Collect Once, Analyze Everywhere

The Problem

• Volume of telemetry is rising due to cloud adoption, IoT, tool sprawl, and new categories of AI apps and AI security solutions.
• Regulatory demands (from GDPR to new cyber disclosure rules) require high-quality, auditable log data.
• Compliance requirements around reporting are expanding and becoming more detailed.
• Security tools produce logs in different formats, increasing the complexity of correlation and detection.
• Traditional SIEM licensing models are financially unsustainable for large-scale data ingestion.

Our Solution

• A software-only telemetry pipeline that supports the collection, enrichment, transformation, and routing of security data from sources to multiple destinations.
• Targeted to security operations that are struggling with large volumes of disparate data, high operational costs, alert fatigue, and missed threats.
• Lets you reshape and route data to the right tools at the right cost tier, without being locked into a single vendor.
• Available as a flexible software license that you can deploy in your own infrastructure or cloud.
• Backed by a team with extensive experience in security logging, SIEM, and regulatory compliance.

Focus

Like Michelangelo, who removed "everything that is not in the stone" to reveal the statue of David, Logcollect removes everything that is not essential in your telemetry stream so your security tools can clearly see what matters.

Deep Experience & Team

• Technology lineage from EventTracker, deployed on over 1 million endpoints.
• Trusted across 2,500+ SIEM installations worldwide.
• Intimately familiar with the security logging problem; implemented at thousands of customers worldwide over the last decade.
• Rich experience in all aspects of the SIEM, XDR, and security space over 15+ years.

Direct Competitors (Telemetry Pipelines)

• Cribl Stream
  Market leader in routing, shaping, and filtering logs for Splunk, Sentinel, and Chronicle.
  Logcollect advantage: simpler, lower-cost, includes endpoint agent + compliance retention.
• Mezmo Telemetry Pipeline (LogDNA)
  DevOps-focused pipeline for shaping and routing telemetry.
  Logcollect advantage: security-native, SIEM-focused, stronger compliance capabilities.

Traditional Collectors

• Snare
  Widely deployed log collector in regulated sectors.
  Logcollect advantage: multi-destination routing, shaping, compression, and compliance automation.
• NXLog
  Strong Windows/syslog collector, heavily driven by configuration scripting.
  Logcollect advantage: central orchestration, agent policy control, less scripting.

Open-Source Pipeline Tools

• Fluentd / Fluent Bit
  Powerful but DIY; requires engineering effort and lacks built-in compliance features.
  Logcollect advantage: purpose-built security pipeline, compliance reporting, endpoint prioritization.
• Logstash (Elastic)
  Highly flexible but resource-heavy, typically used for Elastic environments.
  Logcollect advantage: SIEM-agnostic, optimized for Windows logs, prebuilt compliance workflows.

Key Differentiator

Logcollect is not just a collector or open-source pipeline — it is a security-grade telemetry pipeline with:

• SIEM cost reduction (cut 30–70% ingestion volume)
• Endpoint agent with prioritization and mapping
• 400-day compressed retention
• Automated compliance reporting
• No vendor lock-in (forward to any SIEM)

Product Capability

Logcollect is a software-only telemetry pipeline that supports the collection, enrichment, transformation, and routing of security data from sources to multiple destinations.

It is targeted at security operations struggling with large volumes of disparate data, high operational costs, alert fatigue, and missed threats. Logcollect is available as a software license or fully hosted in AWS and is backed by a team with extensive experience in security logging, SIEM, and regulatory compliance.

Collect once, analyze everywhere.

Benefits

• Cost reduction: Prioritize and route high-value security data to expensive threat detection platforms for review by expert staff, while sending low-value compliance data to highly compressed, low-cost storage with automatic compliance report generation.
• Optimized data ingest: Automate the collection of security event data from a wide range of sources including servers, networks, cloud environments, applications, and agents.
• Data hygiene & curation: Filter, normalize, and transform security data to reduce noise and improve signal.
• Scale: Reshape and redistribute security data to best-fit platforms such as SIEM, Data Lakes, compressed low-cost storage, and time-series databases.
• Vendor agnostic: Avoid lock-in and balance cost, performance, and scale across multiple vendors and platforms.

Fast Search & Common Indexing Model

• Extensible Common Indexing Model standardizes fields and schema.
• SSD-backed index enables rapid search across large log volumes.
• Search using Lucene query syntax or a REST API with Query DSL.
• Uniform normalized fields simplify investigations and threat hunting.

Key Features

• Log collection from endpoints and popular SaaS sources – no log left behind.
• Filter and forward logs to any SIEM, data lake, or other security platforms.
• Index logs in Elasticsearch with up to 30 days of retention in fast SSD storage.
• Compress logs by up to 90% and store for 400 days on low-cost disk to meet compliance needs.
• Automatic report generation for 26 regulatory compliance standards.
• Audit-ready report review framework to demonstrate compliance.

Robust Agent for Windows Endpoints

• Collects all local Windows logs and can receive/relay syslog from local firewalls.
• Extracts device IDs from syslog and transforms system names/fields (e.g., Store #7 mapping).
• Supports fine-grained filtering including regular expressions (RegEx).
• Applies data prioritization to transmit security data immediately and send other data in batch mode with compression.
• Routes logs to multiple destinations (Splunk, Chronicle, Microsoft Sentinel, Securonix, etc.).
• Transfers data securely using syslog over TLS.
• MSI package deployment with no reboot required.
• Centrally manages agent health, configuration, and auto-updates.
• In production for 10+ years with millions of installations.

Retention & Storage Optimization

• Compressed log storage for 1–7 years depending on compliance needs.
• High compression ratios reduce long-term storage cost.
• Full-fidelity logs retained without burdening the SIEM.
• Ideal for PCI, HIPAA, NIST, FISMA, SOX, GDPR retention mandates.

Licensing

Simple licensing model based on the number of endpoints with unlimited log volume.

Support for 26 Frameworks

Out-of-the-box content and reporting for a broad range of regulatory and industry standards, including:

• PCI DSS
• HIPAA
• NIST 800-171
• NIST 800-53
• GDPR
• NERC
• SAS 70
• GPG13
• ...and many others (26 frameworks in total)

Full Lifecycle Support

• Map of requirement to implementation – clear traceability from control to log data and reports.
• Automatic report generation for each supported framework.
• Framework for annotation – annotate findings, compensating controls, and remediation steps.
• Proven across many customers worldwide, including U.S. Government and DoD environments.