How Bronto became a key part of Nitro’s security toolkit

Nitro operates a global document productivity platform serving over 3 million licensed users across 157 countries, including 67% of the Fortune 500. As they transition their PDF and workflow solutions from on-device applications to a comprehensive SaaS model, their distributed infrastructure generates massive log volumes across Azure cloud services, requiring robust logging for security monitoring and compliance with HIPAA, DORA, ISO 27001, and SOC2 requirements at enterprise scale.
‍

‍

How Bronto helped:

Nitro implemented Bronto as their unified security logging layer, moving away from costly Datadog retention and fragmented Azure storage. Their Azure integration streams MS Defender and Entra ID logs through Azure Event Hubs directly to Bronto, while a custom Azure Container Instance with Fluent Bit collects Cisco Meraki syslog events via dedicated EventHub and Azure Function App processing. Nitro is expanding adoption across their engineering organization while maintaining Datadog for specific APM tracing and incident management capabilities.

• Implementation: Rapid initial deployment with phased rollout across all enterprise log sources.
  ‍
• Team Adoption: Currently deployed for security and compliance workflows, with plans for broader engineering team adoption
  ‍
• Cost: Significant reduction in logging costs compared to extending Datadog retention
  ‍
• Retention: Expanded significantly, from as low as 3 days in some circumstances to 365+ days meeting HIPAA, DORA, ISO 27001, and SOC2 compliance requirements. Also opens up new use cases such as threat hunting across historical data, full incident forensics and timeline reconstruction
  ‍
• Long-term behavioral baseline analysis
  ‍
• Coverage: Comprehensive ingestion of MS Defender, Entra ID, and Cisco Meraki logs with centralized Azure Event Hubs integration
  ‍
• Performance: Improved search performance and interface responsiveness compared to Datadog for security analysis workflows