4 ms·
I am shocked that no one has mentioned Graylog so far. Check it out. It's done wonders for me. You can manipulate,sort,retain and do other things on log events
by badrabbit 7y ago
I am shocked that no one has mentioned Graylog so far.
Check it out. It's done wonders for me. You can manipulate,sort,retain and do other things on log events with it. It uses elasticsearch to store the logs.
It has SIEM like functionality with alerts and they are continuing to make it more suitable as a SIEM replacement.
And it does have cloudtrail support.
- keyle 7y agoI was just searching for the word "graylog" as I was about to say the exact same thing.
- nullwarp 7y agoMy only real complaint with graylog is it seems between V2 and V3 all the modules/packs (or whatever they call them) broke and you the useful ones are broken now. Maybe it's better now since I tried but it was a real negative when trying to import some of them to find out later they were incompatible.
- badrabbit 7y agoIt could be. I was never exposed to 2.X