[INT] Alternative for Data Lake

[Brandon_Wertz]

---

@paIoaItonetworks wrote:

Are there any cheaper alternatives of Data Lake? Let's say, our retention is 6 months and we'd like to store incidents and all related information for 1-2 more years somewhere else. Has anyone used/using something like that, e.g. Amazon S3

---

I'm not 100% sure if they're the same.  You talk about CDL logs, then also INCs.  If it's just CDL log retention you can log forward out of CDL to a different destination.  I'm not sure about INCs though, I assume you mean something from XSOAR or XSIAM?  If it's either of these 2 platforms I'm not sure about the export ability from these consoles.

[BPry]

@paIoaItonetworks,

If you wanted to store incident details that's probably something better stored via capturing all of the incident details via the API and copying it elsewhere for longer retention. As an example you could utilize the  ExportIncidentsToCSV script that is readily available that you could utilize as a base and store the CSV of the incident elsewhere to allow for longer retention periods in a cheaper solution.

[paIoaItonetworks]

I'm talking about Cortex XDR, I didn't mention it, but there's a tag. The new requirement is to not export incidents, logs etc to the cloud because it'd be too expensive and also that place, where we'd like to store all data related to incidents should have search engine.