The Zscaler MDR Security Data Lake is a managed data storage solution built for security practitioners. Ingest data from a wide range of security solutions, store your high-volume security logs as long as you want, and query/retrieve them when you need. Zscaler MDR will use data stored in the data lake for supplemental context for threat investigations.
Benefits
Meet long-term data retention compliance requirements with a more cost-effective solution than a SIEM.
Enjoy the scalability and flexibility to accommodate a wide and growing volume of data without needing to manage your data lake infrastructure.
Gain visibility into your security data and enrich investigations.
How does it work?
The Zscaler MDR Security Data Lake is an annual subscription product that can be purchased as an add-on for Zscaler MDR subscriptions. Once your license is activated, you will be able to access the Security Data Lake functionality from your Zscaler MDR portal.
To connect your external data sources to the Security Data Lake, you will need to configure some integrations. In general, each external data source will correspond to one integration in your Zscaler MDR portal. Refer to the Integrate Your Security Stack articles to learn more.
Once your integrations are activated in the Zscaler MDR portal, and your external data sources are configured to start forwarding logs to the Security Data Lake, the next step is to validate that data is flowing into the data lake. You can monitor your overall usage from the Usage page, search/retrieve any stored logs from the Export page, query and analyze your data from the Search page, or see how Zscaler MDR uses your data as context for threat investigations.
How long is “long-term” data retention?
You decide! For each integration you configure to send data to the Security Data Lake, you specify the retention period (in days).
Is my data protected from being overwritten or edited?
Yes. Internally, data is stored using technology and security policies that ensure that data can only be appended — never modified.
Is my data protected from loss due to a disaster?
Yes, we’ve taken precautions to protect your data — data is stored in a format with 99.999999999% (11 nines) of data durability, we have object lock policies to protect against accidental deletion, and we have versioning/backup policies that allow us to recover data up to 30 days after an incident.