Log360 Evaluator FAQ

Log360 supports a wide range of log sources out-of-the-box. Additionally, logs from legacy systems and in-house applications can be parsed using the custom log parser. Below are the commonly added log sources to Log360:

• Domain Controllers
• Windows/Unix servers
• Workstations
• Databases
• Network devices: firewalls, IDS/IPS, routers, switches
• File systems
• Security solutions such as vulnerability scanners and threat solutions
• Cloud infrastructure such as AWS, Azure, and Google Cloud Platform
• SaaS such as Microsoft 365 and Salesforce

Log360's key features are listed below:

• Comprehensive log monitoring
• Real-time Active Directory change auditing
• Robust behavior analytics
• Integrated IT compliance management
• Data protection
• Threat intelligence and analytics
• End-to-end incident detection, management, and response

Log360 is a comprehensive SIEM solution that can be used by enterprises of all sizes across industries. Below are the USPs of the solution:

• Single console for monitoring and securing your entire IT infrastructure
• Easy to deploy, manage, upgrade, and scale up
• Wide range of out-of-the-box report and alert profiles
• Advanced attack mitigation capabilities: cutting-edge analytics, threat intelligence, and response workflows
• Affordable pricing: You pay for only what you need by licensing and enabling the components as per your requirements.

Log360 has been positioned in the Gartner Magic Quadrant for SIEM for four years in a row. Read the latest report here.

Log360 is an integrated SIEM solution with components focused on securing different parts of your infrastructure. Listed below are the components that make Log360:

• EventLog Analyzer: Log monitoring for the network perimeter, servers, applications, and security solutions.
• ADAudit Plus: Real-time Active Directory auditing
• Cloud Security Plus: Public cloud infrastructure auditing
• Exchange Reporter Plus: Dedicated monitoring of Exchange servers
• M365 Manager Plus: Dedicated monitoring for Microsoft 365
• ADManager Plus: Reporting on Active Directory risks
• DataSecurity Plus: Data visibility, auditing, and protection
• Log360 UEBA: Machine-learning-based analytics and risk scoring

Licensing is based on the log sources and add-ons required. Pricing is based on the number of:

• Domain Controllers
• Member servers
• Applications
• Syslog devices
• Workstations

The following add-ons are available for addressing specific needs:

• SQL and IIS auditing
• File integrity monitoring (FIM)
• Exchange auditing
• Microsoft 365 auditing
• UEBA
• Advanced threat analytics

Get a price quote right away here.

Log360 can be downloaded here. The solution can then be installed as an application (by default) or as a Windows service. The standard installation downloads all the components of Log360. Alternatively, you can customize the installation by choosing the components of Log360 that you would like to download.

Yes, an individual component can be upgraded to Log360. If you are already using one of the components of Log360, you can easily license other components/add-ons and upgrade your Log360 installation. The components can be integrated in the Admin Settings of Log360.

Hardware Requirements:

A dedicated server with the following hardware configuration,

Software Requirements:

ManageEngine Log360 supports the following Microsoft Windows operating system versions:

Note: ManageEngine M365 Manager Plus does not support Windows OS versions 2003,2008, XP, and Vista. And it supports Windows OS versions 7 and 2008 R2 only when Service Pack 1 (SP1) is installed.

Supported Browsers

ManageEngine Log360 requires one of the following browsers to be installed on the system to access the Log360 web client.

• Internet Explorer 9 and above
• Firefox 4 and above
• Chrome 10 and above
• Safari 5 and above

Supported Databases

Bundled with the product

• PostgreSQL

External databases

• Microsoft SQL Server 2000
• Microsoft SQL Server 2005
• Microsoft SQL Server 2008
• Microsoft SQL Server 2012
• Microsoft SQL Server 2017

Best practices for securing your installation can be found in this guide.

Yes, individual components of Log360 can run on different servers. This is particularly useful for optimizing performance. Below are the steps to move Log360's components to different servers:

• Login to ManageEngine Log360 as an administrator.
• Navigate to Admin > Log360 Integration and choose the component that you want to move to a different server. Click on Remove to remove the component.
• Wait until the component is removed and the sync gets completed.
• If the component is still running, open the Command Prompt as an administrator. Navigate to the path / bin and execute the command: shutdown.bat
• Copy the component's folder to the desired remote server.
• Start the product on the server by opening Command Prompt as an administrator. Navigate to the path /bin and execute the command: .\wrapper ..\conf\wrapper.conf
• Once the component is up, choose the desired component by navigating to Admin > Log360 Integration.
• Enter the name or IP address and the port number of the server on which that component is running. Select the connection Protocol from the drop down menu.
• Select the authorization checkbox and provide the credentials of the server. Then, click on Integrate Now. This will integrate the component and synchronization will start.

CPU utilization depends on various parameters. The following can be tried to reduce abnormally high CPU utilization:

• Try moving a component of Log360 to a different server.
• Enable an optimal audit policy to generate log records only for the required events of interest.
• Set up log collection filters.
• Review alerting and correlation rules that have been enabled.

The database can be migrated with or without data as required. Below are the steps to migrate the database with data:

Note: SQL native client must be installed in the server. Supported MS SQL database versions are 2005 and above.

• Log into Log360 as an administrator. Navigate to Admin > General Settings > Database Settings > Database Migration.
• Select Log360 under Component Name. Enter the name of the database.
• Under database configuration, select MS SQL server.
• Enter the host name or IP address and the port number of the MS SQL server.
• Select the SQL server instance that you want to use.
• Browse and select the appropriate bcp.exe and bcp.rll files.
• You can either use Windows credentials or a SQL server user account for authentication.
• Check the box against Migrate Existing Data to copy the data from your old database to the new database.
• Test the connection and click Configure to migrate the database. The product will restart with the new database.

Below are the steps to migrate the database without data. Ensure you stop Log360 before proceeding:

Note: SQL native client must be installed in the server. Supported MS SQL database versions are 2005 and above.

• Copy the bcp.exe and bcp.rll files from the SQL Server installation directory and paste them in the Log360 bin folder (<Log360_installed_directory/bin).
• Open Command Prompt as Administrator.
• Navigate to the Log360 bin folder and run: ChangeDb.bat
• Once the database setup wizard opens, change the server type to MS SQL.
• Enter the MS SQL server name in the host name field and select the SQL Server instance you want to use.
• Enter the new database name which will be created for Log360.
• You can either use Windows credentials or a SQL server user account for authentication.
• Click Test to verify the connection and then save. The changes will be updated once you start Log360.