Every security tool sees only its own event: antivirus sees a file, the firewall a connection, the WAF a request. None of them knows what the others saw. An attack passes exactly between them.
A SIEM does not take their place — it builds one layer of observability, detection and record-keeping above them. A single query works across every source, because events are reduced to one model: a field of the same name means the same thing whatever the vendor.
So search, correlation rules, dashboards and reports are not tied to a source type. Adding a new vendor does not mean rewriting the rules.
| Stage | What happens |
|---|---|
| Ingest | Source verified, buffered to disk, duplicates and losses accounted for |
| Processing | Parsing, normalisation to the single model, categorisation, enrichment with context |
| Detection | Correlation rules, behavioural profiles, alerts raised |
| Presentation | Incidents, dashboards, reports and forwarding to external systems |
An event moves between tiers by age, by tier volume or by space used. Retention is set per source class; events that entered an incident follow their own policy.
| Profile | Hot | Warm | Cold-archive |
|---|---|---|---|
| Short · 30 days | 7 days | 23 days | — |
| Base · 90 days | 14 days | 76 days | per policy |
| Extended · 180 days | 30 days | 150 days | up to 365 days |
| Annual · 365 days | 30 days | 180 days | 185 days |
| Long · 1825 days | 30 days | 180 days | 1615 days |
The profiles are example configurations. Typical compression on text logs is 6–12×.
Functionality is identical across all four options — only image delivery and the scaling mechanism differ.
| Option | Delivery | Scaling |
|---|---|---|
| Physical | RPM / DEB packages, ISO image | Adding nodes and disk shelves |
| Virtualisation | OVA / QCOW2 / VHDX images | Changing VM resources, cloning |
| Private and public cloud | VM images, IaC templates | Scaling groups, object storage |
| Containers and hybrid | OCI images, Helm charts | Changing replica counts, StatefulSet |
For multi-site infrastructure a central-node / remote-site scheme applies: a Helix Collector at the site receives events locally, buffers them for 1–72 hours and forwards to the centre over TLS 1.2/1.3.
No. A SIEM is not a security control but a layer of observability and record-keeping above them. The controls do their job; the SIEM brings their events together, relates them and forms an incident.
The base distribution carries ready parsing rules for 600+ source types. For anything outside that list a decoder is written as configuration — product code is not changed and components are not rebuilt.
No. The agent is used on endpoints where it is needed; network equipment, security tools and cloud services are collected agentlessly — over Syslog, REST API, WMI, SNMP or the provider's API.
The source record is stored unmodified, a checksum is computed for each record and included in a block hash chain. Tampering or deletion is caught by scheduled background verification, and an integrity report can be produced for a period.
That depends on your event volume and retention period. Typical compression on text logs is 6–12×, and storage is split across three tiers — the expensive NVMe is only needed for hot. An exact figure follows once your stream has been measured.
We establish which sources, what volume and what retention you need — then give a precise proposal for components and storage.
