Data Lake

The Data Lake is structured into four layers:

• In the first three layers, logs are active and available for analysis, correlation, and enrichment in real time.

• The fourth layer is used for long-term retention, where events are archived and no longer actively processed, but remain accessible for compliance, audits, or historical investigations.

Each layer is equipped with auto-scaling capabilities, allowing the system to absorb event ingestion spikes from any client without impacting the indexing performance of others.

The Data Lake is designed to ensure that resources are always available for event indexing, maintaining performance and reliability even under high load conditions.