Overview
Reduce the Cost of Log Retention
Avoid paying a premium for high volume security data storage.
Reduce SIEM costs
Pay a fraction of SIEM storage costs for high volume data sources like firewall, DNS, proxy and access logs.
Meet retention requirements
Prove to auditors that your data is retained and can be retrieved on-demand. If you need to export specific logs you can do so at any time.
Investigate stored data
Ensure visibility into your data for investigations, improving your security posture.
The Challenge
Security leaders face tough tradeoffs when managing security data. Storing too much in a SIEM means you’re overpaying on infrequently searched, low-value data, while managing a data lake adds infrastructure headaches. You need a solution that reduces overhead and keeps data accessible at all times.
Our Solution
Store raw data—JSON strings, syslog messages, anything that’s line delimited–for any length of time specified by you.
Use SQL to search based on specific attributes–IPs, hostnames, URLs, date/time ranges–and run basic statistical analyses to support internal investigations.
Zscaler MDR can leverage the Security Data Lake during our investigations, strengthening your detection and response coverage.
Dave Coughanour
Robert Williams
