Performance Considerations and Limitations

Compute

Each NetWitness Cloud SIEM instance is allocated dedicated cloud compute resources to enable effective utilization of the product.

  • Compute resource requirements are determined by rate of ingest corresponding to each Cloud SIEM subscription.
  • Certain user-driven behaviors such as utilization of the NetWitness Cloud SIEM product beyond the subscribed throughput license capacity may lead to performance degradation.
  • Certain non-traditional use cases that require high-levels of compute and/or memory resourcing and fall outside the scope of the NetWitness Cloud SIEM product may lead to performance degradation.

If performance degradation is suspected, customers should engage NetWitness Customer Support to determine options for remediation.

Storage

The base subscription offering for NetWitness Cloud SIEM includes adequate high-performance solid-state storage to enable retention of 90 days of log data at the license limit purchased. In addition to the primary allocation of high-performance storage included with each NetWitness Cloud SIEM subscription, customers may purchase storage add-ons enabling extended retention periods.

The NetWitness Cloud SIEM offering enables storage of log data to suit a variety of security and compliance use cases.

Storage allocations are dedicated to each NetWitness instance/tenant.

  • Storage is allocated as a fixed quantity determined by the daily rate of ingest for a Customer based on their throughput subscription.
  • Retention periods may vary based upon the actual rate of daily ingest, log sizing, log enrichment, or other practical variables.

Customers should monitor storage utilization to ensure achievement of their desired retention period. If retention periods are falling below Customers’ required retention periods they should contact NetWitness Customer Support to discuss options.

Data Ingress/Egress

There is no incremental cost for transporting data into the NetWitness Cloud SIEM offering, beyond the agreed subscription pricing. Each NetWitness Cloud SIEM instance is provisioned with a monthly data egress allowance of 2 TB/month to enable an effective product experience for most use-cases.

Data egressed or exported from Customer’s Netwitness Cloud SIEM but remains within the same Azure Availability Zone is exempt from limitations and additional costs.

Bulk data export is not included in the Customer’s data egress allowance. If additional data egress capacity is required for any circumstance, customers must engage a NetWitness Sales, Services, or Support representative to explore suitable options.

See also

Network Connectivity and Data Transfer