Forum Discussion

MarPas's avatar
MarPas
Brass Contributor
Mar 10, 2025

Cribl o Logstash vs AMA CEF: What’s the Best Choice for Ingesting Firewall Logs?

Hi everyone, what are the advantages of using Cribl or Logstash over a CEF log collector via AMA for ingesting firewall logs such as Palo Alto for example into Microsoft Sentinel? In a typical scena...
cost management
data collection
Log Data
duliprb's avatar
duliprb
MCT
Mar 13, 2025

MarPasIndeed, it alternatively reduces the overhead on syslog. I also appreciate your opinion on this regard. Major impact is reduced log volumes. enriched volumes means low data ingestion charges.

 

Resources