Team: Huntress Managed Security Information and Event Management (SIEM)
Summary: This article explains the Managed SIEM page in the Security Insights Report, including log sources, data security activity, data usage, retention, and Smart Filtering.
In this Article
Overview
Log Sources and Billing
Data Security Activity
Top Organizations by Data Ingested
Data Usage
Data Storage and Retention
Smart Filtering
Related Articles
Overview
The Managed SIEM page, titled Data Monitoring through Managed SIEM, shows how Huntress turned your log data into security outcomes. It appears for accounts and organizations with Huntress Managed Security Information and Event Management (SIEM).
Account-level reports show every section in this article. Organization-level reports leave out the sections that compare organizations or describe your subscription. Those are enabled organizations, Top Organizations by Data Ingested, Data Usage, and Data Storage & Retention.
Log Sources and Billing
The top of the page shows the data sources sending logs to Managed SIEM and how billing applies to them. It has these sections:
- Log Sources: The number of data sources sending logs, and how many were added during the period. Select View all sources to see them in Huntress.
- Enabled organizations: On account-level reports, organizations with Managed SIEM enabled and organizations without it.
- Billable Sources: Billable and non-billable log sources. To be billable, a source must be associated with a SIEM-enabled organization, and it must have ingested data in the last 30 days.
Data Security Activity
Managed SIEM starts by filtering, so this section leads with it:
- Data Filtered Out: Data that Smart Filtering removed because it had no security value.
- Events Ingested Across All Your Sources: Log events Huntress analyzed after filtering.
- Investigations: Managed SIEM investigations the Huntress Security Operations Center (SOC) opened.
- Incidents: Incident reports created or enhanced by SIEM insights.
Top Organizations by Data Ingested
On account-level reports, this section lists the organizations that ingested the most data during the period. It helps you see where your data pool is going.
Data Usage
On account-level reports, this section shows your usage against your data pool. The data pool is the total data volume available for the full duration of your account's Managed SIEM subscription.
The section shows the percentage of the data pool you've used, which month of the subscription you're in (for example, Month 6 / 12), and the subscription dates. Your monthly usage can go up and down. You won't be charged extra as long as you don't exceed your overall data pool. If you go over, the percentage label notes that overages might apply.
Data Storage and Retention
On account-level reports, this section shows how many organizations use each retention tier:
| Tier | Hot storage | Cold storage |
|---|---|---|
| Standard | 30 days | 1 year |
| Extended | 90 days | 7 years |
Smart Filtering
Huntress Smart Filtering removes data that has no security value, which lowers cost and complexity. This section shows two amounts for the period:
- Filtered: The data Smart Filtering removed. Filtered data wasn't malicious. It had no security value, and Huntress doesn't keep it.
- Stored: The data Managed SIEM ingested and stored during the period, after filtering.
These are separate amounts, so either one can be larger than the other, especially for a single organization.
Related Articles
These articles cover Managed SIEM billing and the rest of the report: