Elastic & OpenSearch.
Log storage, search and correlation platforms underlying our centralized log management.
01 What it is
Elastic and OpenSearch provide the storage, indexing and search layer for centralized logs — the platform logs actually land in and get correlated within.
02 Where it fits
Central log storage for SIEM-style correlation, coverage reporting, and as the query layer for investigating an incident after the fact.
03 Architecture
Logs ship from source via lightweight collectors (Vector, Fluent Bit), land in an indexed store, and are retained per your compliance requirement before moving to immutable archive.
04 XOOPIE expertise
We operate Elastic/OpenSearch as the backbone of our log management and monitoring service — configuring ingestion pipelines, retention and correlation rules is core, ongoing work.
05 Integration
Integrates with Wazuh for security telemetry, and with Vector/Fluent Bit for log shipping from firewalls, servers and applications.
06 Deployment considerations
Sized to actual log volume with retention tiers matched to compliance requirements — hot storage for recent logs, cheaper archival storage for older, less-frequently-queried data.
07 Monitoring & security
This is the layer log coverage reporting is built on — including tracking when a previously reporting source goes silent.
08 Limitations
Storage and compute costs scale with log volume and retention; we size this against actual requirement rather than defaulting to 'log everything forever.'
09 Alternatives we also work with
- Graylog and similar platforms, evaluated where an existing investment or preference makes them a better fit