Deployment options
Where does each product run, and what does it need?
On-premises deployment for every product
The products can run on customer-controlled infrastructure, with a shared console for SIEM, DLP and SOAR. Hosting, data flows and daily operating responsibilities are agreed around the work the team needs to do.
Where each product runs
ARRTECH SIEM runs on the organization’s own Linux servers, with load balancing and failover across them. It scales out as servers are added.
DLP endpoint and gateway options protect different channels. The deployment identifies supported devices, applications and inspection paths so coverage can grow around the organization’s workflows.
ARRTECH SOAR runs on one server or several. Each SOAR playbook can be tested on sample data and switched on when the team is ready.
Available now to select organizations. Detection runs on customer-controlled CPU hardware sized for the workload and reads an approved export from ARRTECH SIEM or a supported third-party SIEM.
The management agent goes on first. It then installs, updates and configures every other agent.
Cyberdroid AI Investigation, in early access, runs its models on the organization’s own hardware, and the team sets any online fallback. It investigates an AI Detection finding or a SIEM alert and writes the case.
Licensing, sizing and operations
What an architecture review asks once the servers are settled.
Licensing
ARRTECH SIEM is licensed on daily data volume or events per second, with unlimited sources and agents.
Sizing
Sizing is agreed per deployment, and a proof of value measures what Detection uses on real telemetry before any commitment.
Storage
Plan storage around log volume, retention and measured compression. Test retrieval of older records as well as routine searches, and define backup and recovery responsibilities.
Console
One web console manages SIEM, DLP and SOAR in many languages, with sign-in through Active Directory or LDAP.
Agents
Agents run on common server and desktop operating systems.
Offline
The suite runs on premises, including at disconnected sites. SIEM agents hold logs through an outage and forward them when the link returns.
