Query Agent

Query Agent is a natural-language-to-query translator embedded in Sumo Logic's Dojo AI platform, designed for SOC analysts and SREs who need to investigate incidents without memorizing Sumo Logic's proprietary query syntax. It converts plain-English investigative intent into precise, executable queries, reducing the barrier to deep log analysis. The agent is part of a broader Dojo AI suite that also includes a Summary Agent (which condenses fragmented alerts into actionable narratives), a Knowledge Agent (for product documentation queries), and a forthcoming SOC Analyst Agent for AI-assisted triage. It targets teams drowning in alert fatigue—Sumo Logic claims the agent helps filter out noise and repetitive manual work, accelerating investigations by summarizing fragmented alerts into coherent stories. The tool is gated to the Enterprise Suite plan, which costs $0.25 per credit for US deployments and $0.30 for Frankfurt or Global deployments, making it inaccessible to Essentials-tier customers.

How it works: an analyst types a question like "show me all failed login attempts from non-corporate IPs in the last 4 hours" and Query Agent generates the corresponding Sumo Logic query, executes it, and returns results. It also powers Mobot, a chat interface where users ask "how-to" questions about queries in plain language. The agent leverages Dojo AI's multi-agent reasoning system, which connects specialized agents to interpret data, test hypotheses, and provide transparent guidance. Sumo Logic's documentation emphasizes that the agent requires no syntax expertise—analysts describe their investigative intent and get executable queries back. The platform ingests up to 35 TB of logs daily (as seen at Samsung, a reference customer) and applies machine learning for anomaly detection, entity normalization, and risk assessment.

Market position: Query Agent competes directly with the query-building and AI-assisted investigation features in Splunk (via Splunk AI Assistant), Microsoft Sentinel (via Copilot for Security), Google SecOps (via Gemini), Datadog (via Bits AI), Elastic (via Elastic Assistant), New Relic (via AIOps), Coralogix (via AI-powered insights), and QRadar (via Watson). Unlike many rivals, Query Agent is not a standalone tool—it is locked inside Sumo Logic's Enterprise Suite, which bundles Cloud SIEM, UEBA, MITRE ATT&CK mapping, and premium threat intelligence feeds. This bundling makes it cost-prohibitive for small teams that only want the query translation capability. Sumo Logic positions it as part of an "agentic AI" platform, distinct from bolt-on AI assistants offered by competitors.

Honest trade-offs: the main drawback is performance—user reviews on G2 report slow alert processing and delays in query execution, which undermines the promise of "instant" answers. The UI navigation is described as unwieldy, with multiple clicks required to switch between agents and views. Pricing is opaque and volume-based (credits), making it hard to predict monthly costs for heavy query users. Finally, Query Agent only works within Sumo Logic's ecosystem—it cannot translate natural language into queries for other log platforms, limiting its utility in multi-tool environments.

Gated to Enterprise Suite plan only; priced at $0.25 per credit for US deployments and $0.30 per credit for Frankfurt or Global deployments.