https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27523#M6 Hello,<BR /> <BR /> I have multiple devices configured to send logs to my server logs (SIEM) and I need to keep all these logs of my devices for 2 years, for query and reports futures.<BR /> <BR /> I have the following devices: routers, switches, firewalls, to send logs to my SIEM and I would like to know how I set SIEM to save to in your hard disk a structure as this:<BR /> <BR /> Can I create a Logs file per device?<BR /> Can I create a Logs file per group (Client1, Client2, ...)?<BR /> Can I create a Logs file per type device (All firewalls, All routers, ...)?<BR /> <BR /> What do you recommend me? <BR /> and how can I do?<BR /> <BR /> SIEM1<BR /> Inicio de sesion<BR /> Cerrar sesion<BR /> Logones fallidos<BR /> Updrages<BR /> ...<BR /> ..<BR /> .<BR /> Client1<BR /> Firewalls<BR /> PA1_IP<BR /> Inicio de sesion<BR /> Cerrar sesion<BR /> Logones fallidos<BR /> ...<BR /> ..<BR /> .<BR /> PA2_IP<BR /> Routers<BR /> RT1_IP<BR /> RT2_IP<BR /> Switchs<BR /> SW1_IP<BR /> sw2_IP<BR /> Windows Server_IP<BR /> Linux Server_IP<BR /> ...<BR /> ..<BR /> .<BR /> Client2<BR /> Client3<BR /> Client4<BR /> ...<BR /> ..<BR /> .<BR /> <BR /> Thank you very much<BR /> <BR /> Diego<BR /> Thu, 23 Jan 2014 22:47:00 GMT Diego5 2014-01-23T22:47:00Z https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27523#M6 Hello,<BR /> <BR /> I have multiple devices configured to send logs to my server logs (SIEM) and I need to keep all these logs of my devices for 2 years, for query and reports futures.<BR /> <BR /> I have the following devices: routers, switches, firewalls, to send logs to my SIEM and I would like to know how I set SIEM to save to in your hard disk a structure as this:<BR /> <BR /> Can I create a Logs file per device?<BR /> Can I create a Logs file per group (Client1, Client2, ...)?<BR /> Can I create a Logs file per type device (All firewalls, All routers, ...)?<BR /> <BR /> What do you recommend me? <BR /> and how can I do?<BR /> <BR /> SIEM1<BR /> Inicio de sesion<BR /> Cerrar sesion<BR /> Logones fallidos<BR /> Updrages<BR /> ...<BR /> ..<BR /> .<BR /> Client1<BR /> Firewalls<BR /> PA1_IP<BR /> Inicio de sesion<BR /> Cerrar sesion<BR /> Logones fallidos<BR /> ...<BR /> ..<BR /> .<BR /> PA2_IP<BR /> Routers<BR /> RT1_IP<BR /> RT2_IP<BR /> Switchs<BR /> SW1_IP<BR /> sw2_IP<BR /> Windows Server_IP<BR /> Linux Server_IP<BR /> ...<BR /> ..<BR /> .<BR /> Client2<BR /> Client3<BR /> Client4<BR /> ...<BR /> ..<BR /> .<BR /> <BR /> Thank you very much<BR /> <BR /> Diego<BR /> Thu, 23 Jan 2014 22:47:00 GMT https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27523#M6 Diego5 2014-01-23T22:47:00Z https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27524#M7 Hi Diego. I will have someone from GTAC reply to your question. If there is any additional data you could provide, it would be appreciated. Thank you! Mon, 27 Jan 2014 19:14:00 GMT https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27524#M7 Tamera_Rousseau 2014-01-27T19:14:00Z https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27525#M8 Hi Diego,<BR /> <BR /> Yes all the criteria you are asking for and more is available with the use of Event Retention Buckets. Please check our Admin Guide off the extranet for a complete set of options. <BR /> <BR /> <A href="https://extranet.enterasys.com/downloads/Pages/SIEM.aspx" target="_blank" rel="nofollow noreferrer noopener">https://extranet.enterasys.com/downloads/Pages/SIEM.aspx</A><BR /> <BR /> If you have any additional questions please don't hesitate to ask.<BR /> <BR /> Mon, 27 Jan 2014 20:10:00 GMT https://community.extremenetworks.com/t5/security/siem-dragon-event-retention/m-p/27525#M8 Dudley__Jeff 2014-01-27T20:10:00Z