Log Collection & Fleet Management​

Our platform integrates inputs for NXLog, and Beats data shippers for logging Windows and Linux logs. This enables seamless logging of data into Graylog. Graylog Sidecar can manage your log levels and configuration centrally for these log shippers making it easier to manage.

The system supports various input types, including Syslog, CEF, GELF, BEATS, JSON, IPFIX, Netflow, and Plain text. There are many custom integrations that are included directly with Enterprise and Illuminate built-in content.

Incoming logs are processed through Pipelines and rules, where they can undergo a transformation for enrichment, and parsing based on defined criteria into a schema. Pipelines can be used to lookup threat intel as well as enhance the logs with pertinent asset data as well as GeoIP information.  The Graylog information model schema is applied for security analytics and threat with curated alerts as well as Sigma rules and anomaly detection.

Graylog’s Sidecar Fleet Management simplifies the management of log collection agents across distributed environments, providing centralized control over configuration, deployment, and updates. The Sidecar feature gives you one central location to configure profiles for the different logging levels you may require for your different assets for Workstations, Servers, and equipment.

Pipelines and streams facilitate efficient log processing. Pipelines transform and enrich logs, while streams enable organized data management and granular control over log routing. Streams separate your log types based on criteria so you can have different retention periods for different types of data.  This gives you the flexibility to keep logs longer for compliance and trends over time.

By leveraging Graylog’s technologies, our platform ensures efficient log processing, enabling organizations to gain valuable insights and enhance operational efficiency.