In short: Todyl SIEM is a cloud-managed security information and event management service. It collects and correlates logs from Todyl's own agent and from Microsoft 365, identity providers and other tools, with prebuilt detections, case management, Janus natural-language search and compliance dashboards. It is licensed per device with retention tiers from 7 days to 5 years.
What Todyl SIEM is
A SIEM collects security logs from across your systems, stores them, and looks for patterns that point to an attack. Traditional SIEMs are expensive to run and need specialists to tune. Todyl SIEM (Todyl Managed Cloud SIEM) is cloud hosted, runs in a browser and is managed by Todyl, with no on-premises collectors or servers to maintain for the core service.
It brings together data from:
- the Todyl agent, covering SASE network traffic and Endpoint Security activity
- cloud work applications and identity providers, such as Microsoft 365 and Google Workspace
- other security tools, through native integrations
- custom or unusual sources through prebuilt syslog collectors over UDP and TCP
Todyl's detection engine correlates and adds context to those events, so one case shows the whole story rather than a stream of separate alerts.
What is included
| Capability | What it gives you |
|---|---|
| Prebuilt detection library | Detection rules that Todyl builds and continuously tunes |
| Correlation and context | Related events correlated and enriched, so they are investigated together |
| Case management | Alerts, event context and suggested remediation in one view |
| Janus SIEM Search & Analysis | Natural-language search and analysis across your logs |
| Dashboards and reports | Out-of-the-box security dashboards and customisable report templates |
| Compliance dashboards | Premade views for specific frameworks and audit trails |
| Multi-tenant architecture | Separate organisations kept in their own tenants within one console |
The SIEM is also the foundation for Todyl MXDR: the 24/7 team works from the same data and cases.
Retention tiers and how Todyl SIEM is licensed
Todyl SIEM is licensed per device, and the main choice is how long data is kept online:
| Retention tier | Typical use |
|---|---|
| 7 days | Short-term threat detection only |
| 30 days | Investigation window for most incidents (included in the Essentials package) |
| 90 days | Longer investigations and look-back (included in Advanced) |
| 1 year | Annual audit evidence (included in Complete) |
| 3 years | Longer regulatory or contractual retention |
| 5 years | Long-term record-keeping obligations |
Each tier carries a data allowance. Ingest above the allowance is billed per gigabyte at the rate for your tier, so we size the tier and estimate volumes before you commit. Billing is monthly in arrears on devices protected, with no annual contract. Ask us for a quote and we will model the right tier for your log sources.
Requirements and deployment
If you already run the Todyl agent, endpoint and network data flows into the SIEM straight away. We then connect Microsoft 365 or Google Workspace, your identity provider and any firewalls or applications you want covered, set up syslog collection for devices that cannot run an agent, and agree which alerts reach whom.
We help you choose retention against what you actually need to keep: UK GDPR expects you not to keep personal data longer than necessary, while contracts, insurers or sector rules may require longer log retention. Getting this right avoids paying for storage you do not need.
Who it suits and how we help
Todyl SIEM suits organisations that need central logging for an insurer, auditor or customer but do not want to build and staff a traditional SIEM, and those using other Todyl modules who want their data correlated in one place.
We scope your sources, set the tier, connect integrations, review cases with you and handle licence and retention changes on one invoice. Compare other options in EDR, XDR and MDR. See all vendors on our vendors A to Z, or go back to the Todyl overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How long does Todyl SIEM keep data?
Retention tiers run from 7 days, 30 days and 90 days to 1 year, 3 years and 5 years. You choose the tier, and we help match it to your audit, insurance and data protection needs.
Is Todyl SIEM charged per device or per gigabyte?
Both. The licence is per device for your retention tier, which includes a data allowance. Ingest above that allowance is billed per gigabyte.
Do I need on-premises servers for Todyl SIEM?
No. Todyl SIEM is cloud hosted and runs in a browser. Prebuilt syslog collectors are available for sources that cannot send data directly.
Is Todyl SIEM monitored 24/7?
The SIEM detects and raises cases. For round-the-clock monitoring and response, add Todyl MXDR, whose team works from the same SIEM data.