A top 10 US airline achieved FAA and PCI DSS compliance with one log collection pipeline

E-enabled aircraft use TCP/IP connectivity to move data to and from the aircraft without physical storage media — customer profiles, In-Flight Entertainment (IFE) content, navigational data, and aircraft health monitoring. That connectivity also creates real risk. A threat, intentional or unintentional, can degrade system performance or cause denial of service.

The FAA addresses this risk through advisory circular AC 119-1A, which sets out how operators gain authorization for an Aircraft Network Security Program (ANSP) — a requirement for the continued airworthiness of e-enabled aircraft. Where security logs are generated, operators must retain logs from the aircraft's core network and analyze them, continuously or on a schedule, to understand normal system behavior and identify security risks. And because the airline takes card payments on board, its aircraft also fall within the scope of PCI DSS, which requires an established log management process to protect customers' payment card data.

For the airline, that meant collecting logs from disparate systems across the fleet and its ground support infrastructure — Windows, Linux, VxWorks, and airline-specific platforms — many of them compressed or encrypted. The data had to reach both a data warehouse (Azure, Snowflake) and Google Security Operations (formerly Google Chronicle) SIEM for retention and threat analysis. The airline's Trellix (McAfee) agents had hit their limits, and any replacement had to be time-effective, cost-effective, and unintrusive on critical systems.

The airline was naturally cautious about performance and reliability, so it evaluated a range of log collection options — including full Endpoint Detection & Response (EDR) products — before choosing NXLog Platform.

With NXLog, the airline collects logs from critical aircraft and ground systems using a lightweight agent with a small footprint, processes the many formats those systems produce, and forwards everything through one pipeline to both the data warehouse and the SIEM. Centralized agent management gives the team deployment and control at fleet scale, and NXLog's configuration language handles the airline-specific formats that generic agents struggled with.

The entire project took three months, from an extensive evaluation through several deployment phases. For the next stage, the airline planned to extend the pipeline across its Airbus A320 and A220 fleet with support from NXLog Professional Services, targeting 100% coverage of its e-enabled aircraft and infrastructure nodes.