LEM has it's own self-contained database within the virtual appliance. It's optimized for the volume and features that we need for log data. While it operates self-contained, if you need longer term storage or archival ("just in case") you can archive the database to a CIFS share. It is still a proprietary format, so that we could directly re-attach to it (generally, after re-copying it to the appliance). You can't directly attach the primary database to any external storage today because of the low-latency requirements of accessing and storing this volume of data, but as technology and quality in the datacenter reliably changes, that could change.
A related tip, almost all customers run and schedule reports (daily, weekly depending on reporting requirements) to export effectively the same data that's in the database, just organized into functional areas (Authentication, Network, Security, etc).
