---
url: https://docs.realmsec.info/product/data_haven.md
---

# Realm Data Haven:

## Getting Started and Data Search/Resupply Guide

Welcome to Realm.Security Data Haven, the feature that provides secure, long-term archival storage and rapid data search/resupply capabilities for your organizational logs and security data.

What does Data Haven do? The Data Haven automatically stores and protects all data ingested into the Realm platform, ensuring data longevity and providing a mechanism for selective, point-in-time data search/resupply to your configured destinations.

## Access and Data Onboarding

### Accessing the Data Haven UI

* UI Location: Data Haven is available as a new tab on your Realm platform's global navigation bar.
  * \*![navigation haven](../images/nav%20to%20haven.png)

### Data Onboarding and Storage

* **Zero Configuration Onboarding:** There is no manual configuration necessary for directing data to the Data Haven archive. All data sources added to the Realm platform will automatically and securely route logs and events to the Data Haven archival storage.

## Configuring Resupply Destinations

Before you can resupply archived data, you must designate a Destination and an Output Feed as **resupply eligible**. This configuration prevents the resupplied data from mixing with your live, production data streams.

### Setting Up a Resupply Eligible Output Feed

1. Navigate to the Destinations Page to access the Output Feed configuration panel within the Realm platform.
2. Locate and enable the configuration option on the Output Feed to make the feed resupply eligible.
   * \*![outputfeed](../images/outputfeed%20haven.png)

We strongly recommend that users create a separate, dedicated Resupply Destination with a corresponding Resupply eligible output feed. This practice ensures absolute data separation at the destination, preventing the steady flow of production logs from mixing with archived, resupplied data sets.

## **Searching Data Haven**

Search shows you what is in your retained data before you resupply any of it. Instead of resupplying a wide time range and sorting through it afterward, you find the events you need first, see how many there are and when they occurred, and resupply only those. You can build a search two ways. Describe what you are looking for in natural language and Realm drafts the filters for you, or build the query by hand in three steps. Both fill in the same filters, and you can move between them at any point.

### **Opening Search**

Select Data Haven in the left navigation. Data Haven has two tabs, Search and Resupply. The Search tab opens by default.

### **What You Can Search**

Search works on observables, the normalized fields Realm attaches to each event as it is ingested.

* `username`
* `hash`
* `email address`
* `url string`
* `file path`
* `hostname`
* `ip address`
* `process name`

### **Building a Search by Hand**

Under Or Build It by Hand, set the three filters.

> 1. **Sources.** Select one or more sources from Add Source. Each selected source appears as a chip. Click the x on a chip to remove it.
> 2. **Time Range.** Select a relative range such as Last 7 days, or open the calendar to choose dates.
> 3. **Observables.** Add one or more conditions. Each condition has a Field (for example `observables.url\_string\[\]`), a Match type (for example String), an Operator (for example contains), and one or more Values. Type a value and press Enter to add it. Select Case-insensitive to match regardless of case. Click the trash icon to remove a condition.

To see every event from a source within a window, leave Observables empty. The results then show all events from the selected sources in that time range.
![data haven input](../images/datahaven_searchinput.png)

### **Searching in Natural Language (Beta)**

At the top of the Search page, type what you are looking for in the Ask in Natural Language box and click Query. Realm matches your request to Sources, Time Range, and Observables and fills in the filters below. Then run the search. You do not need to select a source first. Realm selects the sources that match the request.

### **Reading Results**

When a search runs, the results show Source Metrics and Events.\
**Source Metrics**

> * **Total events.** The number of events that match your search, with a count for each source. These cards can be used to filter the results.
> * **Histogram.** Matching events plotted over the selected time range, split by source. Use it to see the full volume of what you searched and when the activity happened, such as a spike overnight or a burst inside one hour of a week-long range. Switch between Events and Volume to view by event count or by data volume.

**Events**\
The events list shows matching events with their Timestamp, Source, and observable columns such as IP Address and Username. Click a row to expand the event, and switch between JSON and RAW to view it as structured JSON or as the original ingested raw log. If results are broader than you need, narrow the time range to where the histogram shows activity, or add a condition, and search again.

![mock haven view](../images/mock%20haven%20view.png)

## **Initiating a Direct-from-Search Resupply**

The Resupply workflow is completely unified with the Search experience. Once you have isolated the data you need using the Search tab, you can dispatch it immediately without waiting for preliminary data-gathering calculations.

1. **Run your search** to isolate the desired timeframe and observables.
2. Above the event timeline, click the **SEND RESUPPLY** button.
3. **Configure the Resupply:** A configuration panel will slide out. Review the pre-flight telemetry details to confirm your payload:
   * **Events:** Total number of matched events.
   * **Volume:** Estimated data size (e.g., 16.3KB).
   * **Date/time range:** The exact temporal boundaries of your query.
   * **Query conditions:** The specific syntax and sources being queried.
4. **Select Output Feed:** Click the dropdown menu and select the destination feed where you want to send this data.
5. Click **SEND RESUPPLY**.

![send resupply button](../images/searched%20resupply.png)

The delivery job will queue immediately in the background. You do not need to keep the window open; Realm will automatically send you an email notification once the data delivery is complete.

## **Tracking Resupply Jobs**

The **Resupply** tab serves as your operational audit log for all data delivery jobs. Use this tab to monitor active tasks, review historical deliveries, or cancel jobs.

* **Pending Jobs:** Displays jobs that are currently calculating or transmitting data. To stop an active job, locate it in the list and click **CANCEL**.
* **Completed Jobs:** Maintains a historical record of all successful and failed resupply tasks. Click on any row to open the **More Details** side drawer to view a complete audit trail, including the exact completion time, the requesting user, queried sources, and total data volume delivered.

*Data Haven is a subscription feature available through Realm. Please contact your sales representative for detailed information regarding licensing, retention options, and subscription tiers.*