{'fraction_non_alphanumeric': 0.022779043280182234, 'fraction_numerical': 0.0015186028853454822, 'mean_word_length': 5.656565656565657, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Comparative Analysis of Open-Source Log Management Solutions for Security Monitoring and Network Forensics

Nowadays, centralised event log management plays a crucial role in security monitoring and network forensics. While commercial log management solutions are regularly reviewed and compared by independent organisations (e.g. Gartner Magic Quadrant reports), such comparisons are often hard to find for open-source tools, especially for recently created solutions. However, many institutions are using open-source tools for monitoring and forensics, since they allow for implementation of incident detection and analysis frameworks in a cost-efficient way. Furthermore, recently appeared open-source solutions have started a new architectural trend, where the log management system consists of independent and replaceable modules which interact through well-defined interfaces and protocols. In contrast, most commercial systems are essentially monolithic solutions where individual components (such as the GUI or event collector service) cannot be changed for a component from another vendor. In this paper, we will focus on widely used open-source solutions for log management and discuss their recent developments. We will also cover novel technologies and tools which have appeared during the last 2-3 years.