Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)
What this domain tests
You must be able to pick a delivery model, name the components that carry data from a source to the analytics engine, and reason about sizing, residency, and failure domains.
Delivery models
- New-Scale platform (cloud-native SaaS): multi-tenant, containerized microservices that Exabeam runs and patches. There are no customer-managed processors or indexers, and upgrades are continuous, so version drift is not an admin task.
- LogRhythm SIEM (self-hosted): the customer owns the stack - System Monitor Agents and Data Collectors feed a Data Processor, the Indexer stores data, the AI Engine evaluates alarm rules, and the Platform Manager holds configuration, with Web and Client consoles on top. You own patching, backup, HA and capacity.
- LogRhythm Cloud and hybrid: vendor-hosted or on-prem components feeding cloud analytics, useful when residency rules cover only part of the estate.
On-ramps and boundaries
- A Site Collector runs on-premises, listens for syslog (UDP/TCP 514, TLS 6514) and file sources, buffers locally during outages, and forwards outbound over 443. No inbound firewall holes are required.
- Cloud Connectors poll SaaS APIs on a schedule, so latency equals the polling interval rather than real time.
- LogRhythm agents are installed on endpoints and servers and ship Windows Event Log and file data into a Data Collector.
Sizing and resilience
Licensing is average GB/day ingested plus named users. Size collectors for peak EPS, not average, and place them close to sources so a WAN outage fills the local buffer instead of losing events.
Worked example
A bank must keep three years of raw logs on-premises but wants cloud behavior analytics. Design: a Site Collector receives firewall and proxy syslog locally; the LogRhythm Indexer retains the raw data for the retention period; the same feeds are forwarded to New-Scale for analytics; Cloud Connectors for the identity provider and mail platform supply identity context. Reasoning: residency is satisfied by the on-premises indexer, analytics scale comes from SaaS, and identity data is essential because network logs carry no username.
Traps
- Assuming cloud delivery removes the need to size collectors or watch buffering.
- Forgetting that connectors are poll-based, then blaming parsing for "missing logs".
- Designing for average EPS and dropping events at peak.
- Treating LogRhythm appliances and New-Scale services as one interchangeable component list.