RxLog DocsIntroduction
RxLog collects logs and enables you to search them, investigate with AI, and detect and respond to threats in real time. These docs cover everything from first ingest to building automated response to threats.
How logs travel through RxLog
Log collection starts with selection of the data sources to collect. Logs can be collected through several means: API polling, webhooks, and agent daemons running on your machines (system events, audit logs, files etc.). Upon collection they pass the pipeline, where they're normalized, filtered, and enriched, then stored in ClickHouse and queryable from the platform.
Detections run two ways: in real time as logs are ingested (matched against Sigma rules), and through scheduled queries that run continuously over stored data. Matches raise detections, which are correlated and grouped into incidents for triage and response.