diff --git a/cid-redirects.json b/cid-redirects.json index f2ba1100c6..065962513d 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -4682,8 +4682,9 @@ "/docs/integrations/sumo-apps/security-analytics": "/docs/integrations/sumo-apps", "/docs/integrations/microsoft-azure/microsoft-defender-for-office-365": "/docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-cloud-apps", "/docs/search/copilot": "/docs/search/mobot", - "/docs/search/copilot-unstructured-logs-beta": "/docs/search/mobot-unstructured-logs", - "/docs/search/mobot-unstructured-logs-beta": "/docs/search/mobot-unstructured-logs", + "/docs/search/copilot-unstructured-logs-beta": "/docs/search/mobot", + "/docs/search/mobot-unstructured-logs-beta": "/docs/search/mobot", + "/docs/search/mobot-unstructured-logs": "/docs/search/mobot", "/docs/manage/data-forwarding/amazon-s3-bucket": "/docs/manage/data-forwarding/forward-data-from-sumologic", "/docs/cse/signals": "/docs/cse/records-signals-entities-insights", "/docs/query/query-operators/aggregation-functions": "/docs/search/search-query-language/group-aggregate-operators", diff --git a/docs/search/mobot-preview.md b/docs/search/mobot-preview.md new file mode 100644 index 0000000000..17d11a53a9 --- /dev/null +++ b/docs/search/mobot-preview.md @@ -0,0 +1,252 @@ +--- +id: mobot-preview +title: Sumo Logic Mobot (Extended Preview) +description: Mobot is Sumo Logic's next-generation AI assistant that unifies log analysis and platform guidance in a single conversational interface with automated routing and higher-order reasoning. +keywords: + - mobot + - ai assistant + - artificial intelligence + - log analysis + - unstructured logs +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +
+ + + + + +:::info Participation requirement +Access requires a signed AI addendum. This applies to all future stages (public preview and GA) because Mobot processes raw log data. Contact your account team if you have not yet signed the addendum. +::: + +This preview introduces a new iteration of [Sumo Logic Mobot](/docs/search/mobot/) that functions as a conversational intelligence layer between you and your data. It understands intent from open-ended questions, plans and executes multi-step analysis behind the scenes, and delivers structured, narrative-driven answers with suggested next steps. Because Mobot carries context across turns, follow-up questions, refinements, and changes in direction feel part of the same flow. + +Your feedback directly shapes the product. See [Feedback](#feedback) below. + +## What's new + +Features and behavior described here are subject to change before general availability. + +| | Before | Now | +|:--|:--|:--| +| **[Interface and routing](#united-interface)** | Separate Query Agent and Knowledge Agent with manual selection | Unified interface with automatic routing to the right skill | +| **[Reasoning](#thinking-and-planning)** | Natural language to log query translation | Higher-order reasoning, planning, and implicit log analysis | +| **[Results rendering](#results-rendering)** | Query results open in Log Search | Query results render as structured table summaries inline in the conversation, plus option to open in Log Search | +| **[Anomaly surfacing](#results-rendering)** | Not available | Highlights unusual patterns and suggests next steps | +| **[Missing data sources](#configuration-gap-detection)** | Returns no results or an error | Detects missing partitions or indexes and provides setup guidance | +| **[Log support](#unstructured-logs-support)** | Structured and semi-structured logs | Structured, semi-structured, and unstructured logs | +| **[Conversation history](#conversation-history)** | 24 hours | Retained indefinitely (subject to change) | +| **[Feedback](#feedback)** | Thumbs up/down | Thumbs up/down + shareable conversation URL | + +### United interface + +You no longer need to choose between Query Agent and Knowledge Agent. Mobot handles this for you. + +Open Mobot by clicking **Mobot** in the left nav. Then type your question in the **Ask Something** field. + +
+
+Try asking:
+
+* A log analysis question about errors, trends, anomalies, or security events (for example, `Show me logs from last 15 minutes`).
+* A platform how-to question about configuration, setup, or best practices (for example, `How do I set up an OTel Collector?`).
+
+Mobot automatically routes your question to the appropriate skill, as seen here:
+
+
+
+### Thinking and planning
+
+While Mobot processes your question, it displays a **Thinking...** or **Planning...** indicator showing that it is identifying relevant data sources and analyzing the problem. Behind the scenes, Mobot selects relevant data sources, schema, lookup tables, and saved queries, infers time ranges based on context, and retrieves log data enriched with environmental context.
+
+### Multi-step analysis
+
+Mobot orchestrates multi-step analysis automatically. It translates your question into the appropriate analytical steps, applies multi-step reasoning to synthesize findings, and presents results as a structured response with suggested next steps.
+
+### Results rendering
+
+When Mobot returns results, they appear summarized inline as structured tables directly in the conversation, plus a shortcut button to expand on results in a separate Log Search view.
+
+In this example, Mobot summarizes what stands out at the bottom of the response, labeled **Notable**. For example, if `WARN` entries share an unusual pattern, Mobot flags them, explains what they may indicate, and asks whether you want to investigate further.
+
+
+
+Here's another example showing Mobot displaying inline results and summarizing key observations below it:
+
+
+
+### Clarification prompts
+
+Mobot interprets natural language questions even when they are incomplete or ambiguous. If your question is unclear, Mobot asks a targeted follow-up question to narrow intent before running a search.
+
+For example, asking `Show me logs from last 15 minutes` or `Show me all logs from the last 24 hours` without specifying a source prompts Mobot to ask which application, service, or log source you are interested in, with inline examples such as `kubernetes`, `nginx`, or `auth_logs`.
+
+
+
+
+
+Respond with a source name, source category expression, or any keyword related to what you are looking for. If your question falls outside available data or system capabilities, Mobot clarifies or redirects rather than returning an error.
+
+### Configuration gap detection
+
+When you request data from a source that has not been configured, Mobot detects the missing partition or index and provides step-by-step setup guidance rather than returning an empty result.
+
+For example, asking `Show me Cloud SIEM network records grouped by action` when Cloud SIEM is not enabled prompts Mobot to explain what is missing and walks you through how to enable it.
+
+This detection works reactively. When you ask a question that requires a specific data source, Mobot attempts the query and detects if the partition or data does not exist. Mobot cannot proactively scan your environment or generate a list of all unconfigured integrations.
+
+You can also use this capability on demand. For example:
+
+* `Do I have AWS CloudTrail data?`
+* `Is Kubernetes data flowing in?`
+* `Do I have any threat intel lookups set up?`
+
+### Unstructured logs support
+
+Previously, Mobot worked best on structured (JSON) logs. With this preview release, Mobot automatically applies parsing logic to unstructured logs, even if no FERs are configured.
+
+Now it has built-in support for unstructured logs (raw, text-based log data that does not follow a structured format like JSON). You can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs).
+
+At this stage, Mobot prioritizes unstructured logs that are already used in dashboards, allowing it to surface insights from high-value log sources out-of-the-box. This means it will not interpret all raw logs yet, but support is actively being expanded beyond dashboards.
+
+* **Broader coverage**. Mobot parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types.
+* **Improved usability**. Ask questions in natural language. Mobot interprets your intent and suggests relevant searches, even for raw, non-JSON logs.
+* **Performance and reliability**. Response times and suggestion accuracy are consistent with Mobot's structured log experience.
+* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured logs support builds on Mobot's secure foundation.
+
+#### Common use cases
+
+* **General log exploration**. Ask questions about unstructured logs already used in your dashboards, even if they lack predefined fields.
+* **Error triage**. Investigate frequently visualized log data to surface patterns and recurring issues in unstructured formats.
+* **Security insights**. Detect anomalies or signs of failed logins by querying raw logs already powering security dashboards.
+* **Smarter prioritization**. Mobot focuses on unstructured logs that are visualized in dashboards, helping you get meaningful insights from high-value data sources.
+
+### Conversation history
+
+Mobot retains your conversation history indefinitely. To resume a previous investigation, open the **My Conversations** list and select the conversation.
+
+## Example prompts
+
+Mobot works best when you start with a business question, not a query. Ask questions the way you naturally think about a problem, then refine through conversation. Here are some tips:
+- Start broad, then refine with follow-up questions.
+- Do not worry about structure. Mobot will guide you.
+- If Mobot needs more context, provide a hint such as a data source, lookup table, or field name.
+
+### Developer and SRE
+
+* `What does the error trend look like for my service over the past 24 hours?`
+
+* `Are any services consistently breaching indexing latency SLOs?`
+
+Follow-up:
+
+* `Which instances are most impacted?`
+
+* `When did this start?`
+
+### Security analyst
+
+* `Have there been any recent phishing attempts?`
+
+* `Are there any unusual authentication patterns in our environment?`
+
+Follow-up:
+
+* `Which users are involved?`
+
+* `Is this activity increasing over time?`
+
+### Product and research
+
+* `What integrations does Sumo Logic support for cloud security?`
+
+## Limitations
+
+Mobot is in Extended Preview and has the following known limitations.
+
+**Use cases**
+* Log analysis only. Metrics, traces, and other telemetry types are not supported.
+* Capabilities are constrained by available skills. Domain intelligence and planning are still evolving.
+
+**Access and actions**
+* Read-only. Mobot can query and analyze data but cannot modify, delete, ingest data, manage dashboards or monitors, or access external systems.
+
+**Data and query constraints**
+* Only works with data that has been ingested and is still within your retention period.
+* Large time ranges (30 or more days) or deeply nested queries may be slow, time out, or hit platform limits.
+
+**Experience**
+* Performance and latency may vary depending on query complexity.
+* Responses may not always be fully accurate or complete.
+* No memory across sessions. Each conversation starts fresh.
+
+## FAQ
+
+