Key Concepts
HyperCollector Summary
The HyperSec HyperCollector performs the following key functions:
- Provides a reliable and standardised collection point for both log and contextual data.
- Stores, caches and improves data quality of this data at the edge to reduce costs, improve speed and increase resilience.
- Is deployed as a CIS Ubuntu Linux 22.04 LTS Benchmark v1.0.0 hardened appliance https://www.cisecurity.org/cis-benchmarks as-designed to be deployed into an "assumed compromised" environment. https://www.tenable.com/audits/CIS_Ubuntu_22.04_LTS_v1.0.0_Server_L2
- Output into open data standards form aligned to source data schemas (JSON) without proprietary lock-in.
- Support a range of the most prevalent cyber data sources, both open source and proprietary, with supporting deployment and automation.
- Provide Discovery capability and the collection of other Contextual data sources in addition to log data.
Specificity and Opinionated
Specificity centres around the 80/20 data source concept. The HyperSec HyperCollector has significant infrastructure integration and automation built around the most common 80% of log sources by volume and usage, for example Windows and Linux. These are opinionated deployments, useful, effective and high value out of the box.
https://www.baeldung.com/cs/opinionated-software-design
These sources are further enhanced to improve data quality through the HyperCollector.
Tagging
Tagging of data is an important key concept. The HyperCollector can receive data "as it is sent" using default mechanisms and ports (e.g. raw syslog/UDP/514). However, this introduces issues with data quality and data routing for downstream systems such as HyperSec XDR or a SIEM.
The tagging of data as it is received mitigates this issue. Tagging allows easy and reliable separation of data by downstream systems as well as local storage, if required.
Example: Syslog Tagging
Deployment Types
There are three main deployment types for a HyperCollector
- Virtual Machine
- Small appliance (NUC sized)
- Rack deployment
The deployment of each is functionally identical, only the form factor, installation techniques and control of the underlying hardware vary.