Alert fatigue is breaking SOCs. Sumo Logic says it has a way out.
The New Stack Carly Page
Sumo Logic says dumping all your logs into a SIEM just drowns analysts in noise, not answers. Their fix: filter first, group by entity, and let AI agents triage before humans ever see an alert.
Based on reporting by The New Stack, Carly Page — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Chas Clawson has a line he trots out often: buy a SIEM expecting a single pane of glass, and what you get instead is a single glass of pain. It's a decent joke, but it points at a real problem. For years the default security instinct has been to log everything on the theory that bad actors eventually surface in the pile. Clawson, Sumo Logic's VP of Security Strategy and a former NSA Red Team member, spent a recent webinar explaining why that theory keeps failing SOCs in practice — collection alone doesn't reduce risk, it just produces more alerts than any analyst can plow through.
His proposed fix is what he calls the funnel of fidelity: cast a wide net at ingestion, then aggressively strip noise on the way down until analysts see a short, prioritized list, ideally stitched into something resembling an attack timeline rather than a heap of unrelated pings. There's no shortcut here, he's clear about that. It takes both better tooling and better discipline, and increasingly it means restructuring workflows so agentic AI takes the first pass on alerts, freeing humans to focus on what actually deserves their attention.
A big piece of that restructuring is entity-centric detection — clustering signals around a specific user, host, service account, IP, or file hash instead of triaging every alert as its own isolated event. Clawson argues that trying to review each alert individually is simply a losing game given the volume most SOCs face. Group by entity, though, and disconnected pings from email security, EDR, and identity tools start forming a coherent picture. He also raised a newer wrinkle: non-human identities. Autonomous agents, in his words, have
My take — AI-written commentary, not fact-checked reporting
, he described an agent as basically a toddler with root access — no instincts, but full keys to the kingdom — and warned most SOCs don't even have the audit logs to notice if one gets socially engineered. On where AI genuinely helps, Clawson compares an agent to a new hire: give it clean data and proper context, and it performs well. Hand it raw, messy logs and ask it to hunt threats cold, and it wastes cycles just figuring out which field holds the source IP. That's why Sumo Logic still runs deterministic, rules-based detection for real-time alerting, with AI reasoning over the smaller, cleaned-up set of signals afterward rather than replacing the rules entirely. Trust, or the lack of it, shaped how the company built Dojo.ai, its agent platform — early users flatly refused another black box, so every agent action now traces back to the specific underlying query. Clawson framed the human-oversight question as a spectrum from human-in-the-loop to human-out-of-loop, and cautioned that the most cautious setting isn't automatically the safest option when attacks move as fast as they do now. On budgets, his advice runs backward from convention: figure out what you're actually trying to detect first, then decide what data supports that, rather than hoovering up everything and sorting it later. Sumo Logic tiers storage accordingly, cheap and low-touch for low-priority logs, pricier AI-ready processing reserved for what feeds real-time detection. And when budgets tighten, he says tool sprawl should be the first casualty, not headcount — consolidating overlapping point solutions is an uncomfortable conversation across teams, but it pays off more than letting everyone keep their favorite tool. He closed with a warning that echoes the early cloud-adoption era: skip building an AI strategy now, and expect to be obsolete soon. Webinar Takeaways: filler section pending.
Read more about this at: The New Stack