A U.S. state government cut SIEM costs without losing security visibility

Facing a rising volume of cyber threats, a U.S. state government set out to overhaul its security monitoring. For years it had run Splunk as its SIEM. As log volumes grew, the deployment reached its limits: licensing tied to ingested data pushed costs up, and the pipelines struggled to keep pace, which delayed alerts and let some go unnoticed.

The estate itself was the harder problem. Legacy systems, cloud infrastructure, and a wide range of security tools each produced logs in their own format, so aggregating and normalizing them took constant effort.

Running the collection layer added to the load. Thousands of collection points needed attention, which pulled the security team away from security work while compliance obligations kept growing — and the resulting gaps in log collection put audit readiness at risk. The state decided to migrate to Anomali Security Analytics and rebuild its telemetry layer at the same time. It needed a way to collect, process, and deliver clean, structured logs fast enough to support real-time security operations.

After evaluating commercial and open-source options, the state chose NXLog Platform as the core of its new security data pipeline. NXLog Agent's small footprint, throughput, and configurability suited an estate this varied, and it could aggregate and forward logs from across that estate into the new SIEM.

Deployment covered the sources that mattered: network infrastructure from Juniper, Palo Alto Networks, F5, Zscaler, and Cisco; Windows environments, including event logs, Sysmon, and Active Directory logs; PRTG monitoring; and a set of custom in-house systems. However unusual the format, each stream was brought into one central collection pipeline.

Edge processing did much of the work. NXLog Agent parsed and filtered raw messages on the source host and converted them to structured JSON before anything left the network, enriching records with the context the security team needed for investigation. Data quality went up and noise went down.

Routing rules then sent each stream where it belonged. Bulk raw firewall logs went to Amazon S3, while endpoint data went to Anomali. That kept storage costs in proportion and kept SIEM ingestion focused on the events analysts query.

Between collection points, the team used NXLog Agent's batched compression transport to cut network overhead on the internal hops. Transmissions were encrypted, and the S3 bucket served as a secure staging area supporting the state's audit requirements.