In Stax-managed AWS Organizations, CloudTrail logs reside in the logging foundation account. These events can be consumed using native AWS tools or third party applications.
Stax provides a code repository with guidance designed to support organizations wishing to collect CloudTrail logs in an existing Sumo Logic environment.
Review the repository and its guidance on GitHub.