Guidelines

This is a forum about logging, SIEM, and everything that produces a log file. Firewalls, servers, cloud audit trails, compliance, parsing, storage, the lot. It is run by Trunc, but it is not a support channel and vendor answers get no special weight.

What to post

• Specific questions. "Why is my SIEM slow" is hard to answer. "FortiGate session logs are 90% of my ingest, can I drop them" is not.
• Links worth other people's time: writeups, post-mortems, tooling, standards changes.
• Answers, including half of one. "I hit this and here is what I found" is useful even when it is not a fix.

What not to post

• Product marketing dressed as a question. That includes ours.
• Anything you would not want an auditor to read. Which brings us to the important one.

Redact your logs

Paste real log lines, they make questions much easier to answer. Just be aware a log line gives away more than people expect. Worth swapping out before you post:

• Public IP addresses. Use the documentation ranges: 192.0.2.x, 198.51.100.x, 203.0.113.x.
• Hostnames and domains, including internal ones. Internal naming tells people how your network is laid out.
• Device serial numbers and licence keys. A firewall serial is a unique identifier tied to your support contract.
• Usernames and email addresses.

Keep the structure, change the values. Nobody can tell, and the question is just as answerable.

Moderation

Questions get read before they appear, usually within a few hours. It is a spam measure rather than an editorial one and it applies to everyone, including us. Answers are not held for review.

Downvoting needs a bit of karma first, since that is where new accounts do the most damage. Downvote things that are wrong, not things you disagree with.

Reporting

Spotted something that needs attention? Email support@noc.org with a link.