Logging & SIEM
Operations logging
Centralised syslog, application logs, indexing and long-term retention.
Architecture
Architecture
- 01Source
- syslog
- journald
- app logs
- firewall
- 02ShipBuffering and durability
- Vector
- rsyslog
- Filebeat
- 03ParseSchema and fields
- 04Index
- OpenSearch
- Loki
- Graylog
- 05RetainPolicy and archive
- hot / warm / cold
- S3 archive
Capabilities
Capabilities
Every item is marked: verified production experience, or engineering capability.
Centralised syslog
Proven- rsyslog
- Graylog
- Vector
Indexing and search
Capability- OpenSearch
- Loki
SIEM correlation
CapabilityDetection rules, MITRE ATT&CK-aligned content and response playbooks.
- Wazuh
- Sigma rules
Retention policy
CapabilityHot / warm / cold tiers and archive — balancing cost against requirement.
Audit trail
ProvenWho changed what and when — a complete change history.
Network device logging
Proven- Cisco
- Juniper
- MikroTik
- FortiGate
Technology stack
Technology stack
- Collection
- VectorrsyslogFilebeatWazuh agent
- Index
- OpenSearchLokiGraylog
- Analysis
- GrafanaOpenSearch Dashboards
Engagement model
Engagement model
Project
A one-off scope: audit, migration or implementation with a fixed outcome.
Retainer
Monthly engineering hours — specialist access on demand.
Co-managed
NetWizard and your in-house team together, with split responsibility.