Blackfort Independent Log Vault
The Blackfort Independent Log Vault offers tamper-proof and independent storage of security-relevant log data outside of your own infrastructure.
Safety-critical systems transmit their log data to an external Blackfort platform in parallel with internal logging systems. This ensures that event data is fully preserved even in the event of a successful attack and can be used for incident response, forensic analysis, and regulatory documentation.
Why independent log storage is crucial
After a successful compromise, attackers often try to cover their tracks. To do this, they delete or manipulate log files to conceal their activities.
If log data is stored exclusively within the company's own infrastructure, compromised administrator rights or malware can destroy or alter this data.
The Blackfort Independent Log Vault creates an independent security instance outside the customer's environment. Log data is transferred in parallel to an external platform and stored there immutably. This ensures that the integrity of security-relevant event data is maintained even in the event of a security incident.
This provides companies with a reliable basis for:
Incident Response Analyses
digital forensics
Evidence to be provided to regulatory authorities
Security investigations following attacks
By independently archiving complete log data in the Blackfort Independent Log Vault, SIEM platforms can focus on security-relevant events.
This reduces the volume of data processed in the SIEM – a key cost factor for many SIEM solutions – without sacrificing complete forensic log histories.
Secure log sink for critical systems
The Independent Log Vault enables the secure recording and archiving of log data from a wide variety of systems within an IT infrastructure.
Typical log sources include:
Windows Event Logs
Linux Syslog
Firewalls and network devices
Endpoint Detection Systems
VPN Gateways
Identity Systems
Cloud Platform Logs
The log data is transferred to the Blackfort platform via secure transmission channels and stored there in a client-segregated and unalterable manner.
External storage ensures that security-relevant event data remains available at all times – even if internal systems have been compromised.
Scope of services
Initial setup
Setting up a secure log ingestion environment
Support in connecting relevant log sources
Configuration of encrypted log transmission
Log entry
Recording of log data via standardized protocols
Support for typical infrastructure and security logs
continuous monitoring of the log transmission
Tamper-proof storage
Unalterable storage of log data
client-separate log archiving
defined retention periods
Forensic access
Provision of log data for incident analysis
Structured export for investigations and audits
Support with forensic evaluations