Security events that know which device they are about
Logs arrive at your own endpoint and are matched to the device, asset or site they name. Router events are tied to the exact interface and link.
Events with context
Each event is matched to the device, IT asset or site it names, so an alert starts with where, not just what.
Impact stated
Link alerts state what is at risk: circuits, wavelengths, LSPs, VRFs, services and customers.
Alerts go where you work
Slack, Teams, email, webhooks, PagerDuty, Opsgenie or ServiceNow, with the route shown on the alert.
From setup to answer in four steps
Create a source
Each source has its own key, which you can generate, rotate and revoke.
Send logs
POST NDJSON over HTTPS to your per-tenant endpoint.
Write rules
Threshold, pattern, absence and correlation rules are evaluated every minute.
Work the alert
Alerts move from open to acknowledged, investigating and resolved, or false positive, and can raise a ticket.
What you can do
Formats it understands
JSON, syslog in RFC 5424 and 3164, CEF, router syslog for Nokia SR OS, Juniper Junos, Arista EOS and Cisco IOS XR, and IP Fabric intent checks.
Four rule types
Threshold, pattern, absence (a silent source) and correlation: two rules within a window on the same site, device, interface or link.
Retention you set
Logs are searchable for 90 days by default, then archived for 365 days by default. Both periods are set per source. Screens include a log viewer with facets and a histogram, source health, volume metrics and a dashboard designer.
Works with the rest of the platform
Network inventory and discovery
Walk from site to building, floor, room, rack and device. Compare what is documented with what discovery observed, and approve the differences before anything changes.
Read moreIPAM, DNS and DHCP
See aggregates and prefixes as one tree with a utilisation bar on every row, then drill down to the address, the interface and the DNS name.
Read moreTelemetry and environment
Readings land beside the plan. See sensors on the floor, chart their history with limits drawn in, and compare measured kW with allocated kW rack by rack.
Read moreFrequently asked questions
How do logs get in?
By HTTPS to your own ingest endpoint, with a key per source that you can rotate or revoke.
Which formats are understood?
JSON, syslog (RFC 5424 and 3164), CEF, and router syslog from Nokia, Juniper, Arista and Cisco IOS XR.
Does an alert know which kit it is about?
Events are matched to the device, interface and link, and link alerts list the services and customers at risk.
How long are logs kept?
90 days searchable and 365 days archived by default, set per source.
Where do alerts go?
Slack, Teams, email, webhooks, PagerDuty, Opsgenie or ServiceNow, and a ticket can be raised automatically.
NetCosm is hosted in the United Kingdom, so your rack, power and network records stay in the UK.
See it on your own floor
Book a demo and we will walk through it with your rooms, racks and addresses in mind.