Centralized logging with cloud SIEM and SOAR security

Description

Across AWS, GCP and Azure, there are more than two thousand cloud services emitting log data. This invites a new set of challenges into enterprise log management. Market leaders such as Splunk and Sumo Logic not only expect a cloud infrastructure to be configured consistently across services, regions and accounts but also require supporting engineering teams to set up logging parameters for each cloud service. These unrealistic expectations increase administrative overhead and often result in missing or fragmented cloud service logging data.

Conflux is a Cloudaware Log Management solution that takes a low-friction, high-value approach by automatically discovering, ingesting, and organizing cloud service logs. With complete visibility into logs gained, Conflux also leverages CMDB data to enhance log events with infrastructure metadata such as tags.

Automatic log discovery

Each cloud service instance streams logs to a different destination. For example, each AWS Elastic Load Balancer has a specific logging destination S3 bucket, while an AWS RDS instance streams its logs to a unique CloudWatch Log Group. Cloudaware Conflux automatically discovers and parses AWS, Azure and GCP log sources. Users can define the level of observability in cloud infrastructure by granting necessary permissions to the sources that they would like to share with Cloudaware.

Organization and search

There are hundreds of different proprietary log formats across thousands of multi-cloud service classes. Cloudaware Conflux knows how to differentiate one class from another. After log discovery, Conflux aggregates event data into a log index, specific for each cloud service class. Conflux uses the Elasticsearch engine to enhance search capabilities. Event feeds can be filtered by different attributes such as log class, cloud account, user identity, tag, etc. This allows users to inspect the raw data and track down critical event patterns.