Altice Portugal improved SOC performance with an agentless telemetry pipeline

Telecom operators run some of the most complex IT estates in any industry, and that complexity makes them a high-value target. The attacks they see range from assaults on mobile infrastructure and customer account takeovers to data theft, DDoS, and ransomware. For Altice Portugal, the largest telecommunications operator in the country, customer data is a critical business asset — and it needs protection to match.

Altice Portugal's enterprise security policy requires its Security Operations Center to monitor events without interruption across critical systems and technologies, including the DMZ, security devices, and network elements. The previous log collection tools could not meet that requirement. They failed to retrieve data from several key sources, which left gaps in exactly the places the policy was written to cover.

Performance was the second problem. High-volume sources such as domain controllers pushed more events into the SIEM than it could process efficiently, which slowed the analysis the SOC depends on. Altice Portugal needed a pipeline that could reach every source, reduce noise before it hit the SIEM, and still guarantee that every captured log arrived at the security platforms.

Altice Portugal chose NXLog over other options to build a new event collection pipeline. The deciding factors were its light footprint, the range of event sources it supports, its integrations, and its event parsing.

NXLog Platform provides a flexible telemetry pipeline architecture, including agentless collectors that retrieve events from sources such as Windows endpoints and network appliances. Those events had to reach more than one destination — one path for real-time analysis, another for long-term retention. NXLog handles both. It forwards to SIEM platforms including Google Security Operations, Microsoft Sentinel, Elastic, Graylog, IBM QRadar, and OpenText ArcSight, and to retention targets including its own embedded storage and search engine, AWS, Azure, and Snowflake.

Pre-filtering was the other half of the problem: cut the volume enough to keep the SIEM fast, without losing anything the security platforms needed. NXLog's parsing capabilities handle this by filtering and normalizing events before forwarding them. The engineering team also used the local caching feature of the NXLog agent, so logs reached the security systems reliably and without delay. NXLog Professional Services worked alongside the Altice Portugal team on the implementation.