SRAN Metalog

Appliance or Standard Computer Device: This is either an appliance or a standard computer device capable of collecting and aggregating event logs from both appliance and non-appliance devices, such as firewalls, network devices, operating systems, appliances, network systems, and databases. It can display logs in a consistent format regardless of the number of devices connected to the system.
Multi-Source Collection: Able to gather data from various sources including network device logs, endpoint logs from Windows and Linux agents, and application logs in Syslog formats (RFC5424, RFC3164) as well as non-Syslog formats.
Raw Data Storage: Stores raw data by organizing it according to device name, date, and hou
Centralized and Forwarder Mode: Supports both centralized and forwarder modes for computer traffic data storage. Logs can be forwarded by creating filters based on criteria such as host name, event type, importance level, or message keyword, and sent to other Syslog servers or SIEM devices via Syslog protocol, without altering the original data.
Network Protocol Support: Supports data transmission and reception via network protocols UDP and TCP, with the ability to use TLS/SSL certificates for secure communication with source devices.
Real-Time Display: Provides real-time visualization of source log devices sending log data, including EPS volume, throughput, forwarded log volume, and data at the log destination endpoint.

Data Encryption: Utilizes SHA-256 standard for data integrity verification of stored information.
Log Archive Download: Allows downloading of log archives for specified time periods. Exported logs can be encrypted with options including password-protected ZIP files and AES encryption.
Syslog Storage: Capable of storing Syslog-formatted log files from devices such as routers, switches, firewalls, VPNs, and servers.
Device Management: Supports management of devices through HTTPS, Command Line Interface (CLI), and SSH.
NOSQL Database Storage: Utilizes NOSQL databases for fast storage and retrieval of data.
Full Text Search: Supports full-text search using Dynamic LINQ expression language and Event Query Language.
Log File Indexing: Employs indexing technology to enhance search performance, supporting both full-text search and field-specific search. Search capabilities include conditions such as AND, OR, wildcard expressions, regular expressions, and the ability to specify time ranges or scopes for searches.

Compliance with Data Protection Laws: Ensures accurate storage of log files in accordance with the Computer Crime Act. The SRAN Module Logger software complies with the NECTEC Standard NTS 4003.1-2560 (NECTEC STANDARD NTS 4003.1-2560) and holds a MiT (Made in Thailand) certification from the Industrial Council, confirming its suitability for retaining computer traffic data.
Advanced Compression Technology: Capable of storing large log files using advanced compression technologies such as LZMA and ZSTD. This reduces file sizes significantly (up to 15:1 compression ratio), minimizing hard disk space usage while maintaining high security through encryption. Suitable for storing both Syslog and Non-Syslog data from network devices, databases, and critical applications.
Data Backup: Supports data backup to external storage devices such as tape drives or external storage units.
High-Volume Data Handling: Manages high volumes of log data from multiple sources through an automated load balancer for efficient data queuing and processing.