Maybe I'm wrong ... While you're using Vm ESM, you can't add or mount a SAN. In a phisical appliance, you can install " qLogic 2460 or 2562 SAN adapters on the ELM or ELS" (cf. installation Guide). Same case for DAS (for NAS, i don't know) . You can take a look a "install DAS" chapter into the Intallation guide.
For VM applicance, you can only add additional disk as VMDK. For this, you must shutdown your SIEm before ; then add your disk in sphere ; then power on your siem. Into the data storage tab from receiver properties, you will find a new "virtual local " tab where you will be able to format the disk before use it into storage pools tab.
On top of what @auguste suggested what you can also do is spin up a virtual Linux VM and create a NFS share and use the NFS share as a device storage in ELM for storing your raw logs (Just another option) but I would prefer to use the above method.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.