BALABIT Log Management

RELIABLE, SCALABLE, SECURE CENTRAL LOG MANAGEMENT

More than a million users worldwide trust syslog-ng to deliver log data from across their IT environments

 

“Without CLM, incident response activities associated with reviewing events in system logs becomes a multiweek effort, as logs are manually reviewed by administrators and analysts, and manual correlation of events is attempted."

--- Gartner, Use Central Log Management for Security Event Monitoring Use Cases, Toby Bussa, Kelly M. Kavanagh, 12 October 2016

 

Use Cases

Optimizing SIEM

Security Information and Event Management (SIEM) solutions are widely deployed to protect networks from internal and external threats. They provide alerting and reporting capabilities based on sophisticated event correlation analysis, but these analyses are only as good as the data collected from devices and applications.

 

syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM.

 

Rapid Search and Troubleshooting

Whether you need to respond to a security incident, troubleshoot infrastructure issues, or debug applications, searching millions or billions of logs quickly is usually the first step. Having the right log data at the right time easily accessible is critical to your success.

 

With the syslog-ng Store Box, you can find the answer. Search billions of logs in seconds using full text queries with Boolean operators to pinpoint critical logs.

 

Meeting Compliance Requirements

IT departments increasingly find themselves spending ever more resources on compliance as laws, regulations and industry standards mandate increasing security awareness and the protection of sensitive data. A secure log management solution can help meet compliance requirements.

 

The syslog-ng Store Box provides secure, tamper-proof storage and custom reporting to demonstrate compliance.

 

Big Data Ingestion

Many big data projects run into the 80/20 rule. 80% of resources is spent getting data into their analytic tools and only 20% on analyzing the data.

 

syslog-ng can deliver data from a wide variety of sources to Hadoop, Elasticsearch, MongoDB, and Kafka as well as many others.

 

Universal Log Collection and Routing

Organizations using multiple analytic tools and storage solutions often use multiple log management tools.

 

syslog-ng flexibly routes log data from X sources to Y destinations. Instead of deploying multiple agents on hosts, organizations can unify their log data collection and management.

 

Secure Log Data Archive

Securely manage and archive your log data. Log data often contains senstive information. Personally Identifiable Information (PII), user activity, transactions, and more.

 

The syslog-ng Store Box provides automated archiving, tamper-proof encrypted storage, granular access controls to protect log data. The largest appliance can store up to 10TB of raw logs.

 

The Foundation of Log Management

syslog-ng Store Box

syslog-ng Store Box (SSB) is an easy-to-deploy log management appliance to collect, normalize, store, search and audit your logs. It provides a web-based UI for easy configuration and reporting, ultra-fast full-text search, granular access policies and automated archiving capabilities. SSB collects and indexes events at a very high speed, providing a secure central log storage to feed downstream security and analytics tools, and allows for effective forensics for incident investigations.

syslog-ng Premium Edition

syslog-ng Premium Edition (PE) is a highly scalable and customizable log management solution supporting dozens of platforms, including Windows. You can free your logs from data silos and build a central log transport and management layer that's reliable, secure and fast. Besides premium features, we also provide enterprise-grade technical support and training programs.

syslog-ng Open Source Edition

syslog-ng Open Source Edition (OSE) is the trusted log management infrastructure for millions of users worldwide. Its a high performance tool with rich message parsing and re-writing capabilities, supported by a wide and very active community.