Sumo Logic MCP Server: search logs and Cloud SIEM from Claude, VS Code and Codex

• Searches your logs over a time range and returns counts or raw messages

  Runs a Sumo Logic log search for the time range you ask about and returns either grouped counts or the raw log lines. Searches stop after 2 minutes, so narrow ones work best.

  Try: “Search logs for any outbound connections to port 4444 in the last 48 hours”

  Read · runLogSearch

• Finds alerts by status, severity, monitor name or mute state

  Looks through your alerts and filters them by whether they are active, how severe they are, which monitor fired them and whether they are muted.

  Try: “Show me all active alerts from the last 24 hours”

  Read · alertsSearch

• Opens one alert or alert folder by its ID

  Fetches the details of a single alert, or a folder of alerts, when you already know which one you want.

  Try: “Show me the details of alert <id>”

  Read · alertsReadById

• Finds Cloud SIEM insights by severity, status, owner, entity or tag

  Lists Cloud SIEM insights that match filters such as severity, status, who they are assigned to, the entity involved, confidence or tags.

  Try: “Find all critical insights that are still open”

  Read · getInsights

• Opens one insight with its signals and the entities involved

  Fetches a single Cloud SIEM insight, including the signals that built it, the artifacts and the users, hosts or IPs involved.

  Try: “Show me insight <id>, including its signals and involved entities”

  Read · getInsight

• Lists every Cloud SIEM insight, page by page

  Pulls the full list of Cloud SIEM insights a page at a time, for summaries and reports across all of them.

  Try: “Summarize all insights created in the last 24 hours by severity”

  Read · getAllInsights

• Changes an insight's status, for example to In Progress or Closed

  Sets the status of a Cloud SIEM insight, such as moving it to In Progress or closing it. Needs the Manage Insight Status capability.

  Try: “Update INSIGHT-1234 status to In Progress”

  Write · updateInsightStatus

• Assigns an insight to a person or team

  Changes who a Cloud SIEM insight is assigned to. Needs the Manage Insight Assignee capability.

  Try: “Find all unassigned high-severity insights and assign them to <username>”

  Write · updateInsightAssignee

• Finds detection rules by category, severity, tag or whether they are on

  Lists Cloud SIEM detection rules filtered by category, enabled state, whether they are built-in or custom, score, severity, stream or tags.

  Try: “Show me all rules in the authentication category”

  Read · getRules

• Opens one detection rule, with its tuning if you want it

  Fetches a single Cloud SIEM detection rule by ID, optionally with the tuning expressions applied to it.

  Try: “Get details for rule ID <id>”

  Read · getRule

• Creates a rule that fires when something happens too often

  Adds a Cloud SIEM threshold rule, which raises a signal when matching events pass a count within a time window. Needs the Manage Rules capability.

  Try: “Create a threshold rule that fires when more than 10 failed logins occur within 5 minutes”

  Write · createThresholdRule

• Creates a rule that fires when a matching event appears

  Adds a Cloud SIEM match rule from a template, which raises a signal whenever an event matches the condition you describe. Needs the Manage Rules capability.

  Try: “Create a new match rule that detects SSH brute force attempts from the same source IP”

  Write · createTemplatedMatchRule

• Lists your dashboards

  Shows the dashboards in your Sumo Logic library that you are allowed to see.

  Try: “List my dashboards”

  Read · listDashboards

• Opens one dashboard and its panels

  Fetches a dashboard by ID, including its panels and the queries behind them.

  Try: “Get the current SIEM overview dashboard”

  Read · getDashboard

• Creates a new dashboard

  Makes a new dashboard in your library, for example with a panel built from a search you just ran. Needs the Manage Library capability.

  Try: “Create a new dashboard called "System Overview" with a panel for total log count per minute”

  Write · createDashboard

• Changes an existing dashboard, such as adding a panel

  Edits a dashboard you already have, for example adding or changing a panel. Needs the Manage Library capability.

  Try: “Add a panel for open Critical insights count to the SIEM overview dashboard and save it”

  Write · updateDashboard

• Lists your log partitions and their data tier

  Shows the partitions in your org, filtered by data tier and whether they are active, so searches can target the right data.

  Try: “List all active partitions in the frequent tier”

  Read · listPartitions

• Lists the custom fields set up in your account

  Shows the custom fields your account adds to logs, which helps the assistant write better searches.

  Try: “What custom fields do we have?”

  Read · listCustomFields

• Lists the rules that pull fields out of your logs

  Shows your field extraction rules, so the assistant knows which fields exist for which sources.

  Try: “What partitions and field extraction rules exist for security logs?”

  Read · listExtractionRules

• Used by the assistant behind the scenes

  Finds the right tool for a request

  Lets the assistant search the server's own tool list to pick the tools that fit your question.

  Try: “Which tools can help me investigate an alert?”

  Read · x_amz_bedrock_agentcore_search

Watch out for

• Broad searches can run up your bill

  One question can set off many log searches and retries. On Flex pricing that is scan cost, so keep questions narrow and watch usage. sumologic.com

• It can change SIEM insights and rules

  With the right role it can reassign or close insights and create detection rules. Clear those scopes at sign-in if you only want to look. sumologic.com

• It can create and edit dashboards

  It can add and change dashboards in your library when your role allows it. sumologic.com

Security advisories