vivida (David)

VPN, mobile carrier CGNAT, or Apple Private Relay. All three make one person look like they are in three countries in an hour.

Before chasing it, check whether the address belongs to a hosting provider. A sign-in from a data centre is worth a question even when the country is plausible, and one from a residential ISP in an odd country often is not.

Both, and that is fine. Agentless for anything that already speaks syslog, agents where you need file tailing, buffering or local state.

Windows event logs and application log files both need an agent. Network gear and appliances cannot take one. Most estates end up mixed, and the mistake is picking one on principle then fighting it for two years.

You get to write one detection instead of six.

Without it, a rule for failed authentication has to know Windows calls it 4625, sshd says Failed password, FortiGate has its own wording, Azure has another. With it you write "authentication failure" once.

Cost is real though. Every new source needs mapping and the mapping is where the bugs live. Worth it if you write detections, not worth it if you mostly search, because search does not care about schemas.

Variation I like: keep the rules, change the delivery. Anything you would not wake up for goes into a daily digest instead of an email each. Same coverage, one message instead of two hundred.

Very rough, per day, before compression:

Quiet Linux box, syslog only: 5 to 50 MB
Linux web server with access logs: 200 MB to several GB, entirely traffic driven
Windows member server: 50 to 200 MB
Domain controller with auditing on: 1 to 10 GB, worse if somebody enabled everything
Firewall with session logging: 1 to 20 GB, and this is the one that surprises people

The DC and the firewall are what blow budgets, and both are mostly one or two event types repeating.

Safe: health checks from your own load balancer, 200 and 304 for images, css and js, your own monitoring.

Not safe: anything 4xx or 5xx, anything POST regardless of status, anything touching an admin path.

The subtle one is that dropping all static 200s also loses the evidence somebody downloaded a file they should not have. If you have files behind auth, keep 200s for those paths.

If you need to justify it to somebody, the argument is not "we are losing X". It is "we cannot tell whether we are losing anything, and that is the problem".

Skip the framework, answer four questions.

What is the first thing you want it to catch?
Where do the logs come from on day one?
Who gets the alert at 3am?
What do you pay per GB and what happens when you go over?

If a vendor cannot get through those four in one call, that is your answer.

Rough numbers from clients, per month, small team:

Self hosted Wazuh or Graylog: just the server, so 100 to 400 depending on retention
Sentinel: wildly variable, 300 to several thousand, it is per GB and the GB add up faster than anyone predicts
Splunk: if you are asking about price you are not the customer
Smaller commercial platforms: 100 to 1000

The thing that catches people is that the licence is not the cost. The cost is the person who runs it.

Zeek is the one I always want and rarely get to keep. Genuinely excellent data, then somebody looks at the storage and it quietly goes away.

The RITA pairing is a good call though. Beaconing detection is one of the few things that really does need full connection data.

So many options and tools at all price ranges. What are you really trying to accomplish? Define that first, and specifically your budget.

Otherwise you spend six weeks in demos and pick whoever had the best salesperson.

Seconding that. "I used it as a student" is a much better position than "I read good things about it".

ELK is not simple to implement. It is simple to start and then it is your second job. Graylog is friendlier but you are still running Elasticsearch underneath either way.

What is actually missing from what you have now? If it is search, Graylog helps. If it is alerting and correlation, stay where you are and spend the time on rules instead.