TotalHealLogIntelligence

How it works

1. CollectEnrol a collector; point syslog, CEF, JSON and log files at it.
2. ParseBuilt-in parsers normalise common sources into one schema.
3. DetectBuilt-in rules for scans, denied bursts, threat-intel hits and brute force raise alerts.
4. SearchOne query language, saved searches and scheduled rules.
5. Keep180 days by default, with the retention view showing settings and approved changes.

Reference architecture

Key capabilities

• Collector at your siteSyslog over UDP, TCP or TLS, CEF, JSON and log files, from one enrolled collector with its own device identity. If the cloud is unreachable it keeps the events on disk and sends them later.
• Parsers for common sourcesFortiGate, pfSense / OPNsense, CEF firewalls (Check Point, Palo Alto), BIND and Zeek DNS logs, SSH logs, Microsoft Entra ID, Okta, Google Workspace, Microsoft 365, AWS CloudTrail, Azure Activity and Google Cloud audit logs.
• Detection rules for network logsPort scans and host sweeps, bursts of denied connections, allowed connections to threat-intelligence addresses, DNS queries for threat-intelligence domains, newly seen algorithm-like domains and login brute force from one address — each mapped to MITRE ATT&CK.
• Search, saved searches and scheduled rulesOne query language over every source; save searches and schedule them as rules that raise alerts. Business includes up to 10 scheduled rules, each run at most every 15 minutes.
• Metered ingest that never drops dataAccepted volume is measured per source and day. At 100 % of your licence you are alerted; up to 150 % the extra is billed; above that only sources that were not sending yet wait in their collector — existing sources keep sending.
• Retention you can seeEvents are kept 180 days by default, the CERT-In minimum; the retention view shows the setting, the floor and any approved change.
• Measured on our test systemIn our 25 Oct 2026 run, one collector took 30,000 FortiGate traffic lines over syslog/TCP into a test service on a development machine in 23 seconds (about 1,300 events a second), metered at 670 bytes per event, so 1 GB a day is about 1.5 million such lines; a search over them answered in 124–145 ms. The port scan and the burst of denied connections in the replay each raised one alert.

Deployment options

System requirements

Technical specifications