Data storage

Store and retain large amounts of long-term data using Trellix Enterprise Security Manager - Enterprise Log Manager ( Trellix ESM - ELM ) and search stored log data quickly using Trellix Enterprise Security Manager - Enterprise Log Search(ELS).

Long-term data retention

Trellix Enterprise Security Manager - Enterprise Log Manager enables you to store, manage, access, and report on large amounts of log data over long periods of time.

Organize Trellix Enterprise Security Manager - Enterprise Log Manager data into storage pools, each composed of storage devices. Associate retention times with each storage pool to retain the pool's data for a specific time. Government, industry, and corporate regulations require that logs be stored for different time periods.

You can set up search and integrity-check jobs on the Trellix ESM - ELM . Each job accesses stored logs and retrieves or checks data defined in the job. You can then view the results and export the information.

To configure Trellix ESM - ELM , you must know:

Data sources to associate with each Trellix ESM - ELM device.
Needed storage pools and their data retention times
Storage devices that are needed to store the data
Note
Storage pools require 10% of the allocated space for mirroring overhead.

Quick data search

Trellix Enterprise Security Manager - Enterprise Log Search (Trellix ESM - ELS) retains uncompressed log data for specific durations, speeding your ability to search the stored data quickly from the Trellix ESM dashboard.

To configure Trellix ESM - ELS, you must know:

Additional storage devices - Work with your team to determine the appropriate storage requirements for your environment, such as extra hard drives or network storage.
Retention policies to determine how long you want to retain specific uncompressed data. You can add up to six retention policies with durations in years (365 days), quarters (90 days), or months (30 days).
Data sources to associate with each Enterprise Log Search device.
Note
You can associate one data source with either an Enterprise Log Search or an Enterprise Log Manager but not with both.

Configuring data storage

To allow secure, encrypted communication with Trellix ESM, key the storage devices.
To connect both physical and virtual devices to Trellix ESM, configure the storage devices.
1. Set up data retention policies that identify how long to store log data on the Trellix ESM - ELS device.
2. Set up storage pools on the Trellix ESM - ELM device.
1. Assign receivers to specific retention policies.
2. Assign receivers to specific storage pools.
1. Quickly search stored log data using the Trellix ESM - ELS device.
2. Store large amounts of log data to the Trellix ESM - ELM device.

Storage device types

Device type	Details
NFS	To edit the remote mount point of the storage device with the Trellix ESM - ELM Management Database, use the Migrate DB option to move the database to a different storage device. You can then safely change the remote mount point field and move the database back to the updated storage device.
CIFS	Using the CIFS share type with Samba server versions later than 3.2 can result in data loss. When connecting to a CIFS share, don't use commas in your password.
iSCSI	When connecting to an iSCSI share, don't use commas in your password. Trying to attach multiple devices to one IQN can cause data loss and other configuration problems.
SAN	The SAN option is available only if there is a SAN card installed on Trellix ESM - ELM and there are SAN volumes available.
Virtual Local	This option is available only if a virtual local device has been added to the virtual Trellix ESM - ELM . You must format the device before using it for storage.