Skip to content

Commit 3de8ccc

Browse files
kimsaucekimsauce
committed
integrate demo material
1 parent 3090461 commit 3de8ccc

File tree

1 file changed

+185
-51
lines changed

1 file changed

+185
-51
lines changed

‎docs/platform-services/external-mcp-server.md‎

Lines changed: 185 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,24 @@
11
---
22
id: external-mcp-server
33
title: Sumo Logic MCP Server (Beta)
4-
description: tk
4+
description: Connect your AI tools to Sumo Logic via MCP. Query logs, manage insights, and investigate security incidents from Slack, IDEs, and custom applications.
55
---
66

77
import useBaseUrl from '@docusaurus/useBaseUrl';
88
import Tabs from '@theme/Tabs';
99
import TabItem from '@theme/TabItem';
1010

11-
<head>
12-
<meta name="robots" content="noindex" />
13-
</head>
14-
1511
<p><a href={useBaseUrl('docs/beta')}><span className="beta">Beta</span></a></p>
1612

1713
:::info
18-
This feature is in Beta. For more information, contact your Sumo Logic account executive.
14+
This feature is in closed beta. For more information, contact your Sumo Logic account executive.
1915
:::
2016

21-
Connect your AI tools directly to Sumo Logic to create a unified ecosystem powered by your observability and security data.
22-
23-
<!-- Check with MS and CP if we can use the Dojo AI graphic
24-
<img src={useBaseUrl('img/dojo-ai/mcp-server-overview.png')} alt="Sumo Logic MCP Server in the Dojo AI ecosystem" style={{border: '1px solid gray'}} width="800" />
25-
-->
17+
**Bring your own AI to the Dojo**. Connect your AI tools directly to Sumo Logic to create a unified ecosystem powered by your observability and security data.
2618

27-
The Sumo Logic MCP Server extends Dojo AI into an open, interoperable platform using the Model Context Protocol (MCP). Instead of building custom integrations or treating Sumo Logic as a separate data silo, the MCP Server makes your observability and security data directly accessible to your own copilots, proprietary models, and third-party AI systems.
19+
The Sumo Logic MCP Server makes Dojo AI the central hub of your AI ecosystem using the Model Context Protocol (MCP). Instead of building custom integrations or treating Sumo Logic as a separate data silo, you can connect your own copilots, proprietary models, and third-party AI systems directly to Sumo Logic's capabilities.
2820

29-
<!--The Sumo Logic MCP Server makes Dojo AI the central hub of your AI ecosystem using the Model Context Protocol (MCP). Instead of building custom integrations or treating Sumo Logic as a separate data silo, you can connect your own copilots, proprietary models, and third-party AI systems directly to Sumo Logic's agents and data.-->
30-
31-
Our MCP Server integrates seamlessly with [Query Agent](#), [Knowledge Agent](#), and [SOC Analyst Agent](#), enabling your external AI tools to collaborate with these agents.
21+
Our MCP Server integrates seamlessly with [Query Agent](#) and [Knowledge Agent](#), enabling your external AI tools to collaborate with these agents. As new agents become available (such as the upcoming SOC Analyst Agent), they will also integrate with the MCP Server.
3222

3323
<details>
3424
<summary>What is Model Context Protocol?</summary>
@@ -43,42 +33,95 @@ By implementing MCP, Sumo Logic enables your AI ecosystem to exchange data, cont
4333
The MCP Server provides a standardized interface between Sumo Logic and your AI tools:
4434

4535
1. **Connect your AI tools** using the MCP standard.
46-
1. **Access Sumo Logic data** through secure, permissioned interfaces.
47-
1. **Execute prompts** across multiple environments—IDEs, collaboration tools, or custom applications.
36+
1. **Query with natural language** to analyze data using Sumo Logic's capabilities.
37+
1. **Execute prompts across environments**—IDEs, collaboration tools, or custom applications.
4838
1. **Leverage Dojo AI agents** alongside your own models for unified analysis and response.
4939

50-
Your external AI systems can query logs, analyze dashboards, and collaborate with Sumo Logic agents—all through a single, consistent protocol.
40+
Your external AI systems can query logs, manage insights, analyze dashboards, and update records—all through a single, consistent protocol.
41+
42+
## Prerequisites
43+
44+
The Sumo Logic MCP Server is a fully managed gateway that integrates securely with Sumo Logic platform APIs and Dojo AI agents. To connect your AI tools to this gateway, you'll deploy orchestrator agents in your environment.
45+
46+
### Architecture
47+
48+
* **Sumo Logic provides** the MCP Server gateway (fully managed).
49+
* **You deploy** orchestrator agents that connect to the gateway.
50+
* **Powered by** Amazon Bedrock AgentCore.
51+
52+
For example, to enable MCP in Slack, you would deploy an orchestrator agent on AWS AgentCore runtime. This agent communicates with Sumo Logic's MCP Server gateway via standard MCP protocol, which then securely accesses Sumo Logic APIs and Dojo AI agents.
53+
54+
### Setup requirements
55+
56+
* MCP-compatible client application (Slack bot, IDE assistant, or custom application).
57+
* Orchestrator agent deployment platform (such as AWS AgentCore runtime).
58+
* Sumo Logic credentials for authentication.
59+
60+
Detailed configuration guides will be available as the feature becomes more widely available.
5161

5262
## What you can do
5363

5464
* **Bring the best AI for your stack**. Integrate proprietary models or third-party copilots with Sumo Logic's observability and security data while maintaining the scale, consistency, and security of a unified platform.
55-
* **Automate across your ecosystem**. Use Sumo Logic's telemetry as input for your AI-driven workflows, enabling smarter investigations and faster incident response. <!--emphasize HITL? **Accelerate workflows with AI assistance** Use Sumo Logic's telemetry as input for your AI-driven workflows, enabling faster investigations and response—with analysts staying in control of critical decisions. or.. **Accelerate investigations with AI assistance**
56-
Use Sumo Logic's telemetry to power AI-driven workflows that surface insights faster—while keeping security and operations teams in control of analysis and response decisions.-->
57-
* **Work where you work**. Execute AI-powered queries from your IDE, collaboration tools, or custom applications—no need to switch contexts.
65+
* **Accelerate workflows with AI assistance**. Use Sumo Logic's telemetry as input for your AI-driven workflows, enabling faster investigations and response with analysts staying in control of critical decisions.
66+
* **Work where you work**. Execute AI-powered queries from your IDE, collaboration tools like Slack, or custom applications without needing to switch contexts.
5867
* **Future-proof your strategy**. Add new AI technologies as they emerge while maintaining Sumo Logic's scale, security, and data governance.
5968

6069
## Example use cases
6170

6271
<Tabs
6372
className="unique-tabs"
64-
defaultValue="SOC"
73+
defaultValue="Slack"
6574
values={[
75+
{value: 'Slack', label: 'Slack investigation'},
76+
{value: 'IDE', label: 'IDE integration'},
6677
{value: 'SOC', label: 'Security operations'},
67-
{value: 'DevOps', label: 'DevOps and SRE'},
6878
{value: 'Custom', label: 'Custom workflows'},
6979
]}>
7080

71-
<TabItem value="SOC">
81+
<TabItem value="Slack">
82+
83+
### Investigate security incidents without leaving Slack
84+
85+
When your team receives a Cloud SIEM alert in Slack, your AI assistant can:
86+
87+
* Retrieve triage details and severity assessments generated by SOC Analyst Agent.
88+
* Search related entities (user accounts, IP addresses, system assets, attack chain context).
89+
* Query raw logs to find if other users experienced similar activity.
90+
* Update insight status (from new to in progress to closed).
91+
* Add investigation notes and comments for team visibility.
92+
93+
All of this happens conversationally in your Slack channel, with multi-tool calls handled automatically behind the scenes.
7294

73-
* **Unified threat investigation**. Connect your security copilot to Sumo Logic so it can query threat data, correlate signals, and collaborate with the SOC Analyst Agent for faster triage and response.
74-
* **Automated playbook execution**. Integrate your SOAR platform to trigger Sumo Logic queries and analysis as part of incident response playbooks, combining internal and external context.<!-- HITL? **AI-assisted playbook execution** Integrate your SOAR platform to trigger Sumo Logic queries and analysis as part of incident response playbooks. Your AI tools surface insights and recommendations while analysts maintain oversight of response actions.-->
95+
**Example workflow:**
96+
97+
```
98+
User: @bot what are the triage details? update the status to in progress
99+
100+
Bot: I've retrieved the triage information and updated the status to In Progress.
101+
102+
Verdict: MALICIOUS - Confirmed threat
103+
Severity: CRITICAL
104+
105+
Key Evidence:
106+
1. Phishing Email with Fake AWS Console URL
107+
2. Credential Harvesting - User dan.kent credentials stolen
108+
3. Post-Compromise Activity - AWS IAM user used for enumeration
109+
...
110+
```
75111

76112
</TabItem>
77113

78-
<TabItem value="DevOps">
114+
<TabItem value="IDE">
79115

80-
* **IDE-integrated troubleshooting**. Query logs and metrics directly from your development environment using natural language, with results informed by Sumo Logic's analytics and your own models.
81-
* **Incident analysis in Slack**. Connect your Slack bot to Sumo Logic to pull real-time observability data during incidents, enabling collaborative troubleshooting without leaving your conversation.
116+
* **Query logs from your development environment**. Connect GitHub Copilot or your IDE's AI assistant to Sumo Logic so you can troubleshoot production issues without leaving your code editor. Ask questions in natural language and get query results informed by Sumo Logic's analytics.
117+
* **Debug with full context**. When investigating errors or performance issues, your IDE can pull relevant logs, traces, and metrics from Sumo Logic directly into your development workflow.
118+
119+
</TabItem>
120+
121+
<TabItem value="SOC">
122+
123+
* **Unified threat investigation**. Connect your security copilot to Sumo Logic so it can query threat data, correlate signals, and access insights from SOC Analyst Agent for faster triage and response.
124+
* **AI-assisted playbook execution**. Integrate your SOAR platform to trigger Sumo Logic queries and analysis as part of incident response playbooks. Your AI tools surface insights and recommendations while analysts maintain oversight of response actions.
82125

83126
</TabItem>
84127

@@ -90,18 +133,82 @@ Use Sumo Logic's telemetry to power AI-driven workflows that surface insights fa
90133
</TabItem>
91134
</Tabs>
92135

93-
## Getting started
136+
## Available MCP tools
137+
138+
The MCP Server provides access to Sumo Logic capabilities through the following tool categories:
139+
140+
### Alerts management
141+
142+
* Get a specific alert or folder by ID
143+
* Search for alerts or folders with filters (status, severity, monitor, etc.)
144+
* Retrieve alert history for a time range
145+
* Find alerts related to a given alert
146+
* Resolve an alert by moving it to resolved state
147+
148+
### Dashboard management
149+
150+
* Create a new dashboard
151+
* Get a dashboard by ID
152+
* List all dashboards under Personal folder or viewable folders
153+
* Update an existing dashboard
154+
* Delete a dashboard
155+
156+
### SIEM & Insights
157+
158+
* Get insights with filtering (up to 10,000 results)
159+
* Get all insights without limit
160+
* Get a specific insight by ID
161+
* Get comments on an insight
162+
* Get insight history/changes
163+
* Get entities involved in an insight
164+
* Get triage information for an insight
165+
* Update insight status (new/inprogress/closed)
166+
* Assign an insight to a user
167+
* Add a new comment to an insight
168+
* Get AI-generated summary of a security insight
169+
170+
### Log search
171+
172+
* Search Sumo Logic logs with query syntax
173+
174+
### User management
175+
176+
* List all users in the organization with pagination
177+
178+
### Utility tools
179+
180+
* Parse time strings to epoch timestamps or get current time
181+
* Search for relevant tools given a context
182+
183+
All tools respect your Sumo Logic permission controls and access policies.
184+
185+
## When to use External MCP (and when not to)
186+
187+
Use External MCP for:
188+
189+
* **Conversational investigations**. Interactive queries and analysis through chat interfaces like Slack or IDE assistants.
190+
* **Multi-step workflows**. Combining multiple operations (query, update, comment) in a single natural language request.
191+
* **Real-time collaboration**. Getting AI-powered insights during team discussions in collaboration tools.
192+
* **Agent-to-agent communication**. Connecting your AI assistants with Sumo Logic's Dojo AI agents.
193+
194+
External MCP is designed for conversational, agent-level interaction where AI tools need to query Sumo Logic intelligently. For raw data access, our standard APIs are more efficient and cost-effective.
195+
196+
Do NOT use External MCP for:
197+
198+
* **Bulk data extraction**. Use the [Search Job API](/docs/api/search-job) instead for retrieving large volumes of data.
199+
* **Model training**. Use the [Search Job API](/docs/api/search-job) to pull data for training your own models (note: 100,000 record limit per job).
200+
* **High-volume automated queries**. MCP has significant token consumption costs that make it impractical for bulk operations.
94201

95-
You'll need an MCP-compatible client (IDE, copilot, or custom application). Initial setup involves configuring your MCP client to connect to the Sumo Logic MCP Server endpoint and authenticating with your Sumo Logic credentials. Detailed configuration guides will be available as the feature becomes more widely available.
96202

97203
## Security and data governance
98204

99205
Our MCP Server maintains Sumo Logic's strict security and compliance standards:
100206

101-
* **Permissioned access**. All integrations occur through secure, controlled interfaces
102-
* **Data sovereignty**. Your data never leaves your control
103-
* **No model training**. Customer data is never used to train AI models
104-
* **Audit trails**. All MCP interactions are logged for compliance and security review
207+
* **Permissioned access**. All integrations occur through secure, controlled interfaces.
208+
* **Data sovereignty**. Your data never leaves your control.
209+
* **No model training**. Customer data is never used to train AI models.
210+
* **Audit trails**. All MCP interactions are logged for compliance and security review.
211+
* **Multi-tenant isolation**. The MCP Server acts as a gateway with tenant-level security controls.
105212

106213
The MCP Server acts as a secure bridge, letting you extend your AI ecosystem without compromising visibility, control, or compliance.
107214

@@ -110,7 +217,11 @@ The MCP Server acts as a secure bridge, letting you extend your AI ecosystem wit
110217
<details>
111218
<summary>Which AI tools can connect via MCP?</summary>
112219

113-
Any AI tool, copilot, or application that implements the Model Context Protocol standard can connect to the Sumo Logic MCP Server. This includes popular IDEs with AI assistants, collaboration platforms with integrated copilots, and custom-built agents.
220+
Any AI tool, copilot, or application that implements the Model Context Protocol standard can connect to the Sumo Logic MCP Server. Examples include:
221+
222+
* **IDEs**: GitHub Copilot, VS Code extensions, JetBrains AI assistants.
223+
* **Collaboration platforms**: Slack bots, Microsoft Teams integrations.
224+
* **Custom agents**: Your own copilots and AI systems built on MCP-compatible frameworks like AWS AgentCore.
114225

115226
The MCP standard is still emerging, so compatibility may vary depending on your specific tools.
116227

@@ -119,39 +230,62 @@ The MCP standard is still emerging, so compatibility may vary depending on your
119230
<details>
120231
<summary>Does this work with existing Dojo AI agents?</summary>
121232

122-
Yes. The MCP Server is designed to work alongside your existing Dojo AI agents like Query Agent, Knowledge Agent, and SOC Analyst Agent. External AI tools connected via MCP can collaborate with these agents, creating a unified ecosystem where different models and capabilities work together.
233+
Yes. The MCP Server is designed to work alongside your existing Dojo AI agents like Query Agent and Knowledge Agent. External AI tools connected via MCP can collaborate with these agents, creating a unified ecosystem where different models and capabilities work together.
234+
235+
As new agents become available (such as SOC Analyst Agent), they will also integrate with the MCP Server, enabling your external tools to leverage their capabilities through natural language requests.
236+
237+
</details>
238+
239+
<details>
240+
<summary>Can MCP handle multiple operations in a single request?</summary>
241+
242+
Yes. The MCP Server supports multi-tool calls, meaning your AI assistant can perform multiple operations in response to a single natural language request. For example, asking "what are the triage details and update the status to in progress" can retrieve information and update records in one interaction.
123243

124244
</details>
125245

126246
<details>
127-
<summary>What data can external AI tools access?</summary>
247+
<summary>What operations can I perform through MCP?</summary>
128248

129-
External tools connected via the MCP Server can access the same data and capabilities available to Dojo AI agents, subject to the same permission controls and access policies configured in your Sumo Logic account.
249+
The MCP Server supports both read operations (queries, retrievals, searches) and write operations (updates, creates, deletes). You can query logs, retrieve insights, search for related entities, update statuses, add comments, manage dashboards, and more—all through natural language interactions with your AI tools.
130250

131-
This includes log queries, dashboard data, and account management operations.
251+
See [Available MCP tools](#available-mcp-tools) for a complete list of capabilities.
132252

133253
</details>
134254

135255
<details>
136256
<summary>How does this affect my Sumo Logic usage?</summary>
137257

138-
The MCP Server is a separately licensed capability. Contact your account representative or Support for information about pricing and how MCP Server usage may impact your data scanning and consumption metrics.
258+
The MCP Server is a separately licensed capability. Contact your account representative or Support for information about pricing.
259+
260+
:::note
261+
MCP operations involve significant token consumption. For bulk data retrieval or model training use cases, the [Search Job API](/docs/api/search-job) is a more cost-effective option.
262+
:::
139263

140264
</details>
141265

142-
### Learn more
266+
<details>
267+
<summary>Can I use MCP to train models on my Sumo Logic data?</summary>
268+
269+
No. MCP is designed for agent-level interaction, not bulk data extraction.
143270

144-
*Bring your own AI to the Dojo*.
271+
If you need to train models on data stored in Sumo Logic, use the [Search Job API](/docs/api/search-job) to programmatically retrieve your data. Note that Search Job API has a 100,000 record limit per job.
145272

146-
- [Dojo AI Overview](#) _(link to Dojo AI page)_
147-
- [Query Agent](#) _(link to Query Agent doc)_
148-
- [Knowledge Agent](#) _(link to Knowledge Agent doc)_
149-
- [Model Context Protocol Specification](https://modelcontextprotocol.io/) _(external link)_
273+
</details>
150274

275+
<details>
276+
<summary>Where does my agent run?</summary>
277+
278+
Currently, agents connected via MCP are hosted in your own environment, not within Sumo Logic's infrastructure. This gives you control over your AI models and processing while enabling them to query Sumo Logic data through the MCP Server.
279+
280+
</details>
151281

152-
<!-- In each agent doc (Query Agent, Knowledge Agent, SOC Analyst Agent), add at the bottom:
282+
## Additional information
153283

154-
### Extend with Your Own AI
284+
*Dojo AI power, directly in Slack—and everywhere else you work*.
155285

156-
Want to integrate your own copilots or AI models with [Agent Name]? Learn how the [Sumo Logic MCP Server](/docs/platform-services/mcp-server) enables you to connect external AI tools to Sumo Logic's agents and data.
157-
-->
286+
* [Dojo AI overview](#)
287+
* [Query Agent](#)
288+
* [Knowledge Agent](#)
289+
* [Search API](#) _(for bulk data retrieval)_
290+
* [Search Job API](/docs/api/search-job) _(for model training data)_
291+
* [Model Context Protocol specification](https://modelcontextprotocol.io/)

0 commit comments

Comments
 (0)