| Description |
Implementation Concerns |
| Log Archival Process |
When restoration is required, is this happened in a bulk or can we add parameters i.e: like firewall, device, etc. |
| When in restoration, is this restored into the storage of live box? |
| What will be the impact of the processing of Live SIEM afterward / Performance impact? |
| When archiving is this comply with PCI-DSS. Is this RAW log or Normalized log? |
| The customer has requested to retain application logs for 31 days and the rest for 12 months. If the auditors request to generate a report for 4,5 devices for 12Months, how this can be achieved / estimated time for such request? |
| Endpoint Agent |
Is this only for endpoints like desktops, laptops or can we use this for servers? |
| If we can install this in an application server like IIS, is it enough to forward the logs for main SIEM ? |
| What are the log types collected by, these agents? |
| Are there any limitations on a collection of logs with this agent? |
| Is an agent forwarding logs to a collector or all in one node or both? |
| All in one feature concept SIEM(Ex. As SIEM like Supervisor, Worker, Collector ) |
Please explain the All in one concept |
| Collector device count limits |
Limitation number of device per collector, or based on EPS count |
| If the collector has a maximum EPS rate exceeds what is the method to continue the BAU |
The queue is being cleared after 3 days, what will happen to the logs for the in-between 2 days? Is SIEM being capable enough to flag the timelines and look up for a log in the sending device? |
| Need a better explanation about this procedure(Are there any queuing methods applied) |
| Any disaster situation loss of collector connectivity and after back to normal status. |
Need know how this can be achieved. |
| Lost of a device connectivity to SIEM and reconnection procedure |
If a devicelost its conection for 2,3 days and connected back, what is the mechanism of thisreconnection? |
| Saving location for logs |
What are the Log storing locations for Raw logs and normalised logs |
