The instinct is almost universal: When something goes wrong, security teams reach for more data. The belief is that if they log everything, the bad guys will eventually reveal themselves in the noise.“In an ideal world, we would just collect all the data and find the bad guys,” said Chas Clawson, VP of Security Strategy at Sumo Logic, speaking during the recent TNS webinar, “Log Everything, Alert Smarter: A SecOps Framework for AI-Driven Detection.”“In reality, there are a lot of reasons why that historically has never worked,” Clawson says.A veteran of US federal security operations and the NSA’s Red Team, Clawson has used the session to explain why the model keeps failing SOCs and what’s changing as agentic AI enters the picture.The “single glass of pain”There’s a joke Clawson likes to tell: You buy a SIEM expecting a single pane of glass, and what you actually get is a single glass of pain. Collecting more data doesn’t fix anything on its own; it just means more alerts piling up faster than an analyst can get through them.What Clawson calls the “funnel of fidelity” is his answer to that. Collection stays wide at the top, and then the noise gets stripped away until what lands in front of an analyst is a short list of alerts worth acting on, ideally strung together into something resembling an attack timeline rather than a pile of disconnected events. “There is no easy button,” he says. Getting there takes real work.Is that a tooling problem or a discipline problem? Clawson’s answer: both. But he pointed to a bigger change underway: SOCs moving away from workflows where a human had to lay hands on every single alert, toward ones where agents take the first pass, and humans step in for what’s actually worth their time.Entities, not eventsA recurring theme was entity-centric detection: grouping alerts around a user, host, service account, IP address, or hash rather than triaging each one in isolation. “It’s a losing proposition to try and triage every single alert that comes across your tools because there’s just too many of them,” Clawson says. Clustering by entity turns disconnected signals from email security, EDR and identity tools into a single, legible picture.He also flagged non-human identities as a growing concern, expecting Red Teams to increasingly target autonomous agents through social engineering. “An agent is nothing more than a toddler with absolutely no street smarts, but all the keys to the kingdom,” he said, and many SOCs may lack the audit logs to catch it when one gets manipulated.Trust is the new battlegroundClawson spent a good chunk of the session talking about where AI actually pulls its weight, and his go-to comparison was treating an agent like a new hire. Given proper training, the right context, and clean data, it does the job well. But hand it raw, messy logs and ask it to find the bad guys, and it ends up burning a lot of effort just working out which field is the source IP.That’s why Sumo Logic still leans on deterministic, rules-based detection for real-time alerting. AI comes in afterward, reasoning over the smaller, cleaner set of signals those rules surface, rather than trying to replace them.Trust was the thing that most shaped how Sumo Logic built Dojo.ai, the platform housing its purpose-built agents, including a SOC analyst agent. Early users made their objection clear pretty fast: nobody wanted another black box they couldn’t verify. So every step an agent takes now traces back to the actual query behind it. As Clawson put it, “Maybe one day we’ll be in a world where I can just blindly trust an agent. We’re not quite there yet.”On where to draw the line between automated and human-reviewed decisions, Clawson described a spectrum from human-in-the-loop to human-on-the-loop to human-out-of-loop, cautioning that the most cautious option isn’t always the safest, given how fast modern attacks move.Data tiers and budget trade-offsClawson’s advice on data management: figure out what you actually want to detect first, then work backward to the data that supports it, rather than hoovering everything up and sorting it out later. At Sumo Logic, that means tiering storage: cheap, low-touch storage for the low-priority stuff, and pricier, AI-ready processing reserved for whatever feeds real-time detection.When budgets get squeezed, Clawson says the first thing to go is usually tool sprawl, not headcount or coverage. Getting several teams to give up their favorite point solution in favor of one consolidated platform is a hard conversation, but it tends to pay off more than letting every team keep the tool they like.He closed by comparing the moment to the early days of cloud adoption: “If you don’t have an AI strategy, expect to be obsolete very, very soon.”Watch on demand for more on breaking the alert fatigue cycle REGISTER NOW FOR THIS WEBINARWhat best describes your biggest SecOps challenge right now?*Please selectAlert fatigue — too many low-signal detections overwhelming our analystsLack of entity-centric context — alerts are isolated and hard to correlateAI tools exist in our stack but aren't integrated into actual investigation workflowsData management — we don't have a clear strategy for routing, tiering, and normalizing telemetryJust exploring the topic / no specific challenge yetRegisterYou have successfully registered for the webinar.$(document).ready(function() {// Get UTM parameters.var utm_source = window.tns.getUTMParameterValue('utm_source');var utm_medium = window.tns.getUTMParameterValue('utm_medium');var utm_campaign = window.tns.getUTMParameterValue('utm_campaign');var utm_term = window.tns.getUTMParameterValue('utm_term');var utm_content = window.tns.getUTMParameterValue('utm_content');if (utm_source) { $('input[name="utm_source"]').val(utm_source) }if (utm_medium) { $('input[name="utm_medium"]').val(utm_medium) }if (utm_campaign) { $('input[name="utm_campaign"]').val(utm_campaign) }if (utm_term) { $('input[name="utm_term"]').val(utm_term) }if (utm_content) { $('input[name="utm_content"]').val(utm_content) }if ( $('.airmeet-container[data-event-id]').length ) {var eventId = $('.airmeet-container[data-event-id]').data('event-id');$.get('/wp-json/airmeet/fetch-event', { event_id: eventId }).done(function(response) {// You can populate webinar title and meta here, for example:if(response && typeof response === 'object') {$('.airmeet-webinar-name').text(response.name);var date = new Date(response.start_time);var formatted = date.toLocaleString("en-US", {month: "long",day: "numeric",year: "numeric",hour: "2-digit",minute: "2-digit",hour12: true,//timeZone: "UTC"timeZoneName: "short"});$('.airmeet-webinar-time span').text(formatted);$('.airmeet-container').show().removeAttr('hidden');$(window).trigger('airmeet-webinar-loaded');}}).fail(function(xhr) {console.error('Failed to fetch Airmeet event', xhr);});}/** * Show Airmeet stage based on state * * 1 - webinar form (whether logged in/out) * 2 - thank you screen or video embed */function showAirmeetStage( stage ) {if ( stage == 1 ) {// Logged out.$('.airmeet-webinar-form').show().removeAttr('hidden');$('.airmeet-success, .airmeet-video').hide().attr('hidden', true);} else if ( stage == 2 ) {// Is there a video available?if ( $('.airmeet-video').length ) {// Video embed, prepare the iframe and show.$('.airmeet-webinar-form, .airmeet-success').hide().attr('hidden', true);$('.airmeet-video iframe').attr('src', $('.airmeet-video iframe').attr('data-src'));$('.airmeet-video').show().removeAttr('hidden');} else {// Thank you screen.$('.airmeet-webinar-form').hide().attr('hidden', true);$('.airmeet-success, .airmeet-video').show().removeAttr('hidden');}}// Reset immediate registration flag.window.shouldSubmitWebinarRegistration = false;}/** * Fetch Airmeet registration status for current user. * @param {string} eventId * @returns {Promise} resolves with registration status object or rejects with error. */function fetchRegistration(eventId) {return $.post('/wp-json/airmeet/registration-status', { event_id: eventId }).done(function(response) {if ( response.registered ) {// Already registered, don't resubmit.showAirmeetStage(2);} else {if ( window.shouldSubmitWebinarRegistration ) {submitRegistrationForm();} else {showAirmeetStage(1);}}}).fail(function(xhr) {// Just show form.showAirmeetStage(1);});}// Recheck login state after event is loaded$(window).on('airmeet-webinar-loaded', function() {fetchRegistration(eventId);});// Recheck login state during whichever of these lifecycle events happen first$(window).on('webinar-login-complete webinar-profile-updated webinar-confirmation', function() {if ( ! window.fetchRegistrationAttempted ) {fetchRegistration(eventId);}window.fetchRegistrationAttempted = true;});function submitRegistrationForm() {// Collate all hidden values in the registration form, excluding "questions" and submit with the AJAX request.var $form = $('.airmeet-registration-form');var data = {};$form.find('input[type="hidden"]').each(function() {var key = $(this).attr('name');var value = $(this).val();data[key] = value;});// Questions.data['questions'] = [];$form.find('[data-question]').each(function() {data['questions'].push({question: $(this).data('question'),answer: ($(this).is('select')) ? $(this).find('option:selected').val() : $(this).val()});});$form.find('button[type="submit"]').prop('disabled', true).text('Registering...');$.post('/wp-json/airmeet/register', data).done(function(response) {// Show success screen.showAirmeetStage(2);window.dataLayer.push({'event' : 'webinar_registration','object_id' : '22828659','object_type' : 'webinar'});}).fail(function(xhr) {console.error('Failed to register for event', xhr);$form.find('button[type="submit"]').prop('disabled', false).text('Register');});};// Submit registration form.$('.airmeet-registration-form').on('submit', function(e) {e.preventDefault();/*const user = window.tns.getCookie('tns-user');if (user) {// Logged in.submitRegistrationForm();} else {window.shouldSubmitWebinarRegistration = true;//$('.masthead-login-button').trigger('click');loginForWebinarRegistration();}*/window.shouldSubmitWebinarRegistration = true;loginForWebinarRegistration();});function loginForWebinarRegistration() {// Resampling the login config, just changing the subscriptions to suit.window.imgjs.subscribe.config.onClose = function(user) {if (user) {window.tns.setCookie('tns-user-id', user.author_id, 8400)window.tns.setCookie('tns-user', JSON.stringify(user), 8400)/// Update the BlueConic profile with the email and Ory IDconst profile = window.blueConicClient.profile.getProfile()profile.setValue('email', user?.email)profile.setValue('ory_id', user?.author_id)window.blueConicClient.profile.updateProfile()$('.masthead-login-button').text("")/// Determine if it's a new subscription by testing/// if the createdAt date is today's dateif (window.imgjs.subscribe.isNewSubscription(user.createdAt)) {window.dataLayer.push({'event' : 'user_registration','url' : window.location.href,'channel': window.imgjs.subscribe.channel,'channel_id': window.imgjs.subscribe.channel_id})}$(window).trigger('webinar-login-complete');} else {console.log('[IMG Subscribe] ERROR Failed to validate OTC')window.tns.setCookie('img-session-token', '', -1)window.tns.setCookie('tns-user-id', '', -1)window.tns.setCookie('tns-user', '', -1)$('.masthead-login-button').text("LOGIN")$(window).trigger('webinar-login-failed');}}var subscriptions = {mc : [],hs : ['688810681', /// TNS Weekly (PROD)'688810832' /// Events & Webinars (PROD)]}window.imgjs.subscribe.config.onProfileUpdate = function(data) {console.log("Set tns-user cookie with the following data:")console.log(data)if (data.user) {window.tns.setCookie('tns-user-id', data.user.author_id, 8400)window.tns.setCookie('tns-user', JSON.stringify(data.user), 8400)$(window).trigger('webinar-profile-updated');} else {console.error("[IMGJS] ERROR No user returned to onProfileUpdate")}}window.imgjs.subscribe.config.onConfirmation = function() {$(window).trigger('webinar-confirmation');};window.tns.user = window.tns.getCookie('tns-user')if (window.tns.user) window.tns.user = JSON.parse(window.tns.user)window.imgjs.subscribe.channel = 'webinar'window.imgjs.subscribe.channel_id = 'log-everything-alert-smarter-a-secops-framework-for-ai-driven-detection'//window.imgjs.subscribe.open(null, subscriptions, 'login');window.imgjs.subscribe.open(null, subscriptions, 'login', window.tns.user);}}); Key Webinar Takeaways:Why “log everything” backfires, and the funnel of fidelity model to fix it.How entity-centric detection turns scattered alerts into a single, investigable picture.Where AI agents genuinely earn their keep in a SOC workflow, and where they don’t.How to build a data management strategy that keeps the right telemetry AI-ready without breaking the budget.The post Alert fatigue is breaking SOCs. Sumo Logic says it has a way out. appeared first on The New Stack.