Graylog Documentation, Release 2.5.0
Maximalist
“Collect it all, let Graylog sort it out.”
The Maximalist strategy is to collect all events that are produced by any source. The thinking goes, all log data is
potentially valuable, especially for forensics. Collecting it all and keeping it forever guarantees you will have it if you
need it. However, this strategy is often not practical, due to budgetary or other constraints. The cost of this strategy can
be prohibitive, since many more technical and human resources must be devoted to collection, processing and storage
of event data. There is a performance penalty associated with keeping extremely large data sets online that must be
considered as well.
Use Cases
“What do you want to do with event data?”
Use cases should inform most decisions during the planning phase. Some of these decisions include determining the
event sources from which you must collect, how you will collect from these sources, how much of each event type to
store, how events should be enriched and how long to retain the data.
Use case, broadly defined, means the technical steps necessary to achieve a technical and/or business outcome. An
easier way to think about it is that a use case is a description of what you want to do with an event log once you’ve
collected it. Use cases are often categorized to group like activities. Some common use case categories are Security,
Operations, and DevOps. An example of a Security use case might be monitoring user logins to critical resources.
An operations use case might monitor network or hardware performance, while DevOps use cases would focus on
real-time application layer monitoring or troubleshooting.
Event Log Sources
“What logs do you need to collect?”
In an environment where seemingly everything generates event logs, it can be difficult to know what to collect. In most
cases, selection of event sources should be driven by the use cases you have identified. For example, if the use case is
monitoring of user logins to critical resources, the event sources selected should be only those of the critical resources
in question. Perhaps the LDAP directory server, Local servers, firewalls, network devices, and key applications.
Some other potential event sources by category.
Security
• Firewalls
• Endpoint Security (EDR, AV, etc.)
• Web Proxies/Gateways
• LDAP/Active Directory
• IDS
• DNS
• DHCP
• Servers
• Workstations
• Netflow
Ops
8 Chapter 2. Getting Started
我的内容管理
展开
