slug: sumo-logic provider: Sumo Logic generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 21 edges: - tag: roleManagement spec_file: sumo-logic-role-management-api-openapi.yml reanchored_from: sumo-logic-rolemanagement-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: PUT /v1/roles/{roleId}/users/{userId} assignRoleToUser Assign A Role To A User.; POST /v1/roles createRole reason: Role CRUD plus assignment/removal of roles to users is role-based access control administration — identity and access management. - tag: roleManagementV2 spec_file: sumo-logic-rolemanagementv2-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: PUT /v2/roles/{roleId}/users/{userId} assignRoleToUserV2 Assign A Role To A User.; schemas ViewFilterDefinition, RoleDefinition reason: 'V2 of the same surface: role definitions with view filters and role-to-user assignment, i.e. access control administration.' - tag: slosLibraryManagement spec_file: sumo-logic-sloslibrarymanagement-api-openapi.yml capability_id: BC-4220.10 capability_id_l1: BC-4220 capability_name: Service Reliability Engineering confidence: 0.88 evidence: '"Bulk Fetch SLI Values, Error Budget Remaining And SLI Computation Status For The Current Compliance Period."; schemas SliStatus, SloUsageInfo' reason: Defines and monitors service-level objectives/indicators and error budgets — textbook service reliability engineering. - tag: traces spec_file: sumo-logic-traces-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.88 evidence: '"Run A Trace Search Query Asynchronously."; "Get A Critical Path Of A Trace."; schema TraceDetail' reason: Distributed trace search and inspection — logs/metrics/traces observability of the running service. - tag: serviceAccountManagement spec_file: sumo-logic-serviceaccountmanagement-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /v1/serviceAccounts createServiceAccount "Create A New Service Account."; "Create A New Access Key For A Service Account." reason: Operations manage non-human service account identities and their access keys/credentials — identity and access management for the platform, not a business-domain capability. - tag: serviceMap spec_file: sumo-logic-servicemap-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: GET /v1/tracing/serviceMap getServiceMap "Get A Service Map."; schemas ServiceMapNode, ServiceMapEdge reason: Distributed-tracing derived service topology map — observability of the running service, not any business relationship mapping. - tag: spanAnalytics spec_file: sumo-logic-spananalytics-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.85 evidence: POST /v1/tracing/spanquery "Run A Span Analytics Query Asynchronously."; schema TraceSpanStatus reason: Querying and aggregating distributed-tracing spans — trace-based observability of production services. - tag: threatIntelIngestProducer spec_file: sumo-logic-threatintelingestproducer-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: '"Uploads Indicators In A STIX 2.x Json Format."; schemas StixIndicator, KillChainPhase' reason: Ingestion of STIX threat indicators and kill-chain metadata for security monitoring — threat detection and response. - tag: userManagement spec_file: sumo-logic-user-management-api-openapi.yml reanchored_from: sumo-logic-usermanagement-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /v1/users createUser "Create A New User."; "Reset Password."; "Disable MFA For User." reason: Platform user account lifecycle, password reset, MFA and unlock — identity and access administration, not HR employee records. - tag: metricsQuery spec_file: sumo-logic-metricsquery-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.78 evidence: POST /v1/metricsQueries runMetricsQueries 'Run Metrics Queries'; schemas TimeSeriesList, MetricDefinition, Points reason: Executes time-series metrics queries against telemetry collected from running systems, which is the metrics leg of Observability Management. - tag: monitorsLibraryManagement spec_file: sumo-logic-monitorslibrarymanagement-api-openapi.yml capability_id: BC-4220 capability_id_l1: BC-4220 capability_name: SaaS Platform Operations Management confidence: 0.78 evidence: POST /v1/monitors monitorsCreate 'Create A Monitor Or Folder.'; schemas TriggerCondition, MonitorNotification, MonitorPlaybooksList reason: Manages monitors with trigger conditions, notifications and playbooks — production monitoring and alert detection on a SaaS platform. Sits between Observability Management and Incident Response detection, so only the L1 is asserted. - tag: scimUserManagement spec_file: sumo-logic-scim-user-management-api-openapi.yml reanchored_from: sumo-logic-scimusermanagement-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: POST /v1/scim/Users createSCIMUser Create SCIM User; DELETE /v1/scim/Users/{id} deleteSCIMUserById Delete SCIM User reason: SCIM-based create/update/deactivate of user accounts is automated user provisioning and de-provisioning (joiners-movers-leavers) — identity and access management, not HR records management. - tag: threatIntelIngest spec_file: sumo-logic-threatintelingest-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.78 evidence: '"Get Threat Intel Indicators DB Information"; "Set The Threat Intel Indicators Store Retention Period In Terms Of Days."' reason: Manages the threat-intelligence indicator datastore used for security detection — threat detection and response tooling. - tag: passwordPolicy spec_file: sumo-logic-password-policy-api-openapi.yml reanchored_from: sumo-logic-passwordpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GET /v1/passwordPolicy getPasswordPolicy Get The Current Password Policy.; PUT /v1/passwordPolicy setPasswordPolicy reason: Reads and sets the account's password policy — an access-credential control, squarely identity & access management rather than a business policy lifecycle capability. - tag: logSearchesManagement spec_file: sumo-logic-logsearchesmanagement-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.72 evidence: GET /v1/logSearches listLogSearches 'List All Saved Log Searches.'; schemas LogSearchScheduleSyncDefinition, LogSearchNotificationThresholdSyncDefinition reason: CRUD over saved/scheduled log searches with notification thresholds on a machine-data analytics platform — this is log-based observability of running systems, matching Observability Management (logs, metrics, traces). - tag: metricsSearchesManagement spec_file: sumo-logic-metricssearchesmanagement-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.72 evidence: POST /v1/metricsSearches createMetricsSearch 'Save A Metrics Search.'; schema MetricsSearchQuery reason: Saving and maintaining metrics searches on an operational telemetry platform — metrics-based observability of production systems. - tag: metricsSearchesManagementV2 spec_file: sumo-logic-metricssearchesmanagementv2-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.72 evidence: POST /v2/metricsSearches createMetricsSearches 'Create A New Metrics Search Page.'; schemas MetricsQueryData, SpansQueryData, TracesFilter reason: Metrics search pages combining metrics, spans and traces queries — logs/metrics/traces observability of the running service. - tag: Collectors spec_file: sumo-logic-collectors-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.7 evidence: 'listCollectors List collectors; createCollector Create a collector; vendor spec: ''cloud-native log analytics, observability, and security platform''' reason: Collectors are the agents/ingestion points that feed logs and metrics into Sumo Logic, so managing them is stewardship of the observability data pipeline. Confidence at 0.7 because the tag exposes only bare CRUD with no schemas, and an IT Operations Management reading (BC-600.40) is a near neighbour. - tag: Users spec_file: sumo-logic-users-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /v1/users createUser Create a user; DELETE /v1/users/{id} deleteUser Delete a user reason: User lifecycle CRUD for platform accounts is identity administration (joiners-movers-leavers), not HR employee records. Alternative reading as tenant identity/user provisioning (BC-4230.50) keeps confidence moderate. - tag: dashboardManagement spec_file: sumo-logic-dashboardmanagement-api-openapi.yml capability_id: BC-610.50 capability_id_l1: BC-610 capability_name: Analytics & BI Management confidence: 0.7 evidence: '''List All Dashboards.'', ''Create A New Dashboard.'', ''Start A Report Job'', schema ''PaginatedReportSchedules''' reason: Dashboard authoring plus scheduled report generation is analytics/BI delivery. Alternative reading is observability visualisation, so confidence is held at 0.7. - tag: samlConfigurationManagement spec_file: sumo-logic-samlconfigurationmanagement-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /v1/saml/identityProviders createIdentityProvider Create A New SAML Configuration.; POST /v1/saml/lockdown/enable enableSamlLockdown Require SAML For Sign-in. reason: Configures SAML identity providers, allowlisted users and SSO enforcement for the account — identity federation and sign-in control. Could alternatively be read as tenant identity federation from the SaaS provider's side, hence moderate confidence.