Skip to content

Commit d64d0ca

Browse files
alexane-bougeardbebin-sekoiaalexane-bougeardbebin-sekoia
authored
Merge pull request #2972 from SEKOIA-IO/Exalog_GA
Exalog doc : Revise data storage and retention documentation
2 parents 369e0ee + cdbbf42 commit d64d0ca

4 files changed

Lines changed: 176 additions & 22 deletions

File tree

‎docs/xdr/FAQ/data_storage_retention.md‎

Lines changed: 65 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,86 @@
11
# Data storage and retention
22

3-
Sekoia.io uses a hybrid storage architecture to balance real-time detection performance with long-term compliance requirements. This system categorizes security events into two distinct tiers: Hot and Cold storage.
3+
Sekoia.io stores and indexes security events to support detection, investigation, and compliance. Two storage engines are available across Sekoia.io regions: **Hot/Cold storage** and **ExaLog**.
44

5-
## Hot storage
5+
## Region availability
66

7-
Hot storage contains your most recent events. This tier is mandatory for all Sekoia.io Defend plans and is optimized for immediate operational use.
7+
The storage engine available to your workspace depends on your region and provisioning date.
88

9-
* **Availability**: Events are immediately searchable for threat hunting and detection.
10-
* **Retention**: The default period is 30 days, extendable up to 365 days.
11-
* **Performance**: High-performance indexing for rapid querying.
9+
| Region | Storage engine | Notes |
10+
|--------|---------------|-------|
11+
| FRA1 | ExaLog | Workspaces created from May 2026 onward. Workspaces created before May 2026 are being migrated progressively. |
12+
| SGP1 | ExaLog | All workspaces. |
13+
| FRA2 | Hot/Cold storage | — |
14+
| EUR1 | Hot/Cold storage | — |
15+
| MCO1 | Hot/Cold storage | — |
16+
| UAE1 | Hot/Cold storage | — |
17+
| USA1 | Hot/Cold storage | — |
1218

13-
## Cold storage
19+
!!! tip "FRA1 workspaces created before May 2026"
20+
If your workspace is on FRA1 and was provisioned before May 2026, you can request migration to ExaLog. Migration gives you a unified retention window, direct search across all retained events, and no rehydration step for older data. Contact your Customer Success Manager or see [Migrate your workspace to ExaLog](/xdr/FAQ/migrate_workspace_to_exalog.md).
1421

15-
Cold storage (or "Archives") is an optional tier for older events. It provides a cost-effective way to store data for compliance without maintaining it in the active search index.
22+
!!! note "Rollout to additional regions"
23+
ExaLog is being rolled out to additional regions. When ExaLog becomes available in a new region, only events ingested after the activation date are indexed in ExaLog. Existing data is not migrated retroactively. Full capabilities become available progressively as your original retention window expires.
1624

17-
* **Availability**: Events are not immediately searchable. You must trigger a rehydration process to access this data.
18-
* **Retention**: Combined retention (Hot + Cold) typically ranges from 30 to 365 days.
19-
* **Resiliency**: Sekoia.io maintains the same level of data resiliency for both storage tiers.
25+
---
2026

21-
## View your storage capacity
27+
## Hot/Cold storage
2228

23-
You can verify the specific storage durations included in your subscription directly within the platform.
29+
Workspaces running Hot/Cold storage use a two-tier model that separates active, searchable events from archived data.
2430

25-
To view your current plan:
31+
### Hot storage
2632

27-
1. Navigate to **Settings > Subscription**.
28-
2. Locate the **Storage** section to see your allocated days for each tier.
33+
Hot storage contains your most recent events and is optimized for immediate operational use.
34+
35+
- **Availability**: Events are immediately searchable for threat hunting and detection.
36+
- **Retention**: The default period is 30 days, extendable up to 365 days.
37+
- **Performance**: High-performance indexing for rapid querying.
38+
39+
### Cold storage
40+
41+
Cold storage (also called "Archives") is an optional tier for older events. It provides a cost-effective way to retain data for compliance without keeping it in the active search index.
42+
43+
- **Availability**: Events are not immediately searchable. You must trigger a rehydration process to access archived data.
44+
- **Retention**: Combined retention (Hot + Cold) typically ranges from 30 to 365 days.
45+
- **Resiliency**: Sekoia.io maintains the same level of data resiliency for both storage tiers.
46+
47+
### View your storage capacity
48+
49+
You can verify the storage durations included in your subscription directly in the platform.
50+
51+
1. Navigate to **Settings > Subscription**.
52+
2. Locate the **Storage** section to see your allocated days for each tier.
2953

3054
![Navigation to Settings > Subscription to view hot and cold storage days](/assets/xdr/storage_subscription.png)
3155

56+
### Storage limitations
57+
58+
!!! warning "Permanent data deletion"
59+
Sekoia.io cannot retrieve data that exceeds your defined storage thresholds. If your total retention is 120 days, any data older than this limit is permanently deleted and cannot be recovered.
60+
61+
Retention periods are strictly governed by your contractual agreement.
62+
63+
---
64+
65+
## ExaLog
3266

67+
ExaLog is Sekoia.io's log storage and search engine for high-volume workloads. It provides a unified retention window with no distinction between hot and cold tiers. All events within your configured retention period are directly queryable from the **Events** page without any rehydration step.
3368

34-
## Storage limitations
69+
| Characteristic | Details |
70+
|---|---|
71+
| Retention | Configurable retention window; events linked to alerts or cases are preserved beyond the standard window |
72+
| Search | All events are searchable within the retention period without delay |
73+
| Encryption | Data is encrypted at rest; Sekoia.io manages the encryption keys |
74+
| Export | Large-volume exports to S3-compatible storage are supported (available June 2026) |
3575

36-
Retention periods are strictly governed by your contractual agreement.
76+
To learn more about ExaLog capabilities, see [ExaLog storage engine](/xdr/FAQ/exalog_storage_engine.md).
3777

38-
!!! warning "Data Permanence"
78+
---
3979

40-
Sekoia.io cannot retrieve data that exceeds your defined storage thresholds. For example, if your total retention is 120 days, any data older than this limit is permanently deleted and cannot be recovered by Support.
80+
## Related articles
4181

42-
## Next steps
43-
To learn how to access your archived events for a specific investigation, follow our guide to [restore data from cold storage](/xdr/FAQ/restore_data_cold_storage.md).
82+
- [ExaLog storage engine](/xdr/FAQ/exalog_storage_engine.md) — Learn about ExaLog's capabilities and how it differs from Hot/Cold storage.
83+
- [Migrate your workspace to ExaLog](/xdr/FAQ/migrate_workspace_to_exalog.md) — Step-by-step guide to checking your current storage model and requesting a migration to ExaLog.
84+
- [Restore data from cold storage](/xdr/FAQ/restore_data_cold_storage.md) — How to rehydrate archived events from cold storage.
85+
- [Events page](/xdr/features/investigate/events.md) — How to search and filter events in the Sekoia.io investigation interface.
86+
- [Understand massive event export](/xdr/features/investigate/event_export.md) — How to export large volumes of events to an external S3-compatible storage.

‎docs/xdr/FAQ/exalog_storage_engine.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# ExaLog storage engine
2+
3+
ExaLog is Sekoia.io's log storage and search engine, designed to give security analysts and MSSPs fast, scalable, and cost-efficient event querying across extended retention windows. All events within your configured retention window are directly queryable at any time from the **Events** page, SOL queries, and notebooks — without any intermediate step.
4+
5+
For information on which regions and workspaces use ExaLog, see [Data storage and retention](/xdr/FAQ/data_storage_retention.md).
6+
7+
## How ExaLog works
8+
9+
ExaLog provides a unified retention window: there is no distinction between recent and older events within the retention period. All data is indexed in a single layer and available for immediate search.
10+
11+
Events linked to alerts or cases are preserved in dedicated indexes beyond the standard retention window, ensuring that forensic data remains available for investigation even after the original retention period expires.
12+
13+
## Capabilities
14+
15+
### Event search
16+
17+
ExaLog handles all search queries initiated from the **Events** page, including searches scoped to events involved in alerts.
18+
19+
!!! tip "Get the most out of extended retention"
20+
Always specify a time range in your queries. Without one, a query targets your entire retention window, which can significantly slow down results.
21+
22+
### Retrohunt and anomaly detection
23+
24+
You can run retrohunt queries and anomaly detection jobs across the full configured retention window, enabling you to hunt for threats over extended historical datasets without being limited by shorter query horizons.
25+
26+
### Detection rules and correlation
27+
28+
Detection rules and correlation logic operate over the full ExaLog retention window, enabling rule-based detections to cover longer time ranges.
29+
30+
## Benefits
31+
32+
| Benefit | Description |
33+
|---|---|
34+
| Unified retention | All events within the retention window are immediately searchable with no rehydration required |
35+
| Extended retention for alert-related events | Events linked to alerts or cases are preserved beyond the standard retention window |
36+
| Search performance | Search performance is equivalent to or better than the Hot/Cold storage model |
37+
| Cost efficiency | The storage model reduces indexing and storage costs, enabling Sekoia.io to offer competitive retention pricing |
38+
| Encryption | Data is encrypted at rest; Sekoia.io manages the encryption keys |
39+
| Multi-region support | ExaLog is being rolled out to all deployment regions |
40+
41+
## Availability and migration
42+
43+
ExaLog reached general availability on FRA1 and SGP1 regions in May 2026. All new workspaces on these regions are provisioned on ExaLog. Existing FRA1 workspaces are migrated progressively.
44+
45+
For a full breakdown of availability by region, see [Data storage and retention](/xdr/FAQ/data_storage_retention.md).
46+
47+
To initiate or check the status of your workspace migration, contact your Customer Success Manager or follow the steps in [Migrate your workspace to ExaLog](/xdr/FAQ/migrate_workspace_to_exalog.md).
48+
49+
## Related articles
50+
51+
- [Data storage and retention](/xdr/FAQ/data_storage_retention.md) — Overview of both storage models and region availability.
52+
- [Migrate your workspace to ExaLog](/xdr/FAQ/migrate_workspace_to_exalog.md) — Step-by-step guide to checking your current storage model and requesting a migration.
53+
- [Events page](/xdr/features/investigate/events.md) — How to search and filter events in the Sekoia.io investigation interface.
54+
- [Understand massive event export](/xdr/features/investigate/event_export.md) — How to export large volumes of events to an external S3-compatible storage.
55+
- [Retrohunt](/xdr/features/detect/rules_catalog.md) — How to run retrohunt queries across historical event data to identify past threats.

‎docs/xdr/FAQ/migrate_workspace_to_exalog.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Migrate your workspace to ExaLog
2+
3+
This article explains how to check whether your workspace uses ExaLog and how to request a migration from the legacy Hot/Cold storage model.
4+
5+
ExaLog is Sekoia.io's next-generation storage engine. Migrating gives you access to a unified retention window, improved search performance, and extended retention for alert-related events without any rehydration step.
6+
7+
## Prerequisites
8+
9+
- Your workspace is on FRA1 region.
10+
- Your workspace was created before May 2026 (workspaces created from May 2026 onward on FRA 1 and SGP1 are already on ExaLog).
11+
- You have a Customer Success Manager assigned to your account.
12+
13+
## Check your current storage model
14+
15+
To verify which storage model your workspace uses:
16+
17+
1. Navigate to **Settings > Subscription**.
18+
2. Locate the **Storage** section.
19+
3. If you see separate **Hot storage** and **Cold storage** entries, your workspace uses the legacy model and is eligible for migration.
20+
21+
![Navigation to Settings > Subscription to view hot and cold storage days](/assets/xdr/storage_subscription.png)
22+
23+
## Request migration to ExaLog
24+
25+
!!! note "Migration timeline"
26+
Migration is performed by our teams. The timeline depends on your workspace size and region availability. Your Customer Success Manager will confirm the schedule before any action is taken.
27+
28+
1. Contact your Customer Success Manager directly or through the Sekoia.io support portal.
29+
2. Request migration of your workspace to ExaLog.
30+
3. Confirm the migration schedule with your Customer Success Manager.
31+
32+
Your Customer Success Manager will coordinate the migration and notify you when your workspace is ready.
33+
34+
## What to expect after migration
35+
36+
Once your workspace is migrated to ExaLog:
37+
38+
- All events within your configured retention window are immediately searchable from the **Events** page.
39+
- The rehydration process for archived events is no longer required.
40+
- Retrohunt queries and anomaly detection jobs operate across the full retention window.
41+
- Events linked to alerts or cases are preserved beyond the standard retention window.
42+
43+
!!! note "Historical data availability"
44+
Events ingested before the migration date become available in ExaLog progressively, as your original retention window transitions. Full ExaLog capabilities are available once the transition is complete.
45+
46+
## Related articles
47+
48+
- [ExaLog storage engine](/xdr/FAQ/exalog_storage_engine.md): Learn about ExaLog's capabilities, benefits, and how it differs from the legacy Hot/Cold model.
49+
- [Data storage and retention](/xdr/FAQ/data_storage_retention.md): Overview of both the legacy Hot/Cold model and ExaLog, with guidance on which applies to your workspace.
50+
- [Restore data from cold storage](/xdr/FAQ/restore_data_cold_storage.md): How to rehydrate archived events from cold storage on legacy workspaces.
51+
- [Events page](/xdr/features/investigate/events.md): How to search and filter events in the Sekoia.io investigation interface.

‎mkdocs.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,15 +220,20 @@ nav:
220220
- Use your own CTI in Sekoia.io: xdr/usecases/use_your_own_cti.md
221221
- Investigate overusage: xdr/usecases/playbook/investigate_overusage.md
222222
- Log volume reduction strategies: xdr/usecases/playbook/log_volume_reduction_strategies.md
223+
224+
223225
- FAQ and troubleshooting:
224226
- General: xdr/FAQ.md
225227
- Alerts: xdr/FAQ/Alerts_qa.md
226228
- Events:
227229
- Events FAQ: xdr/FAQ/get_events.md
228230
- Events QA: xdr/FAQ/Events_qa.md
229231
- Facing issues with logs collection: xdr/FAQ/Log_collection_Troubleshoot.md
232+
- Storage:
230233
- Data storage and retention: xdr/FAQ/data_storage_retention.md
231234
- Restore Data from cold storage: xdr/FAQ/restore_data_cold_storage.md
235+
- Understand Exalog storage engine: xdr/FAQ/exalog_storage_engine.md
236+
- Migrate to Exalog: xdr/FAQ/migrate_workspace_to_exalog.md
232237
- Intelligence:
233238
- Detection: xdr/FAQ/intelligence/Detection_qa.md
234239
- Questions about IoC revokation: xdr/FAQ/intelligence/revoke_ioc.md

0 commit comments

Comments
 (0)