Data Lake Integration Decommissioning: How to Preserve Data

Issue

The customer wants to decommission a Data Lake log source and wants to know what action to take (deactivate or remove) to ensure that previously ingested logs remain searchable for future investigations.

Environment

Red Canary Security Data Lake.

Resolution

• Deactivate the integration to stop the ingestion of new data.
• The existing data will remain in the Data Lake until the end of the retention period.
• Once the data has aged out, the integration can be permanently removed.
• Contact Red Canary support for any questions.

Cause

Keeping the integration as deactivated will ensure the data is still searchable.