A SIEM that never drops your logs because of the licence

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

LogIntelligence collects syslog, CEF, JSON and log files through a collector at your site, parses common firewalls, DNS, identity and cloud sources, and alerts on built-in detection rules. Ingest is metered per day; above the licence you are alerted and billed, never silently dropped.

2The challenge

Firewalls, DNS servers and servers write the evidence of most attacks into logs nobody reads until after an incident — and SIEM licences often punish you for sending more of them.

The TotalHeal approach. A collector at your site sends syslog, CEF and log files to TotalHeal, where they are parsed, searched and checked by built-in detection rules. Ingest is metered per day, and nothing is ever dropped because of the licence.

3Architecture

4How it works

1. CollectEnrol a collector; point syslog, CEF, JSON and log files at it.
2. ParseBuilt-in parsers normalise common sources into one schema.
3. DetectBuilt-in rules for scans, denied bursts, threat-intel hits and brute force raise alerts.
4. SearchOne query language, saved searches and scheduled rules.
5. Keep180 days by default, with the retention view showing settings and approved changes.

5Capabilities in detail

• Collector at your siteSyslog over UDP, TCP or TLS, CEF, JSON and log files, from one enrolled collector with its own device identity. If the cloud is unreachable it keeps the events on disk and sends them later.
• Parsers for common sourcesFortiGate, pfSense / OPNsense, CEF firewalls (Check Point, Palo Alto), BIND and Zeek DNS logs, SSH logs, Microsoft Entra ID, Okta, Google Workspace, Microsoft 365, AWS CloudTrail, Azure Activity and Google Cloud audit logs.
• Detection rules for network logsPort scans and host sweeps, bursts of denied connections, allowed connections to threat-intelligence addresses, DNS queries for threat-intelligence domains, newly seen algorithm-like domains and login brute force from one address — each mapped to MITRE ATT&CK.
• Search, saved searches and scheduled rulesOne query language over every source; save searches and schedule them as rules that raise alerts. Business includes up to 10 scheduled rules, each run at most every 15 minutes.
• Metered ingest that never drops dataAccepted volume is measured per source and day. At 100 % of your licence you are alerted; up to 150 % the extra is billed; above that only sources that were not sending yet wait in their collector — existing sources keep sending.
• Retention you can seeEvents are kept 180 days by default, the CERT-In minimum; the retention view shows the setting, the floor and any approved change.
• Measured on our test systemIn our 25 Oct 2026 run, one collector took 30,000 FortiGate traffic lines over syslog/TCP into a test service on a development machine in 23 seconds (about 1,300 events a second), metered at 670 bytes per event, so 1 GB a day is about 1.5 million such lines; a search over them answered in 124–145 ms. The port scan and the burst of denied connections in the replay each raised one alert.

6Security and data handling

• Nothing dropped for the licenceAt 100 % you are alerted; up to 150 % is billed; existing sources keep sending.
• Survives outagesThe collector keeps events on disk and sends them later.
• Its own identityEach collector is an enrolled device with its own identity.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A Linux host at your site for the collector, reachable by your log sources
• Outbound HTTPS from the collector to TotalHeal

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.