Exabeam Site Collector for SaaSExabeam Site Collector

Exabeam Site Collector

Exabeam SaaS Cloud uses site collectors to enable you to upload log data from your data centers or VPCs to Exabeam. Site collectors in the Exabeam SaaS Cloud were designed to support most data centers with a single Site Collector.

You can configure more than one site collector for your deployment. For example, if you need to collect logs from multiple data centers or VPCs and upload them to Exabeam.

Note

When cloud collector agents are in use, data does not flow through a site collector.

Important

Exabeam's non-Saas site collectors will no longer be supported as of September 1, 2020. Please migrate your site collectors to the Exabeam SaaS Site Collector before the deadline.

Site Collector Architecture

At a high level, Exabeam's site collector involves three main processes:

  • Message collection

  • Data persistence and upload

  • Cloud connectivity

Site Collector for SaaS.jpg

First, Exabeam collects messages from external servers, systems, data centers, and other machines via syslog and/or Exabeam collectors (including Windows, File, and GZip).

Note

For more information on configuring agent-based or server-side collectors, please refer to the Exabeam Collector Guide.

Then, the site collector queues the messages on disk before uploading to Exabeam SaaS Cloud. The site collector continuously upload messages from the queue to Exabeam SaaS Cloud. Data is encrypted in transit to the cloud and at rest (in the cloud). Data is compressed to 300-500% of the original source before uploading to Exabeam SaaS Cloud.

Finally, the cloud connectivity feature maintains a healthy connection to Exabeam SaaS Cloud to allow it to connect to customer assets such as AD for context and authentication, access API for log repositories, and any other Incident Responder actions.

The site collector includes the following:

  • Kafka for message bus

  • Logstash for message processing

  • OpenVPN for client connectivity

  • Zookeeper for Kafka management

Site Collector Specifications

The Exabeam SaaS Site Collector can be deployed in two capacities, Essential and Enterprise. Please review the specifications in the table below that applies to

EPS

Minimum CPU and Memory

Agent Collectors

5k

4 CPU, 8 GB RAM

100

20k

8 CPU, 16 GB RAM

200

30k

16 CPU, 32 GB RAM

500

Additionally, please ensure the following storage requirements and permissions are met:

  • CentOS 7.x+/RedHat 7.x+

  • /tmp must be a writeable location and allow for execution

  • /data is storage for Kafka data (sizing is based on the Site Collector Specifications above) with 300 GB or higher per EPS

  • Default local retention is 24 hours or available disk space in /data allocation

Storage

Essential

(Up to 5k EPS)

Enterprise

(10k+ EPS)

/ (including /tmp)

50 GB

100 GB

/opt

50 GB

100 GB

/var/logs

50 GB

50 GB

/data

200 GB

500 GB

Table 1. Essential and Enterprise Type Site Collector - Minimum storage allocation


The following table is a guide for the Essential type SaaS Collector. It is based on calculations for:

  • 1500 bytes average message size

  • 1.5 times of rated EPS per day to be stored locally

  • EPS rated for Essential Tiny, Small, Medium, and Large are 1k, 2k, 3.5k, 5k EPS respectively

Retention Days

Essential Tiny

(GB)

Essential Small

(GB)

Essential Medium

(GB)

Essential Large

(GB)

1

400

600

900

1200

2

600

1000

1600

2200

3

800

1400

2300

3200

5

1200

2200

3700

5200

7

1600

3000

5100

7200

10

2200

4200

7200

10200

30

6200

12200

21200

30200

Table 2. Essential Type Site Collector - Storage Capacities by Retention


Important

Capacity specifications for Exabeam Enterprise site collectors are not shown and are calculated based on required retention and EPS rates.

Note

OS partition cannot be smaller than 100GB.

Here are some deployment examples based on log ingestion rates:

Collector Type

CPU, Memory, and Storage

Essential Medium, 2.5k EPS

4 CPU, 8 GB RAM, 900 GB

Enterprise, 18k EPS

8 CPU, 16 GB RAM, 3800 GB

Enterprise, 108k EPS

4 site collectors with 16 CPU, 32 GB RAM, 6200 GB each

or

6 site collectors with 8 CPU, 16 GB RAM, 4200 GB each

Table 3. Specification Examples


Required Services

Please ensure firewalld is installed and present on the system.

Note

The firewalld service automatically installs if it is not already present on the system.