ONE IDENTITY
Syslog-ng
Store Box

High performance, enterprise-class log management appliance

Syslog-ng Store Box™ (SSB) is a high performance, high reliability log management appliance that builds on the strengths of syslog-ng Premium Edition. With SSB, you can collect and index log data, perform complex searches, secure sensitive information with granular access policies, generate reports to demonstrate compliance, and forward log data to 3rd party analysis tools.

Key Features

SEARCH AND REPORT

With full-text search, you can search through billions of logs in seconds via the web-based user interface. Wildcards and Boolean operators allow you to perform complex searches and drill down on the results.

STORE AND FORWARD

You can store large amounts of log data, create automated retention policies, and backup data to remote servers.

SECURE LOG DATA

Log data frequently contains sensitive information. SSB can store log data in encrypted, compressed, and time-stamped binary files restricting access to authorized personnel only.

Use cases

BIG DATA INGESTION

Many big data projects run into the 80/20 rule. 80% of resources is spent getting data into their analytic tools and only 20% on analyzing the data.
Syslog-ng can deliver data from a wide variety of sources to Hadoop, Elasticsearch, MongoDB, and Kafka as well as many others.

UNIVERSAL LOG COLLECTION AND ROUTING

Organizations using multiple analytic tools and storage solutions often use multiple log management tools. syslog-ng flexibly routes log data from X sources to Y destinations. Instead of deploying multiple agents on hosts, organizations can unify their log data collection and management.

RAPID SEARCH AND TROUBLESHOOTING

Whether you need to respond to a security incident, troubleshoot infrastructure issues, or debug applications, searching millions or billions of logs quickly is usually the first step. Having the right log data at the right time easily accessible is critical to your success. With syslog-ng Store Box, you can find the answer. Search billions of logs in seconds using full text queries with Boolean operators to pinpoint critical logs.

OPTIMIZING SIEM

Security Information and Event Management (SIEM) solutions form the core of many enterprises’ IT security strategy but they can be expensive to deploy and maintain. Syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM.

SECURE DATA ARCHIVE

Log data often contains sensitive information – Personally Identifiable Information (PII), user activity, transactions, and more. Syslog-ng Store Box provides automated archiving, tamper-proof encrypted storage and granular access controls to protect log data. You can securely manage and archive your log data for long term. The largest appliance can store up to 10TB of raw logs.

MEETING COMPLIANCE REQUIREMENTS

IT departments increasingly find themselves spending ever more resources on compliance as laws, regulations and industry standards mandate increasing security awareness and the protection of sensitive data. A secure log management solution can help meet compliance requirements. The syslog-ng Store Box provides secure, tamper-proof storage and custom reporting to demonstrate compliance.

Features

SEARCH AND REPORT

With full-text search, you can search through billions of logs in seconds via the web-based user interface. Wildcards and Boolean operators allow you to perform complex searches and drill down on the results.

Users can easily create customized reports from the charts and statistics they create on the search interface to demonstrate compliance with standards and regulations such as PCI-DSS, ISO 27001, SOX and HIPAA.

STORE AND FORWARD

You can store large amounts of log data, create automated retention policies, and backup data to remote servers.

The largest appliance can store up to 10 terabytes of uncompressed data.You can also forward logs to third party analysis tools or fetch data from syslog-ng Store Box via its REST API.

SECURE LOG DATA

Log data frequently contains sensitive information. SSB can store log data in encrypted, compressed, and time-stamped binary files restricting access to authorized personnel only.

Authentication, Authorization and Accounting settings can restrict access to the SSB configuration and stored logs based on user group privileges and can be integrated with LDAP and Radius databases.

COLLECT AND INDEX

The syslog-ng Store Box’s indexing engine is optimized for performance. Depending on its exact configuration, one syslog-ng Store Box can collect and index up to 100,000 messages per second for sustained periods.

When deployed in a client-relay configuration, a single SSB can collect logs from tens of thousands of log sources