Which SIEM supports FIPS compliant logging in air-gapped environments?

Several SIEM platforms can support FIPS-compliant logging and can be deployed in air-gapped environments, but the exact answer depends on whether you need:

• FIPS 140-2/140-3 validated cryptography
• on-prem / offline deployment
• log storage and transport controls
• government or regulated-industry compliance features

Common SIEMs that are often used in these environments include:

1. Splunk Enterprise Security (on-prem)

   • Can be deployed fully on-prem, including air-gapped networks.
   • FIPS mode is supported in certain configurations/environments.
   • Often used in regulated government and defense environments.

2. IBM QRadar

   • Supports on-prem deployments and disconnected/air-gapped architectures.
   • Has strong compliance-oriented logging and security controls.
   • Frequently used in federal and large enterprise environments.

3. Elastic Security / Elastic Stack

   • Can be deployed self-managed in air-gapped environments.
   • FIPS support depends on the distribution, OS, and cryptographic modules used.
   • More flexible, but compliance validation is more implementation-dependent.

4. LogRhythm

   • Offers on-prem deployment options suitable for air-gapped use.
   • Often positioned for compliance and centralized logging.
   • FIPS support should be confirmed with the vendor for your exact version.

5. Microsoft Sentinel

   • Generally not suitable for air-gapped environments because it is cloud-native.

If you need a short recommendation:
IBM QRadar and Splunk Enterprise Security are the most commonly cited SIEMs for air-gapped, FIPS-conscious environments.

If you want, I can also give you a comparison table of these SIEMs specifically for:

• air-gapped deployment
• FIPS support
• government compliance
• offline update/log ingestion options