Base SIEM and SOAR capabilities

Includes the core capabilities for data ingestion, threat detection, investigation and response with 12 months hot data retention, full access to our 700+ parsers and 300+ SOAR integrations and 1 environment with remote agent.

The detection engine for this package supports up to 1,000 single-event and 75 multi-event rules. Choose a subset of Curated Detection rules.

Threat intelligence

Bring your own threat intelligence feeds.

Data pipeline management

Includes limited filtering and transformations.

Contact sales for pricing

Includes everything in the Enterprise package plus:

Base SIEM and SOAR capabilities

Expanded detection engine supporting up to 3,500 single-event rules and 200 multi-event rules.

Applied threat intelligence

Full access to Google Threat Intelligence (which includes Mandiant, VirusTotal, and Google threat intel) including intelligence gathered from active Mandiant incident response engagements.

On top of the unique sources, Applied Threat Intelligence provides turnkey prioritization of IoC matches with ML-base prioritization that factors in each customer's unique environment. We will also go beyond IoCs to include TTPs in understanding how an adversary behaves and operates.

Google curated detections

Additional access to emerging threat detections based on Mandiant's primary research and frontline threats seen in active incident response engagements.

Data pipeline management

Includes advanced filtering, redaction, transformations, and routing to Google. Additionally, 12 months of routing to another destination for SIEM migrations is included.

BigQuery UDM storage

Free storage for BigQuery exports for Google SecOps data up to your retention period (12 months by default).

Contact sales for pricing