Data ingestion volume
Catalog row in Vendor License Metrics · Cited
- Unit
- Gigabyte per day
- Aliases
- GB/day; data capacity; ingest
- Definition
- Falcon Next-Gen SIEM FAQ (2024-10-21): "Falcon Next-Gen SIEM’s licensing is based on data ingestion volume and the length of retention." The 10GB/day tier for Falcon Insight XDR customers is expressed per day of third-party data ingested.
- Counting rules
- Third-party data ingested per day counts against the licensed capacity; data from licensed Falcon modules (endpoint, identity, cloud and other Falcon telemetry) carries no additional ingestion charge. Under the 10GB/day tier, data above the daily limit is not ingested unless an extended subscription is held. Retention is a second licensing dimension: 7 days by default, extendable up to 36 months.
- Floors / minimums
- 10GB per day of third-party data at no additional cost for Falcon Insight XDR customers with a dedicated CID (7-day retention).
- Applies to products
- Falcon Next-Gen SIEM
- Related metrics
- Product category