Security Information and Event Monitoring (SIEM): Combination of different data source into one tool that provides real-time analysis of security alert generated by applications and network hardware.
Log File: File that records either events that occur in an Operating System or other software that runs, or messages between different users of a communication software.
Syslog/Rsyslog/Syslog-ng: Logs data from different types of systems in a central repository (Linux and Unix).
Journalctl: Linux utility used for querying and displaying logs from the journald, which is responsible for managing and storing log data on a Linux machine.
NXLog: Multi-platform log management tool that helps to easily identify security risks, policy breaches, or analyze operational problems (Linux, Unix, and Windows).
NetFlow: Proprietary network protocol system created by Cisco that collects active IP network traffic as it flows in or out of an interface. Captures: Point of Origin, Destination, Volume, Paths. This is not full packet capture.
Sampled Flow (sFlow): Provides a means for exporting truncated packets, together with interface counters for network monitoring. NetFlow captures IP flow statistics; sFlow captures a statistical sample of packets at the interface level, making it less resource-intensive and truly protocol-agnostic.
Internet Protocol Flow Information Export (IPFIX): Universal standard of export for IP flow information from routers, probes, and other devices.
Metadata: Data that describes other data.
Graphical display of information across multiple different systems for a comprehensive overview.
Splunk: Large-scale data platform that can process various data types including security and incident response data.
Automatically computer-generated report. As you drill down, determine if something was malicious, suspicious, or benign.
Generates scan reports automatically. Review vulnerability scan results to confirm if detected vulnerabilities actually exist.
Gathers all data sent to and from a specific network device.