a {
text-decoration: none;
color: #464feb;
}
tr th, tr td {
border: 1px solid #e6e6e6;
}
tr th {
background-color: #f5f5f5;
}
Log Viewer Feedback and Feature Suggestions
The Log Viewer, particularly when combined with custom rules, is a powerful tool and provides a great deal of flexibility for monitoring and alerting. However, while it is already quite capable, I sometimes feel it could benefit from a little more power to truly control the Force when it comes to advanced filtering and event processing.
The documentation available through the customer portal provides a good starting point, but I found it somewhat limited when it comes to advanced rule configuration, troubleshooting, debugging, and real-world use cases. Additional examples, best practices, and guidance around rule processing would be very helpful for administrators trying to build more sophisticated alerting.
I am posting here because, after searching THWACK, I was unsure where best to provide product feedback and suggestions.
Observations and Suggestions
Rule Processing
One area that I found slightly confusing is rule processing behaviour. In my testing, some rules did not appear to function as expected unless they were placed within the Global Processing Rules section.
Additional documentation or visibility into rule processing order would help users better understand how rules are evaluated and how different rule types interact.
Excluding Specific IP Addresses
A common use case is excluding trusted systems from generating alerts.
For example, vulnerability scanners often generate authentication failures or other expected events during routine scans. Ideally, these events could be excluded from specific alerting rules without discarding the underlying log entries.
In my testing, placing a drop rule before a processing rule appeared to remove all associated content rather than simply exclude the event from a particular alert. More granular exclusion options could provide greater flexibility while preserving valuable log data.
Additional Filtering Capabilities
It would be beneficial to see additional filtering options, particularly for:
- Windows Event Logs
- Event message content
- Authentication and login events
- User accounts or account types
- Device groups or classifications
- Keywords or specific text within log messages
More advanced filtering would help reduce noise, improve alert accuracy, and make it easier to focus on meaningful events.
Conclusion
Overall, I have been impressed with the capabilities of the Log Viewer and custom rules engine. With enhanced documentation, greater transparency around rule processing, and more granular filtering options, it could become an even more powerful tool for administrators looking to fine-tune their monitoring and alerting strategies.
I would be interested to hear how others are approaching similar use cases and whether there are best practices or techniques I may have overlooked. After all, many of us are simply trying to bring a little more balance to the Force of log management. 😉
