaS-delivered monitoring play positions it to provide visibility across those distributed environments without requiring teams to operate their own monitoring infrastructure.

This article is based on reporting originally published on containerjournal.com and Sumo Logic’s announcements at Illuminate 2019.