Log Management GuideΒΆ

Log Management is an important Punchplatform use case. A complete log management solution breaks down into several components: log collection, log parsing, event management, archiving and indexing. The punchplatform supports standard configurations ot support these components:

  • LTR (Log TRansfer) and LMR (Log Management Reception) are used to collect and transfer the logs;
  • LMC (Log Management Center) is in charge of parsing, normalising, enriching indexing and saving your logs.
../../_images/LTR-LMC.png

The parsing, enrichement and normalization phases are an essential part of the chain. These are performed by punchlets, small parsers and functions written in Punch (Getting started). The PunchPlatform ships in with many standard log parsers written by cybersecurity experts.

This chapter explains all these topics in details.