What are the best practices for maximizing the value of log data?

Graylog Central (peer support)
, ,
1

Hi,

I’m currently working with Graylog, which contains log data from both Linux and Windows machines. I’ve been able to create streams, alerts, and dashboards etc but I’m struggling to find other ways to better leverage my log data.

I’d appreciate any suggestions on what else I could implement.

Thanks for your help !!!

2

What business problems do you want to solve / what questions are you trying to answer?

3
  1. before you ingest data, think what you want to see in them.
  2. ingest the data, answer your questions
  3. look through the data to find more answers to questions you did not know of beforehand.
4

I don’t have any particular problem. I’ve been asked to find a useful solution to improve the security of our system. I’ve been able to create alerts that notify me if someone tries to log in multiple times via SSH to one of my machines, for example. But I don’t see what else I could implement.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.