Pattern DD-B

Log export and evidence retention

Syslog passes natively without middleware, and the chain of custody gets stronger as a side effect.

Request a quote Talk to an engineer

Area: Data diodes
Environments: 4
Products used: 4

How it is built

One-way path
Data path
Path that does not exist

Logs leave the monitored network. A compromised SOC is not a way back in.

Used in these environments

Log export to a SOCThe one flow where the diode is cheaper and simpler than the alternative — which is why it is almost always the right first installation.
Nuclear facilityThe regulator, not the operator, sets what has to be provable — and provability shapes the architecture.
Financial market dataMulticast passes natively, which is exactly the distribution model market data uses.
Evidence and forensic chainTransaction logs and per-transfer hash verification are what make the chain documentable.

How it works

Log sources write to a local collector inside the monitored network. The collector sends across the diode to the SIEM. Syslog over UDP passes natively — no middleware is needed, which is why this is almost always the right first diode installation.

The local collector is not optional

Letting every device send straight across the diode gives you no buffer when the link fails and no local way to detect a source that has gone quiet. The collector is where retention, sequencing and gap detection live.

What the pattern does not protect

The diode faithfully forwards tampered log entries too. An attacker inside the protected domain can write whatever they like to the log, and it reaches the SIEM looking exactly as trustworthy as everything else. The diode guarantees that the log cannot be deleted from the outside. It guarantees nothing about what was written on the inside.

Correlation across the boundary also needs both sides on the same time. NTP passes a diode inward, which means a diode in that direction — or a separate time source on each side.