ISO 27001

[oliverhavrila]

Dear,

I got a request from my business partner and I did not found any relevant information:

The system must retain the original logs for the purpose of security auditing and enable compliance with legislative standards and requirements, in particular by demonstrating the compliance of the offered system with the requirements of STN ISO/IEC 27001 for the provision of audit trails.

Does Security Onion meet this requirement? Thanks

[InfosecGoon]

Security Onion will retain original logs for components like Zeek and Suricata, with the caveat that they will be purged when disk space begins to fill up. If you need to retain them for a longer period, you can use something like the AWS CLI tool and a crontab to copy them up to S3 space and lifecycle into Glacier from there -- it's cheap and allows you to retain the data indefinitely.