All posts NXLog Blog

July 20, 2026

Log enrichment with GeoIP: adding location context at the collection layer

A source IP address on its own answers almost none of the questions an analyst asks at triage. Did this login attempt come from a country where we have no users? Is the source a residential connection or a hosting provider? Log enrichment with GeoIP answers these questions before anyone has to ask them by resolving each IP address against a geolocation database and writing the results — country, city, coordinates, network owner — directly into the event record.

July 20, 2026

Log timestamp normalization to ISO 8601: Getting every source to agree on time

When you reconstruct an incident across firewalls, endpoints, and application logs, the timestamps rarely agree. One source records Oct 10 13:55:36 with no year and no time zone. A Zeek log two racks over emits 1760104536.225121. The firewall already speaks 2025-10-10T13:55:36.003Z. Until every one of those is converted to a single format and time zone, your event timeline is an estimate. The fix is timestamp normalization: convert each timestamp to ISO 8601 in UTC at the point of collection, before the data reaches your SIEM.

July 16, 2026

The audit blind spot: collecting logs from mainframes and core banking systems your SIEM doesn't speak

Every telemetry vendor’s demo runs on the same infrastructure: a clean, cloud-native, container-friendly stack where a modern agent drops in and just works. Then you go back to the bank you run day to day, where a mainframe still clears transactions, an IBM i (AS/400) system has been in production for decades, and a core-banking platform speaks a log format no off-the-shelf agent has heard of. That gap between the demo and the data center is where audit blind spots live.

July 15, 2026

6 Logstash alternatives and competitors for security operations in 2026

If you are looking for a Logstash alternative for security operations, six tools cover the field: NXLog Platform, an agent-based telemetry pipeline built for security data collection with centralized agent management; Fluentd, a CNCF project with a large plugin catalog; Fluent Bit, its lightweight C-based sibling for edge and container collection; Vector, a Rust-based pipeline owned by Datadog; Cribl Stream, a commercial pipeline for routing and reducing data between existing collectors and SIEMs; and syslog-ng, a long-lived syslog daemon from One Identity.

July 15, 2026

Why the SIEM is the wrong layer to solve compliance: a pipeline-first framework for financial services

When an auditor sits down with your team, they don’t ask whether you have a SIEM. They ask you to prove something: show me every privileged access event on this system for the last twelve months, timestamped, complete, and unaltered. Compliance in financial services isn’t a posture; it’s an evidence problem. And the moment you treat your SIEM as the place where evidence lives, you’ve put your audit trail on the most expensive, most volatile, and least complete layer of your stack.

July 14, 2026

Where your SIEM ingestion bill comes from: a financial services cost breakdown

Most security leaders can tell you their SIEM bill to the dollar. Far fewer can tell you, line by line, what they’re paying for. That’s a problem because in financial services, that bill grows faster than the security coverage it’s supposed to buy. Let’s break it down. The bill is a function of volume, and volume is not your friend Ingestion-priced SIEMs charge by how much data you send. That makes your security budget a direct function of log volume.

July 8, 2026

Making the most of Windows Event Forwarding for centralized log collection in 2026

Windows Event Forwarding (WEF) gives you centralized log collection with tools that ship in every supported version of Windows. There are no agents to deploy and no licenses to buy: a collector server, a Group Policy Object (GPO), and a subscription are enough to start moving events. That makes WEF one of the most accessible routes to getting Windows logs into one place. It also has hard limits in platform coverage, in resource cost, and in the kinds of data it can carry.

June 29, 2026

Cribl competitors: 6 alternatives for SecOps teams

If you run security operations, you’re probably evaluating Cribl for one reason. The volume of telemetry hitting your SIEM is outpacing your budget, and you want to filter and reshape it before you pay to index it. Cribl is good at that. It defined the category when it launched in 2018, and for many teams, it’s still the default. Cribl works. The decision turns on three narrower questions: whether your data problem matches the one Cribl solves, what deployment model you need, and what you’ll pay per gigabyte to get there.

June 24, 2026

Structured logging and JSON conversion: Getting logs SIEM-ready at the source

Your detections, correlation rules, and search results are only as good as the underlying data structure. A raw log line is a string. A structured JSON event is a set of named fields you can filter, pivot, and alert on. Convert your logs to JSON at the collection layer before they reach your SIEM. Doing it early cuts ingest cost, keeps your schema consistent across sources, and makes your detections less fragile.

June 22, 2026

Log analysis tools for SecOps: How to evaluate the whole stack in 2026

Teams usually choose a log analysis tool by comparing vendors. The more costly decision sits one level up: the category of tool. The wrong choice there surfaces months later as a source you can’t collect, data you can’t normalize, or a per-gigabyte bill for logs you never needed. Log analysis tools collect, parse, store, search, and visualize log data so teams can detect threats, investigate incidents, and troubleshoot systems. The term spans four distinct categories — collection agents, processing pipelines, storage and search engines, and analysis platforms — that each handle a different job in the same workflow.

All articles

Featured posts

Categories