This topic provides instructions for Administrators on how to define and order retention rules for log storage collections on an Archiver.
Retention rules specify the type of logs to be stored in the collection. In order for your log collections to gather and store log data, you must associate them with at least one retention rule. When you configure a retention rule, you specify a condition and a collection for that rule. The condition (rule definition) determines the type of logs stored in that collection.
For the condition, you can use anything that works in a regular query where clause.
For example, to get logs from compliance services, you can use the following condition:
device.group='PCI Devices' || device.group='HIPPA Devices'
Rule and Query Guidelines provides additional examples.
After you define the retention rules for your collections, it is important that you specify the order of your retention rules. Security Analytics evaluates the retention rules for all of the collections in numerical order by the number listed in the Order column in the Retention Rule section of the Data Retention tab of the Archiver (Administration > Services Config view).
Before you configure your retention rules:
- Configure total hot, warm, and cold storage
- Configure log storage collections
Define a Retention Rule for a Collection
- In the Security Analytics menu, select Administration > Services.
- Select the Archiver service and > View > Config.
The Services Config view of Archiver is displayed.
- On the Data Retention tab, in the Retention Rule section, click .
The Rule Definition dialog is displayed.
- Configure the fields in the Rule Definition dialog as described in the following table:
- Click Save.
The retention rule that you define becomes associated with the collection you selected. On the Data Retention tab, in the Collections section, you can click > Select Rules in the Actions column for the selected collection to view the retention rules associated with the collection in the Retention Rule section.
Specify the Order of your Retention Rules
To prioritize the complete list of all of your retention rules:
- In the Retention Rule section of the Data Retention tab, select a retention rule and use drag and drop (or select Move Up and Move Down) to change its order in the priority list.
- Click Apply to save the order of the retention rules.
Add Archiver as a Data Source to Broker.