Axoflow alternative built for security teams

NXLog Agent runs on Windows, Linux, macOS, FreeBSD, AIX, and Solaris, across x86, ARM, POWER, and SPARC hardware. Axoflow ships edge agents for two operating systems. Your fleet is bigger than that — your collection layer should cover it.

Axoflow's Windows agent collects files, Event Log, and ETW. NXLog Agent adds file integrity monitoring, Registry monitoring, packet capture, and native DNS and DHCP parsing — the endpoint signals your detection rules need, all from one lightweight agent.

Axoflow's documentation states its agent-to-router transport currently runs without TLS or authentication. NXLog Agent encrypts data in transit with TLS/SSL, signs records with HMAC integrity checks, and can encrypt logs at rest — protection along the full path.

Every NXLog pipeline is explicit configuration: versionable, reviewable, and testable before rollout. When a vendor's classifier updates itself, your pipeline changes without a change ticket. With NXLog, you decide what each agent collects, drops, and forwards.

NXLog Agent filters, trims, and rewrites events at the point of collection, so noise never reaches your network or your SIEM bill. Source-based licensing means reduction costs you nothing — and incident-time volume spikes cost nothing extra.

NXLog Platform lists its prices: $5.58 per source per month at 100 sources, a free plan for up to 10 sources, and a 30-day trial with no credit card. You learn the cost without booking a call.

Deploy the same lightweight agent on Windows, Linux, macOS, FreeBSD, AIX, and Solaris — on x86, ARM, IBM POWER, and SPARC hardware. Enroll each agent to NXLog Platform for central configuration, monitoring, and updates. One codebase, one configuration language, one place to manage the whole fleet.

Collect the Event Log with fine-grained queries, subscribe to ETW providers, watch files and Registry keys for changes, capture network traffic passively, and parse Microsoft DNS and DHCP logs natively. Prefer agentless? NXLog receives events forwarded over Windows Event Forwarding, too.

NXLog Agent reads the macOS Unified Logging System and Apple Endpoint Security framework, Linux Audit, BSM auditing on Solaris and FreeBSD, and AIX kernel audit logs. If it runs in your estate, you can collect from it — without waiting for a third-party receiver to exist.

NXLog's configuration language filters, rewrites, enriches, correlates, and de-duplicates events on the agent itself. Drop the noise before it leaves the host, mask sensitive fields early, and convert formats — syslog, JSON, CSV, XML, CEF, LEEF — wherever it makes sense in the route.

NXLog Platform enrolls agents over a secured channel, pushes versioned configurations, monitors agent health, and stores logs with built-in search. Deploy it as your own instance and keep management and data under your control.

NXLog Agent receives and sends OTLP over gRPC and HTTP — logs, metrics, and traces. Ready-made solution packs move Windows, macOS, Linux, and syslog data to OpenTelemetry backends, Splunk, Microsoft Sentinel, and Google SecOps in a few configuration steps.