In short: Cynet SIEM is the log management and SIEM capability built into the Cynet platform. It collects endpoint, network, firewall, identity, email and SaaS logs, supports search and forensic queries, raises correlated XDR alerts and retains data for audits. It is an add-on to Cynet Protect and Elite and is included in All-in-One.
What Cynet SIEM is
Cynet SIEM brings security information and event management into the same console as the Cynet platform. Rather than standing up a separate SIEM, shipping logs to it and writing correlation rules from scratch, you collect logs alongside the telemetry Cynet already gathers from endpoints, email and cloud services.
It is designed for organisations that need a SIEM for compliance, investigations or insurance, but do not have analysts to run a traditional one. Logs from firewalls, identity systems, applications and SaaS platforms sit next to Cynet's own endpoint, network and email data, so an investigation can follow an attacker from a phishing email to a sign-in to a device without switching tools.
SIEM and SIEM Analytics
Cynet describes two parts to its SIEM offering:
| SIEM Analytics | SIEM | |
|---|---|---|
| What it is | Log collection, hunting, forensic search and retention (formerly centralised log management, or CLM) | An AI-driven detection and compliance layer |
| Custom log queries, forensic search and visualisation | Yes | Yes |
| Firewall, application, SaaS and identity logs correlated with Cynet telemetry | No | Yes |
| Custom XDR rules raised as correlated alerts | No | Yes |
| Pre-built queries and reports for audits and cyber insurance reviews | No | Yes |
Cynet states that hot, readily searchable data is kept for 90 days, and that cold data can be retained for up to seven years for regulated sectors. Our catalogue lists the add-on as Cynet SIEM Essentials; we confirm exactly what it includes, and any longer retention option, before you order.
How Cynet SIEM is licensed
Cynet SIEM is priced against the number of endpoints in your Cynet estate, in bands, rather than by the volume of data you ingest. That makes the cost easier to plan than with SIEMs charged on gigabytes per day.
| Package | SIEM | SIEM Analytics |
|---|---|---|
| Protect | Add-on | Add-on |
| Elite | Add-on | Add-on |
| All-in-One | Included | Included |
If you are on Elite and need SIEM, email security and ITDR, it is often worth comparing the cost of the add-ons with moving to All-in-One, which includes them. Ask us for a quote and we will lay both options out.
Requirements and use cases
Cynet SIEM runs inside the Cynet cloud console, so there is no separate server to build. You need a Cynet package, and log sources that can forward their logs, such as firewalls, identity providers, servers and SaaS applications. Cynet's own endpoint, email and cloud telemetry is collected automatically.
Typical reasons UK organisations add it:
- Audit and compliance evidence: pre-built queries and reports for audits and cyber insurance reviews, which also help with supply-chain questionnaires
- Investigations: forensic search across every log source, looking for signs such as large file transfers or mass file changes
- Fewer false positives: correlated XDR alerts instead of single noisy events
- Longer retention: keeping logs for the period your sector or contracts demand
- Supporting CyOps: on Elite and All-in-One, CyOps MDR analysts can see the same logs when investigating
How Forever Systems helps
We help you work out which log sources matter, whether SIEM Analytics or full SIEM fits, and how long you need to retain data. We supply the add-on or the All-in-One package on your Forever Systems account, help connect your firewalls and identity systems, and make sure useful reports are set up for audits.
If you already run another SIEM, we can help you assess whether Cynet can replace it or sit alongside it. For other options see EDR, XDR and MDR and our vendors A to Z.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cynet SIEM included in Cynet All-in-One?
Yes. Both SIEM and SIEM Analytics are included in the All-in-One package. On Protect and Elite they are add-ons.
How long does Cynet SIEM keep logs?
Cynet states that 90 days of hot, searchable data are kept, with cold data retained for up to seven years for regulated industries. We confirm the retention options when we quote.
What is the difference between Cynet SIEM and CLM?
CLM, Cynet's centralised log management, is now called SIEM Analytics. Cynet SIEM adds correlation of firewall, application, SaaS and identity logs, custom XDR alert rules and pre-built audit and insurance reporting.
Is Cynet SIEM priced by data volume?
No. It is priced against the number of endpoints in your Cynet estate rather than the volume of logs ingested, which keeps the cost predictable.