--- title: "Axoflow architecture" url: "https://axoflow.com/docs/axoflow/0.86/architecture/" last_modified: "2026-09-14T15:48:25+02:00" --- > For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt). # Axoflow architecture [Axoflow Platform](https://axoflow.com/docs/axoflow/0.86/architecture/index.md) provides an end-to-end pipeline that automates the collection, management, and loading of your security data in a vendor-agnostic way. The following figure highlights the Axoflow data flow: ![Axoflow Platform Architecture](https://axoflow.com/docs/axoflow/0.86/architecture/axoflow_architecture_hu_1cd866815ae3d5da.webp) ## Control plane and data plane Axoflow is split into two halves: a control plane that you configure and monitor the pipeline from, and a data plane that carries your security data. Only the data plane ever touches the data itself. ### Control plane The management half of Axoflow: it configures the pipeline and describes what flows through it, but never carries your data. In practice, the control plane is [AxoConsole](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#console). It collects the metrics that the pipeline components report and draws them as a live topology, so what it holds is the *metadata* of each event: the source it originated from, the size in bytes (and event count over time), its destination, and any other element that *describes* the data. You also manage the pipeline from here. AxoConsole deploys the managed components, translates every [flow](https://axoflow.com/docs/axoflow/0.86/data-management/flow-overview/index.md) you configure into component-level configuration, and raises alerts on anomalies, so you never have to edit agent configuration files by hand. ### Data plane The collector agents, processing engines, and storage that carry and process your telemetry data, as opposed to the control plane that manages them. The data plane covers [AxoRouter](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#router), the [Axoflow agents](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#axoedge), and the [Axoflow Cloud Connectors](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#axoedge). These components collect, classify, filter, and transform your telemetry data, deliver it to its proper [destinations](https://axoflow.com/docs/axoflow/0.86/destinations/index.md) ([SIEMs](https://axoflow.com/docs/axoflow/0.86/destinations/index.md), storage), and report metrics to the control plane as they go. The storage your data lands in belongs on this side of the line too: [AxoStore](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#axostore) keeps data on the AxoRouter host, and [AxoLake](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#axolake) keeps it long term. You can manage data plane components from the AxoConsole, or run them independently of it. > **Note:** > Note that AxoRouter and Axoflow agent collects detailed, real-time metrics about the data-flows – giving you observability over the health of the security data pipeline and its components. Your security data remains in your self-managed cloud or in your on-prem instance where your sources, destinations, Axoflow agents, and AxoRouters are running, only metrics are forwarded to AxoConsole. ## Pipeline components A telemetry pipeline consists of the following high-level components: - *Data Sources*: [Data sources](https://axoflow.com/docs/axoflow/0.86/data-sources/index.md) are the endpoints of the pipeline that generate the logs and other telemetry data you want to collect. For example, firewalls and other appliances, Kubernetes clusters, application servers can all be data sources. Data sources send their data either directly to a *destination*, or to a *router*. Axoflow [provides several log collecting agents](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#axoedge) and solutions to collect data in different environments, including connectors for cloud services, Kubernetes clusters, Linux servers, and Windows servers. - *Routers*: Router (also called relays or aggregators) collect the data from a set of data sources and transport them to the destinations. [AxoRouter](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#router) can collect, curate, and enrich the data: it automatically identifies your log sources and fixes common errors in the incoming data. It also converts the data into a format that best suits the destination to optimize ingestion speed and data quality. - *Destinations*: Destinations are your SIEM and storage solutions where the telemetry pipeline delivers your security data. ![Axoflow as SaaS deployment](https://axoflow.com/docs/axoflow/0.86/img/platform-architecture-1_hu_bf0f513f92d4b6af.webp) Your telemetry pipeline can consist of managed and unmanaged components. Axoflow provides several managed Axoflow agent components that help you collect or fetch data from your various data sources, or act as routers. ## AxoConsole AxoConsole (formerly Axoflow Console) is the [control plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#control-plane) of Axoflow: the data visualization and management UI. Available both as a SaaS and an on-premises solution, including air-gapped and hybrid environments. AxoConsole collects and visualizes the metrics received from the pipeline components to provide insight into the details of your telemetry pipeline and the data it processes. It also allows you to: - [deploy managed components](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/index.md) (like Axoflow agent and AxoRouter), - [configure data routing and processing flows](https://axoflow.com/docs/axoflow/0.86/data-management/flow-overview/index.md) that the AxoConsole automatically translates into specific configuration and deploys to the managed pipeline components, and - troubleshoot your pipeline by [tapping real-time into the various data flows](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md) and agent logs. ![Security data pipeline topology on the AxoConsole](https://axoflow.com/docs/axoflow/0.86/img/topology/topology_hu_34be5e61926d6313.webp) ## AxoRouter AxoRouter is the main processing engine of the [data plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#data-plane): a router (aggregator) and data curation engine that collects all kinds of telemetry and security data and has all the low-level functions you would expect of log-forwarding agents and routers. AxoRouter can also curate and enrich the collected data, it: - [automatically identifies your log sources](https://axoflow.com/docs/axoflow/0.86/concepts/inventory/index.md), recognizing the product that’s sending it, for example, switches, firewalls, and web gateways - [fixes common errors in the incoming data](https://axoflow.com/docs/axoflow/0.86/concepts/automatic-data-processing/index.md): for example, it corrects missing hostnames, invalid timestamps, formatting errors, and so on - automatically parses the logs of hundreds of [COTS](https://axoflow.com/docs/axoflow/0.86/reference/glossary/index.md#term-cots) devices - performs [data reduction](https://axoflow.com/docs/axoflow/0.86/concepts/classify-reduce-security-data/index.md) and [normalization](https://axoflow.com/docs/axoflow/0.86/concepts/normalization/index.md) to reduce noise and improve data quality. Before sending your data to its destination, AxoRouter automatically converts the data into a format that best suits the destination to optimize ingestion speed and data quality. For example, when sending data to Splunk, setting the proper sourcetype and index is essential. ![Axoflow Platform Architecture](https://axoflow.com/docs/axoflow/0.86/architecture/axorouter-architecture_hu_de1d1479bb51d5ea.webp) ## Axolet Axolet connects the [data plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#data-plane) to the [control plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#control-plane). It’s a monitoring and management agent that integrates with the local log collector (like [AxoSyslog](https://axoflow.com/docs/axoflow/0.86/data-sources/connector-rules/index.md), Splunk Connect for Syslog, or syslog-ng) that runs on the data source and provides detailed metrics about the host and its data traffic to the AxoConsole. AxoRouter deployments automatically include Axolet. ## Storage solutions Storage sits in the [data plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#data-plane), alongside the components that route the data into it. In addition to being able to route your data to various storage and SIEM solutions, Axoflow provides a range of storage solutions for your use cases, from small, temporal storage to petabyte-scale long-term data retention. ![Storage architecture overview](https://axoflow.com/docs/axoflow/0.86/img/storage-overview_hu_67a07e026fd41583.webp) ### AxoStore AxoStore is a lightweight, queryable, temporary storage option that stores data locally on the AxoRouter host. AxoConsole provides federated search for every AxoRouter that has AxoStore deployed, so you can simultaneously run queries on every AxoStore. AxoStore is automatically available for all Axoflow customers, for each AxoRouter node, with 7 days retention, and up to 1TB of storage. For longer retention time or bigger storage, you need an extended AxoStore subscription. [Contact us](https://axoflow.com/contact?contact_form_subject=support_request) for the details. You can retrieve selected data from AxoStore and ([rehydrate](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md)) it to other destinations for further analysis as needed. For example, AxoStore allows you to: - Store debug-level logs for a short time (for example, 24h) to support “what if something happens” scenarios. - Collect and search data ad-hoc for maintenance or debugging tasks. - Keep a lightweight local backup of your security data. - Retrieve selected data from AxoStore and ([rehydrate](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md)) it to other destinations for further analysis as needed. ![AxoStore search](https://axoflow.com/docs/axoflow/0.86/architecture/storage-search_hu_dce2b00a8a613fa7.webp) For details, see [Storage](https://axoflow.com/docs/axoflow/0.86/storage/index.md). ### AxoLake AxoLake is a tiered SaaS security lake with a scalable hot tier for fast queries, and cost-efficient, S3-compatible cloud-based cold tier. You can use high-level, policy-based routing to decide which data goes to cold storage, hot storage, or your SIEM. If you need to work with data from cold storage, you can [rehydrate](https://axoflow.com/docs/axoflow/0.86/data-management/rehydration/index.md) it into hot storage, or even replay it to send it into your SIEM. Designed for long-term retention, open access, and integration with SIEMs and security analytics. AxoLake provides cheap, long-term archive storage, while making hot data available for detection and analytics. For details and pricing, see the [AxoLake product page](https://axoflow.com/axolake-petabyte-security-data-storage), or [contact us](https://axoflow.com/contact?contact_form_subject=storage). ![AxoLake](https://axoflow.com/docs/axoflow/0.86/architecture/axolake.svg) ## Axoflow agents and collectors Axoflow provides the following [data plane](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#data-plane) agents and collectors: - [AxoRouter](https://axoflow.com/docs/axoflow/0.86/architecture/index.md#router) is the main collector and data processing engine for push-based protocols, such as Syslog, OTLP, HTTP, and WEC. - Axoflow agent (AxoEdge) is a collection of managed agents for [Linux](https://axoflow.com/docs/axoflow/0.86/provisioning/linux-agent/index.md), [Kubernetes](https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/kubernetes/telemetry-controller/index.md), and [Microsoft Windows](https://axoflow.com/docs/axoflow/0.86/provisioning/windows-opentelemetry/index.md). They collect local data from the host they’re deployed on, send it to an AxoRouter instance, and provide metadata for AxoConsole. Axoflow agent provides file and journald collectors on Linux and Event log and Event trace collectors on Windows. - Axoflow Cloud Connectors are pull-based collectors built on top of OpenTelemetry that integrate with all modern Cloud Services (for example, AWS CloudWatch, Amazon S3, GCP Pub/Sub, Azure Event Hub), API and streaming sources (CrowdStrike, Kafka) and legacy methods (SQL) for enterprise log collection use cases. In addition to the [existing sources](https://axoflow.com/docs/axoflow/0.86/data-sources/index.md), Axoflow Cloud Connectors can consume events from a vast amount of HTTP or streaming APIs and can be extended by the Axoflow team to support any custom pull based HTTP or streaming API source. A few specific examples: | Receiver | Cloud source | | --- | --- | | `awscloudwatchreceiver` | AWS CloudWatch Logs | | `awsfirehosereceiver` | Kinesis Firehose | | `awss3receiver` | S3 log storage | | `awslambdareceiver` | Lambda telemetry | | `azureblobreceiver` | Azure Blob Storage | | `azureeventhubreceiver` | Azure Event Hub | | `cloudflarereceiver` | Cloudflare Logpush | | `cloudfoundryreceiver` | Cloud Foundry logs | | `googlecloudpubsubreceiver` | GCP Pub/Sub | | `kafkareceiver` | Kafka log streams | | `lokireceiver` | Loki / Promtail | | `fluentforwardreceiver` | Fluentd / Fluent Bit | | `syslogreceiver` | Syslog (cloud services) |