I’m deploying Suricata on networks for a few Canadian clients who need their data kept in Canada because of PIPEDA and provincial rules in BC and Quebec. The sensors sit on Canadian networks, but IDS data travels further than people expect. These are the things I’m checking:
- EVE JSON logs. They hold IP addresses, hostnames, HTTP details and sometimes file names, so I check where they’re stored and how long they’re kept.
- Packet capture. Full PCAP or conditional capture can include real customer content, so I keep it local, encrypted and on a short retention period.
- Log shipping. When logs go to Elasticsearch, OpenSearch or a SIEM, that backend has to live in a Canadian data centre too.
- File extraction. Extracted files can contain personal documents, so I limit which types are saved and where.
- Rule updates. Downloading rule sets is fine, but I check that no telemetry or alert data is sent back to outside services.
- Dashboards. Hosted dashboards and threat intel lookups can send IP addresses abroad, so I review each one.
- Backups. Configuration and any retained logs are backed up to encrypted Canadian storage.
What else would you check when IDS data has to stay inside one country?