La Banque Postale unified log collection and met national regulations with one autonomous pipeline

As a critical infrastructure operator, La Banque Postale is subject to security requirements imposed by domestic and international regulations. Every critical system must stay resilient, and log collection and centralization is a key part of proving it. The bank’s security team relies on centralized events to detect, prevent, and remediate threats across vital banking systems in time.

The goal of the project was to collect and centralize logs from all data center systems into a Splunk data store for operational and threat analysis. The native Splunk forwarders in place held the team back on ingestion speed, filtering, and the range of sources it could integrate.

Compliance also asks for more than endpoint logs. The team needed events from key network, security, and storage services across the data center — appliances from Blue Coat, Cisco, CyberArk, F5, IBM, Hitachi, and others — most of which transmit events over syslog.

The first stage replaced the native Splunk forwarders with NXLog agents on Windows, Linux, and AIX endpoints. As a dedicated log collection agent, NXLog gave the team faster ingestion, richer filtering, and more integration options than the forwarders it replaced.

The agent’s embedded log file rotation was one of the reasons for the switch: engineers manage log files directly, without relying on each system’s own rotation features. That autonomy carried into daily operations: the team now integrates new log sources on its own.

The next stage brought in the appliances. The team set up a load-balanced cluster of NXLog collectors to receive syslog from network, security, and storage services, with failover and load balancing options keeping collection highly available.

Once collected, events are filtered and processed centrally, forwarded to an Apache Kafka broker cluster, and delivered to the Splunk SIEM, where security engineers monitor, detect, and remediate threats.

The capabilities behind this deployment — the lightweight agent, its filtering and integration options, and centralized agent management — are available today as part of NXLog Platform.