Hey folks, been evaluating our SIEM stack and we're hitting that classic mid-market scaling wall. We're about 150 engineers, cloud-native, with a decent stream of AWS CloudTrail, some app logs, and need to start building out proper detection rules.
We've been on a trial with Sumo Logic for about three months. The query power and their built-in apps (like the AWS Observability one) are genuinely impressive. But man, that invoice preview 😅. It's making the finance team ask some very direct ROI questions.
So I'm turning to the community: **For those who've gone with Sumo Logic in the mid-market range, did the value justify the cost?**
Here's our quick pro/con list from the trial:
**Pros:**
* The query language is intuitive, and dashboards are powerful once built.
* Data onboarding for AWS was almost too easy – that's a blessing and a cost risk.
* Their SOAR playbooks (built on Cortex) feel integrated nicely, which saves us stitching tools together.
**Cons/Concerns:**
* Ingestion costs feel unpredictable. We had one misconfigured log source that blew a week's budget.
* For the price, I'm wondering if we could get 80% of the way there with a combo of Elastic (for logs) and a dedicated SOAR.
* Their tiered pricing feels like it pushes you into features we might not need yet.
My core question is about **long-term cost control**. Is Sumo's feature set so efficient that it reduces enough manual labor to offset its premium? Or does it become a budget anchor?
Would love to hear from teams who made the choice, especially if you compared it to alternatives like Sentinel, Expel, or even building around open-source cores.
Keep automating!
Keep automating!
I'm a platform lead at a 250-engineer FinTech, running most of our logs, metrics, and cloud SIEM off Sumo Logic in production for about two years. We're multi-cloud (AWS primary, some Azure), heavy on Kubernetes, and ingest around 2 TB/day.
Core comparison for a mid-market team like yours:
1. **Cost Structure & Predictability**: The per-GB ingestion model is the main event. At our volume, list price runs ~$2k-$3k per TB ingested (depends on your commit). The hidden cost isn't just bad configs - it's how easy their parsers and field extraction add *derived* data, which also counts. Our bill fluctuated 15-20% month-to-month until we built internal dashboards to track expensive log sources.
2. **Deployment & Integration Effort**: For AWS, it's a 9/10. Deploy their CloudFormation stack, and within an hour you have dashboards for GuardDuty, Config, CloudTrail, etc. The flip side is that ease creates cost risk. You will spend a month tuning log source ingestion and setting granular exclusions to avoid that "misconfigured source" disaster.
3. **Where It Clearly Wins**: The query language and built-in apps. For a team that doesn't want to hire a dedicated Lucene expert, Sumo's query syntax is way more approachable for devs. Their Cortex SOAR integration is genuine; we automated maybe 30 common AWS security alerts into tickets and Slack pings with about a week of work.
4. **Where It Breaks / Limitation**: Custom app development and control. If you want to build a highly custom visualization or integrate a niche data source not in their catalog, you're in for a fight. Their API is solid for querying, but the UI framework is rigid. Also, at about 5+ TB/day, the price gets eye-watering, and you'd likely start a serious build-vs-buy conversation.
My pick for your described use case (150 engineers, CloudTrail + app logs, need detection rules): I'd stick with Sumo, but only if you can commit to a 12-month contract with a volume discount and appoint one engineer as the dedicated "log sheriff" to manage ingestion. If your team lacks the bandwidth for that ongoing tuning, look at Datadog's security offering - it'll still hurt financially, but the learning curve is less steep for ops.
Tell us your actual monthly log volume in GB and whether you already have a security engineer on staff; that makes the call binary.
That cost risk you identified is real. The ingestion model punishes you for success - more logs means a bigger bill, not just more insights. Their field extraction is a black box that adds significant hidden volume.
You're right to look at Elastic. For 150 engineers with mostly AWS and app logs, you could build what you need with OpenSearch or the Elastic Stack for a fraction of the cost. The trade-off is 2-3 FTEs to build and maintain it. If you have that platform capacity, it's a better long-term bet.
Sumo's value is only justified if your team lacks the time to build and you need the integrated SOAR and apps right now. Otherwise, you're paying a premium for convenience.
That bit about the integrated SOAR playbooks saving you from stitching tools together really resonates. That's a hidden cost people underestimate - the time sink of managing separate vendor relationships and making things talk to each other.
But your "blessing and a cost risk" line about AWS onboarding is the real red flag for a team your size. If it's that easy to ingest, your engineers will just... keep doing it, and finance gets a new surprise every month. Did your trial give you any tools to set hard ingestion quotas or alerts for budget overruns?
Asking because I'm looking at similar tools and that predictability is a huge deal for us.