LOGbinder Blog

Updates, Tips and News   RSS Feed  

«  Exchange Server 2016: “Fo... | Making SIEM better by foc... »

LOGbinder’s formatted output is an unsung hero

Mon, 19 Oct 2015 12:35:07 GMT

Security analysts need to be confident in their audit monitoring performance. Anybody can rotate car tires, but only a professional can properly rotate and balance the wheels to improve tire performance and safety. The same is true with application audit log parsing. For most SIEM security analysts, only LOGbinder delivers the performance and stability that security and compliance policies demand.

Not all that long ago data analysts and early log management platforms were stuck with “garbage in” problems. Remember when it was problematic even to import a text file, leave alone the esoteric ones with packed headers and binary fields? Headers were missing, delimiter collisions were constantly causing headaches, file parsing was a resource hog, and transport speed was something you could experience only from the bridge of U.S.S. Enterprise NCC-1701-D. It is still a difficult process, but LOGbinder’s formatted output has made all that a distant memory for a lot of people.

Our developers put extensive thought into how to best present security audit events for SIEMs to consume. LOGbinder software presents a robust and meaningful file (or UDP stream), thoughtfully formatted for SIEM consumption. The result is speed, of course, but also stability at any processing speed.

This comes up because recently we were asked to help a customer to achieve a log consumption rate of 1 GB/minute! We’re working on the challenge (and think we’ll exceed the customer requirement) but the thing is we can do it because already our carefully crafted output formats will allow it. No other “home grown” solution can come anywhere close to that value proposition.

Perhaps it is easy to undervalue just how sublime it is to have a log input option That. Just. Works.

If your stakeholder confidence is vital enough, your organization’s reputation is important enough, only LOGbinder is strong enough to reliably feed your SIEM.


Comments disabled

powered by Bloget™