There is practically no other log management solution that is capable of
collecting logs from all platforms found in larger organizations (various UNIX
platforms, Linux, Windows, Apple macOS, along with various network-ready
devices), filtering the logs, aggregating them, and sending them to almost any
SIEM or endpoint of your choice.
This means NXLog is a one-stop solution for log collection, processing
and distribution. It requires neither third-party "plugins" nor different
"connectors" to be installed each time you decide to change from a different
log source or from a different endpoint to another.
These are the three most common ways that NXLog can be utilized to
efficiently reduce log noise and save costs:
- Trimming logs
refers to reducing log size by removing unwanted data comprised of fields
containing low-value information, as well as redundant or duplicated fields.
You can easily configure this feature by specifying a list of "whitelisted"
fields to keep. All other event fields will be removed thus reducing the volume
of data that will be processed and forwarded.
- Filtering logs
Depending on your business requirements, it might be feasible to
entire log events when there is no valuable information in the log record, or
for example, when the log event is duplicated. You can configure NXLog
to drop such unwanted log events by defining a set of attributes that they will
match. Any matching events will trigger the
procedure, leaving only the events that security analysts need.
- Data compression
Log data can also be
on transmission in order to reduce network bandwidth usage. Consequently, log
data is transmitted faster and disk storage requirements are reduced if the
endpoints are writing the logs to file.
There are just a few of the advantages NXLog offers for reducing the
total cost of logging operations. The cost savings can be significant if your
organization is currently sending all events unfiltered to a SIEM, since many
of them charge by data volume ingested. If you take a look at NXLog’s
rich set of
you will see that is truly in a class of its own in terms of its modular,
distributed architecture and its ability to
with such a vast number third-party solutions.