Subscription Management and Options

Subscription Options

NetWitness Cloud SIEM is metered based on the amount of log data throughput ingested daily, measured in gigabytes (GB) per day. The throughput-based subscription measures data ingest against a subscription entitlement and can always be increased to a higher rate to account for any increase in the amount of data being collected.

Customers may evaluate current and past daily data ingestion information on the licensing page within the NetWitness Cloud SIEM user interface.

  • Base Cloud SIEM Offering: Measured by GB/Day of data ingested (starting at a minimum of 50 GB/Day) including sufficient storage for 90 days of data retention

The Storage add-ons presently available across all supported regions are as follows:

  • 90-Day Hot Storage Add-On: The 90-Day Hot Storage Add-On extends the base 90-day retention period using high-performance premium solid-state storage. This yields a total retention period objective of 180 days.
  • 365-Day Warm Storage Add-On: The 365-Day Warm Storage Add-On provides 365 days of retention using spinning disk (HDD) storage. The first 90-days of this storage will overlap with the premium solid-state storage in the Base Offering. This Add-On utilizes the NetWitness Archiver capability to provide an economical solution for long-term log retention primary for compliance-driven use cases. This is not a suitable add-on for rapid queries or threat detection and investigation.

Subscription Expansion

Customers interested in growing their utilization of the NetWitness Cloud SIEM offering may pursue expansion of their relationship at any point during the subscription term. Expansions can coincide with the remainder of the subscription term, be applied for a limited duration, or for a single instance. Expansion of the NetWitness Cloud SIEM offering may be pursued via the purchase of:

  • Additional daily ingest capacity
  • Storage add-ons for extended retention
  • Additional data egress capacity

Subscription Renewals

NetWitness Cloud SIEM customers will receive a renewal notification within 90 days of subscription expiration.

  • Customers are encouraged to pursue information regarding renewals at any point during their subscription term to confirm pricing, commercial requirements, or new releases of NetWitness product or service offerings. Confirmation of an intent to renew is recommended within 30 days of subscription expiration to ensure service continuity.

Contact your NetWitness Account Manager at any point during your subscription period with questions regarding renewal policies or processes.

Subscription Termination

On the date of Subscription Expiration, all functionality of the NetWitness Cloud SIEM product is suspended. The Cloud SIEM product will cease standard operational functionality including ingestion of log data upon subscription expiration.

Contact your NetWitness Account Representative if access to the Cloud SIEM service is required beyond the date of expiration.

After expiration, an image of the NetWitness Cloud SIEM product configuration and data will be retained for 30 days to enable reinstatement of the service. Log data will be retained for 30 days following expiration to support download or migration to another data-store as needed.

  • In the event of Subscription Termination and a requirement for Data Egress, data egress charges may apply for bulk data migration.

The NetWitness Cloud SIEM dedicated instance, configurations, and log data are fully destroyed following 30 days of subscription expiration using industry standard best practices for data destruction.

See also