Devices, systems, and methods for streamlining and standardizing the ingest of security data across multiple tenants

A security monitoring system capable of streamlining and standardizing the ingest of data across a plurality of tenant networks, each of the plurality of tenant networks comprising at least one log source, the security monitoring system comprising:

• a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to:
• receive raw log data from the log source associated therewith;
• and
• generate formatted log data based on the raw log data;
• an edge module configured to:
• ingest the formatted log data from the plurality of data gateway modules;
• and
• a central control plane module configured to:
• automatically update the configuration of at least one of the plurality of gateway modules in response to a change to the log source(s) associated therewith;
• wherein the security monitoring system is configured to implement a security action related to at least one of the plurality of tenant networks based on the ingested formatted data.

A system for streamlining and standardizing the ingest of security data, the system comprising:

• a plurality of tenant networks, each of the plurality of tenant networks comprising at least one log source;
• and
• a security monitoring subsystem comprising:
• a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to:
• receive raw log data from the log source associated therewith;
• and
• generate formatted log data based on the raw log data;
• an edge module configured to:
• ingest the formatted log data from the plurality of data gateway modules;
• and
• a central control plane module configured to:
• automatically update the configuration of at least one of the plurality of gateway modules in response to a change to the log source(s) associated therewith;
• wherein the security monitoring subsystem is configured to implement a security action related to at least one of the plurality of tenant networks based on the ingested formatted data.