Sold by: XPLG
Deployed on AWS
PortX sits between your sources and your destinations and makes the stream itself intelligent. It collects logs, metrics and events once - syslog, agents, cloud APIs, Kafka, files - and applies parsing, filtering, deduplication, sampling, masking of sensitive fields, enrichment and schema transformation while the data is in motion. Routed outputs go to Splunk, Sentinel, Google SecOps, Elastic, S3, Snowflake, OpenTelemetry backends or XpoLog, each receiving exactly the shape and volume it needs. Teams use PortX to cut SIEM and observability ingestion cost 30-70 percent, to migrate between platforms with zero ETL rewrite, and to keep PII and secrets out of downstream tools. Native AI dictionaries and signatures classify streams automatically so the first policy is minutes, not weeks, away.
Overview
PortX is the data pipeline module of the XPLG AI Streams Platform: the intelligent control plane for operational, security and telemetry data streams, engineered for one million events per second per instance.
Collect once. Any source: syslog, Windows events, cloud audit trails, Kubernetes, Kafka, files, agents, OpenTelemetry. One collection layer replaces per-tool forwarders and duplicate agents.
Control in flight. Parse, filter, deduplicate, sample, aggregate and reduce; mask or tokenize PII, credentials and secrets; enrich with identity, asset, geo and threat context; transform to the schema each destination expects (CEF, UDM, OCSF, ECS, OTLP). Native AI dictionaries, signatures and stream models classify and tag data automatically.
Route what matters. Send security-relevant events to your SIEM, everything to cheap object storage, metrics to observability, and curated streams to XpoLog, LogX and Audity. Replay from the archive when an investigation needs it.
Outcomes: 30-70 percent lower SIEM and observability spend, zero-ETL migration between Splunk, Sentinel, Google SecOps, Elastic and data lakes, no vendor lock-in, and sensitive telemetry protected before it leaves your account.
Deployment: runs as the XPLG X8 container stack on this AMI; the same image runs on Kubernetes, VMs and on-prem. Single node to a 2-6 server cluster. Licensed per GB/day. Data stays in your AWS account; subscription on your AWS bill. Patches are pulled on every boot from AWS ECR Public.
Highlights
- Reduce, mask and transform telemetry in flight: collect once at one million events per second, drop noise, tokenize PII and secrets, enrich with identity and threat context, and convert to CEF, UDM, OCSF, ECS or OTLP before data reaches any tool. Cut SIEM and observability spend 30-70 percent.
- Zero-ETL migration and no lock-in: route the same stream to Splunk, Microsoft Sentinel, Google SecOps, Elastic, S3, Snowflake or OpenTelemetry backends in the shape each expects. Move between platforms by changing a route, not rewriting pipelines.
- AI streams intelligence built in: native dictionaries, signatures and stream models classify data automatically, so policies take minutes instead of weeks. Part of the XPLG AI Streams Platform; the same image runs on this AMI, Kubernetes, VMs and on-prem.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
AmazonLinux 4.14.133-113.112.amzn2.x86_64
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
m7i.2xlarge Recommended | $5.88 |
m6idn.xlarge | $2.63 |
m6i.2xlarge | $5.88 |
t3.2xlarge | $5.88 |
m5ad.xlarge | $2.63 |
t2.2xlarge | $5.88 |
m5d.4xlarge | $9.25 |
c7a.xlarge | $1.79 |
m6in.xlarge | $2.63 |
m5d.2xlarge | $5.88 |
Dimensions summary
You pay by the hour based on the EC2 instance type you run PortX on. Pricing is usage-based, so you are billed only for the hours the software runs. The many options map to AWS instance families and sizes, letting you match compute power to your data pipeline load. Larger sizes within a family (xlarge, 2xlarge, 4xlarge) give more capacity and carry a higher hourly rate. General-purpose (m-series, t-series) and compute-optimized (c-series) families are both available. You choose the instance that fits your throughput and performance needs.
Top-of-mind questions for buyers
You pay per hour for each running instance of the software on an EC2 host. One billable unit is one hour that a chosen instance runs. The instance type you pick sets the hourly rate. You run the software yourself on that EC2 compute.
Software charges meter running hours only. A fully stopped instance stops accruing the hourly software fee. Stopped instances may still incur separate AWS charges, such as storage for attached volumes. To stop software billing, stop the instance running PortX.
You move to a larger size within a family or a different family to add compute capacity. Nodes can also work together as a cluster to process more data. Each running instance bills its own hourly rate, so total cost rises with the instances you run.
www.xplg.com
Helpful?
Vendor refund policy
We do not currently support refunds, but you can cancel at any time.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
XPLG X8 8.2.0 - Release Notes (AWS Marketplace)
General XPLG X8 8.2.0 moves the AWS Marketplace listing to the X8 container platform: one image, five products, one license model and one workspace. The AMI runs the same xplg-service Compose stack used on Docker, Podman, Kubernetes and VMs, so a Marketplace node behaves exactly like any other X8 node - same roles (master, server, processor), same .env, same Traefik edge on 80/443, and the same path from a single node to a cluster of two to six servers. The instance pulls the current 8.2 patch on every boot, so patches reach you without a new AMI; only major versions require a new listing version. Console on :30304/logeye/ (or :80/:443 via Traefik); node data on the instance's local NVMe/SSD, shared configuration optionally on EFS.
Security updates The platform runs as a non-root service (uid 30303, gid 0) on Amazon Linux 2023 with OS security patches applied at build and at boot. No default credentials ship with the image: security is activated on first sign-in, and every instance generates its own identity. The host exposes only the role ports (30304-30308 HTTP, 30444-30448 HTTPS, 80/443 with Traefik, 514 for syslog sources) and no SSH keys or registry credentials are present in the AMI. Deployments register to your XPLG Dock workspace so licenses, usage and support tickets are tied to the node that produced them.
AI native 8.2 is the first X8 release with the AI layer built into the base image rather than added per product. Every workspace receives XMC (XPLG Model Credits) with its evaluation license, metered against the same usage view as GB/day and streams. LogX anomaly detection, Audity identity intelligence and the in-console assistant all draw on this layer, and the same credits follow the deployment from evaluation to production.
PortX is the data streams pipeline control plane for observability and security: collect, control, reduce, secure. In 8.2 it runs as a role in the X8 stack, so a single node can ingest, reduce and route to downstream SIEMs and observability backends while sharing configuration with the rest of the platform. Licensing is GB/day; the node reports consumption to your Dock workspace.
Additional details
Usage instructions
After deploying the instance, click on Manage in AWS Console to see the running instance and public DNS address to continue the configuration of the product. Connect to the Web UI via the public DNS address: http://{public-DNS -address}:30304 or http on port 80 or/and https://{machine-public-ip}.
Resources
Vendor resources
Support
Vendor support
XPLG provides support for this product to all AWS Marketplace subscribers.
Support portal and knowledge base: https://support.xplg.com Deployment, licensing and usage portal: https://dock.xplg.com/support Email: support@xplg.com Phone (USA): +1 888 482 4770 Phone (Israel): +972 3 656 5265
Standard support is included with every subscription: ticket response within one business day (Sunday to Friday, 08:00 to 18:00 Israel time), access to documentation, release notes and product updates. Deployment assistance for this AMI (network, ports, data volume, sources and destinations) is included during the first 30 days.
Premium and 24x7 support with defined SLAs, a named engineer and quarterly reviews are available through a private offer. Contact sales@xplg.com .
When opening a ticket, include the AMI version, instance type, the output of ./verify.sh and docker compose logs master.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
XPLG Flux - Ultra-Fast File and Binary Data Streaming to the Cloud
Secure, ultra-fast streaming of files, folders and large binary datasets into S3 and across clouds. 100x faster than SFTP.
LogX is the AI observability module of the XPLG AI Streams Platform. Instead of waiting for data to be indexed and then running rules over it, LogX scores the stream as it flows: Deep Text Inspection tokenizes every event, clusters machine signatures, learns normal behaviour per service and flags anomalies, new error patterns, rate shifts and correlated failures across services in real time. Native dictionaries and programmable signatures mean any team can read, validate and extend what the models look for. The result is service intelligence - which service is degrading, what changed, which upstream dependency is implicated - delivered as events, dashboards and alerts, and cuts mean time to resolution by up to 80 percent. New stream models ship continuously through the platform image, so detection improves without a redeploy.
XpoLog is the search, visualization and monitoring module of the XPLG AI Streams Platform. It indexes logs and telemetry from any source - applications, servers, network devices, cloud services, containers, databases - and gives teams augmented search with automatic parsing, pattern discovery and correlation across sources. Hundreds of ready apps ship dashboards and monitors for common technologies; alerts fire on rules, thresholds and anomalies. Because the stream is reduced, masked and enriched by the platform before indexing, XpoLog stores less and searches faster, which is how it delivers terabyte-scale log management at roughly half the cost of legacy tools. Deploy in hours on this AMI, grow to a cluster, and keep the same console on Kubernetes, VMs or on-prem.
Audity is the identity intelligence module of the XPLG AI Streams Platform. It consumes identity and activity streams - directory and IAM, SSO, cloud audit trails, SaaS, databases, applications, endpoints - and unifies them into one behavioral timeline per user, service account and device. Enrichment with MITRE ATT&CK, Sigma and UDM happens in the stream, and AI models score behaviour as it occurs: unusual access, privilege escalation, dormant accounts waking up, impossible travel, data movement outside pattern, identity drift between systems. Security teams get insider risk and account compromise in real time; GRC and audit teams get a queryable trail that answers who did what, where, when and with which rights, cutting audit and compliance preparation by 70-90 percent.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.