Configuring Cold Storage

You can store snapshot-based data from your data processor (DP) on another server (cold storage), so that you can analyze it later. You can import the stored data to your working DP or to a dedicated forensic DP. A dedicated forensic DP does not ingest data or perform ML. Contact your sales team about installing a dedicated forensic DP.

Cold Storage Requirements

To configure cold storage you must:

  1. Create a retention group with cold storage or edit a retention group to add cold storage times.

  2. Assign tenants to the retention group by editing the tenants.

  3. Configure an external cold storage location.

Configuring an External Cold Storage Location

To configure an external cold storage location:

  1. Click System | Data Processor | Data Management.

  2. Click the Snapshot Storage Configuration tab. The existing storage locations are displayed.

  3. Click .The Add External Storage screen appears.

  4. Enter the Name of the new location. The name must be lowercase and can include numerals, underscores (_), and dashes (-). This field does not support multibyte characters.

  5. Choose Cold Storage for the Mode.

  6. Choose the Type. You can choose NFS or S3.

  7. Enter the Directory and Host (for NFS) or Bucket (for S3).

  8. Enter the Host DNS or IP address (for NFS).

  9. Enter the Port (for NFS).

  10. Enter the Access Token and Secret Token (for S3).

  11. Choose the Forensic Target. If you choose Current Data Processor, Stellar Cyber reserves disk space on the system so you can analyze the forensic data. If you choose External Forensic Data Processor, disk space on this system is untouched. You can import from cold storage to your current DP or to a dedicated forensic DP regardless of which target you choose.

  12. Click Submit. Stellar Cyber verifies the connection (including previously verified locations). If verification fails, the storage location is considered unavailable.

When the verification is complete, you see the option to Create under Configure | Data Management: Snapshot Import.

Stellar Cyber is now ready to write data to cold storage. Data is stored as it exceeds the configured hot storage times.

You can analyze data in cold storage by importing it.