ELK is a good option - I'm a fan of open source. You can build it on your own (http://logz.io/blog/deploy-elk-production/ http://logz.io/blog/deploy-elk-produc

ELK is a good option - I'm a fan of open source. You can build it on your own (http://logz.io/blog/deploy-elk-production/ http://logz.io/blog/deploy-elk-production/) or you can use ELK as a service (disclaimer, I work for Logz.io which offers such service). We see customers use ELK to detect intrusion attempts by monitoring and alerting on: - Access from specific countries - Internal connections to specific countries - SSH auth request - Correlation between failed logins across multiple machines - kernel exceptions (which may be buffer overflow attempts) - AWS VPC Logs - AWS Cloudtrail logs - we internally use it extensively to audit access HTH