Sumo Logic Flex is the licensing option (“Sumo Credit Flex”) in which Sumo Logic stops charging for log ingest and charges instead for storing logs and for searching them. Credits are consumed on the basis of the volume of log data scanned.[2] The pricing page offers Flex on the Enterprise Suite and summarises it as “$0 ingest” with unlimited users.[3] The same credit pool also pays for Sumo Logic’s security add-ons. These are Cloud SIEM, billed as SIEM Enterprise (“CSE”) GB Ingest, Cloud SOAR and the SOC Analyst Agent, an AI agent that investigates SIEM Insights.[1] Under the tier-based option these add-ons can be bought with Enterprise Security or Enterprise Suite. See Sumo Logic credits and data tiers and, for contract terms, Sumo Logic licensing.
Editions
The Supplemental names one Flex Eligible Service Plan, Enterprise Suite Flex. Its Product Variables are Flex Log Storage, Flex Log Upfront Search, Flex Log Metered Search, Data Forwarding, Metrics, Tracing, SIEM Enterprise, Cloud SOAR and SOC Analyst Agent. SIEM Enterprise, Cloud SOAR and the SOC Analyst Agent need additional purchase.[1] The Flex Accounts documentation also describes Free, Trial and Essentials Flex accounts.[2]
| Flex account | Allocation and limits |
|---|---|
| Free | 1.25 credits a day for logs, metrics and traces in any combination; 7-day log retention; three users[2] |
| Trial | Credits for about 1 GB a day of data, giving roughly 500 GB of search volume a day (15 TB in total); 20 users; 30-day retention; 30 days[2] |
| Essentials | Troubleshoot, Collaborate and Orchestrate options; upgradeable to Enterprise Suite Flex at any time[2] |
| Enterprise Suite Flex | All capabilities; Ingest Budgets available only on this plan[2] |
Security add-ons. CSE GB Ingest can be added to Enterprise Security and Enterprise Suite. Cloud SOAR can be added to Enterprise Suite. The SOC Analyst Agent can be added to Enterprise Security and Enterprise Suite, but only with an active CSE GB Ingest (SIEM) licence and data consumption.[1] The pricing page marks SIEM and Cloud SOAR as “activation required”. SIEM activation depends on minimum volume and service requirements, and Cloud SOAR activation on a minimum number of users.[3] Catalog: Cloud SIEM ingest and the SOC Analyst Agent are add-on purchases.
Metrics
| Product Variable | Unit | Example burn rate | Catalog row |
|---|---|---|---|
| Flex Log Storage | GB of log data stored, raw or enriched | 0.05 credits | GB Storage[1] |
| Flex Log Upfront Search | GB scanned against Flex Log Storage | 10 credits | Upfront Search[1] |
| Flex Log Metered Search | GB scanned after Upfront capacity is depleted | 20 credits | Metered Search[1] |
| Data Forwarding | GB exported out of the service | 0.5 credits | Data Forwarding GB[1] |
| CSE GB Ingest (Cloud SIEM) | GB of log data ingested into Cloud SIEM | 40 credits | CSE GB Ingest[1] |
| Cloud SOAR | Named User, at a daily credit utilization set on the Order Form | Per Order Form | Cloud SOAR Named User[1] |
| SOC Analyst Agent | Investigated Insight (an investigation producing a verdict) | 100 credits | Investigated Insight[1] |
Metrics (10 credits per 1,000 DPM) and Tracing (35 credits per GB) use the same burn rates as the tier-based option.[1]
Counting / floors
What a scan is. The pricing FAQ defines data scanning as what happens when a query runs across log data, for example from Log Search, dashboards or monitors. Scan volume is the total storage volume scanned.[3] The Flex pricing estimator groups customers into usage profiles of 500 to 750, 750 to 1,500 and 1,500 to 2,000 scans per GB ingested.[3] Scans are measured in 5-minute intervals starting at 12 AM Pacific Standard Time, and partial intervals are pro-rated.[1]
Upfront, then Metered. Upfront Search is reserved scan capacity bought in advance. Once it is exhausted, Metered Search starts and continues at the metered rate until more Upfront capacity is added. In the published example the metered rate is twice the upfront rate.[1] Catalog: Flex Metered Search starts when Upfront Search is depleted.
Storage. Flex Log Storage counts all ingested log data stored, raw or enriched. The example of 10 GB a day kept for 30 days over 12 months comes to about 5,475 credits.[1] Storage usage in the Account Overview updates daily and can take up to 24 hours to appear.[2]
Controls. Administrators can set a query size limit, also called a query budget or scan budget, to cap the GB a single query may scan and so prevent unexpected charges. Sumo Logic recommends setting it at the 95th percentile of query sizes.[4] A new budget can take up to five minutes to take effect.[4] Catalog: Scan budgets can cap query size.
SIEM, SOAR and agent counting. Cloud SIEM ingest is counted per GB per OrgID. The example of 10 GB a day for 12 months comes to 146,000 credits.[1] A Cloud SOAR Named User is a unique user authorized to use Cloud SOAR in the customer’s org. Each one consumes the “Daily Named User Credit Utilization” on the Order Form; the example of five users at 274 credits a day comes to 500,050 credits a year.[1] The SOC Analyst Agent’s daily allocation is consumed each day. Any overage adds credits for each Investigated Insight above the baseline on that day.[1] Catalog: Credits are consumed at Order Form burn rates per unit of measure.
Usage visibility. The Flex Account Overview splits usage into Flex Scan Upfront, Flex Scan Metered, Flex Storage, Tracing Ingest, Cloud SIEM Ingest and Metrics Ingest, with forecasts and alerts at 70% and 90% of credits used.[2] Cloud SIEM ingest also appears as its own category in credits accounts.[5]
Virtualization & partitioning
Not applicable. No host, core or virtual-machine metric applies to Flex or the security add-ons.
Cloud / BYOL
Not applicable; the service is hosted by Sumo Logic. Flex prices carry the same deployment-region uplifts as credits plans, from +10% (Dublin, Montreal, US Federal) to +40% (European Sovereign Cloud).[1] Example 2 in the Supplemental prices Enterprise Suite on Global deployment with quarterly payment at USD 2.16 per credit, against an MSRP of USD 1.50 for US deployment paid annually.[1]
Programs
Sumo Credit Flex. Fees are paid in full at the start of the term. Net annual fees rise 10% at renewal unless otherwise agreed in writing, as for credits plans.[1] Catalog: Net annual fees increase 10% at renewal unless otherwise agreed.
AI features. The pricing page allows the Mobot conversational interface 10 prompts per user per day on both Essentials and Enterprise Suite. The MCP Server integration is limited to four API calls per section and ten concurrent requests.[3] The Service Agreement says the Services do not use Customer Data to train or fine-tune generative AI models, and makes AI features subject to separate AI Services Terms and Conditions.[6]
Out of scope
- Customer-specific Upfront Search capacity, SOAR daily utilization and SOC Analyst Agent baselines, which are set on Order Forms.
- The AI Services Terms and Conditions and the federal end-user Service Agreement.
- Cloud SIEM detection content, rules and integrations, which do not affect licensing.