- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
ConnectWise SIEM
You look after security for dozens of clients. Their alerts don’t stop at 6 p.m. — ConnectWise SIEM gives MSPs one multi-tenant SIEM across every client, in three tiers, with the ConnectWise 24/7 SOC watching alerts when your own team has gone home.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The ConnectWise platform family
This page covers ConnectWise SIEM — Essentials, Pro and Dedicated Tenant, with the optional ConnectWise SOC. The rest:
Quick facts
30-second orientation- Product
- Multi-tenant SIEM for MSPs, with an optional SOC
- Tiers
- SIEM Essentials, SIEM Pro, Dedicated Tenant
- SOC
- 24/7 ConnectWise SOC; “15-minute SLA” (vendor)
- Retention
- 30-day window on Essentials; 1–7 years on Pro
- Sources
- 22 named integrations plus 17 syslog feeds
- Pricing
- Per user, quote only — no figure published
- Analysts
- No Gartner, Forrester or IDC placement
- Lineage
- Perch Security and StratoZen, bought in 2020
- India
- No India storage region documented
- In India via
- TechBag — INR/GST, sizing and support
Understand MSP SIEMs before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is an MSP SIEM?
One SIEM for many clients — logs from every customer collected, correlated and searched in a single multi-tenant console.
A console per client and nobody on nights vs one MSP SIEM with a SOC — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A console per client, nobody on nights | ConnectWise SIEM |
|---|---|---|
| Who watches at night | Nobody, or an on-call phone | The ConnectWise SOC, 24/7, where you add it |
| Logs per client | A separate console per customer | One multi-tenant SIEM across every client |
| How it is priced | Per gigabyte, guessed each month | Per user, quoted once and packaged |
| Audit evidence | Screenshots pulled together by hand | Downloadable threat analysis reports on Pro |
| Getting it live | A months-long SIEM project | An agent pushed through the ConnectWise Platform |
| What it is NOT | — | Not self-hosted — no on-premises edition is sold |
The cheapest test is two clients for a month: connect Microsoft 365 and a firewall, turn on the SOC for one, and compare what reaches your desk.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Collection
An agent deployed through the ConnectWise Platform gathers endpoint events; API connectors pull Microsoft 365, SaaS and identity logs, and syslog takes firewalls.
SIEM
Logs from every client land in one multi-tenant SIEM for correlation, alerting and search. Dedicated Tenant instead segments storage, memory and compute per partner.
SOC
ConnectWise analysts triage and investigate around the clock under a 15-minute SLA in ConnectWise’s words. Included on Dedicated Tenant, optional on Essentials and Pro.
Platform
Since the July 2026 general release the SIEM sits on the ConnectWise Platform beside PSA, RMM and ScreenConnect, so security and service tools share one platform and one sign-in.
Agent, API and syslog feeds into one multi-tenant SIEM — with the ConnectWise SOC reading the alerts around the clock.
Nine capabilities. Collect, detect, respond.
ConnectWise SIEM lets an MSP watch every client’s security logs from one console, with a SOC behind it.
Deployed from the platform
Rollout is agent-based through the ConnectWise Platform, so an MSP already on ConnectWise RMM pushes collection without a separate project.
39 listed log sources
The integrations page names 22 products — SentinelOne, Defender, Duo, Meraki, Proofpoint among them — plus 17 syslog feeds for firewalls.
Thirty days to seven years
Essentials surfaces trends over a 30-day retention window; SIEM Pro lets you set retention anywhere from one to seven years per need.
Microsoft 365 identity threats
Even the entry tier carries identity threat detection and response for Microsoft 365, where most SMB account takeovers begin.
Endpoint protection in the tier
Essentials guards endpoints against ransomware and malware; Pro adds memory-based threat detection and behavioural attack prevention.
Event Search and threat views
Pro adds Event Search across collected logs and Enhanced Threat Views, which lay out attack timelines with prioritised threat context.
A 24/7 SOC on day one
ConnectWise analysts monitor, investigate and lead incident response around the clock, using threat intelligence from its CRU research team.
Self-directed threat hunting
Dedicated Tenant gives isolated infrastructure and adds self-directed hunting, for partners with their own analysts and heavy log volumes.
Threat reports for audits
Pro produces downloadable threat analysis reports an MSP can hand to a client for a security review, an audit or an incident write-up.
Watch ConnectWise SIEM in action
Investigating threats with Event Search in the modernised SIEM, how the new SIEM is set up, and ConnectWise’s security keynote on the ConnectWise Platform.
ConnectWise SIEM Modernized Threat Investigation & Event Search
Investigating threats in the new SIEM.
Product Office Hours: SIEM — SIEMplified and SIEMless
How the reworked SIEM is set up.
Unifying Cybersecurity & Efficiency with ConnectWise Platform
Security on the ConnectWise Platform.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most MSPs can’t staff a night shift. ConnectWise SIEM puts its SOC behind every client you choose.
Here’s what genuinely sets it apart — and exactly where it stops.
A SOC without hiring one
Most MSPs cannot staff analysts through the night. ConnectWise puts its own 24/7 SOC behind the SIEM — included on Dedicated Tenant, optional on Essentials and Pro, and selectable for all clients or just a few. ConnectWise describes its response commitment as an industry-first 15-minute SLA.
Built to be resold
Perch Security, which ConnectWise bought in November 2020, was pitched as an MSP-designed SIEM with multi-tenancy at its core, and the product keeps that shape. Pricing is per user rather than per gigabyte, so a partner can package it into a monthly security bundle without guessing log volumes.
Tiers that follow the client
Essentials covers endpoints and Microsoft 365 identity with a 30-day window. Pro adds Event Search, threat views, a wider integration library and one-to-seven-year retention. Dedicated Tenant isolates storage and compute and adds self-directed hunting for partners running their own analysts.
Where it stops
No price is published, and ConnectWise documents no India storage region — so CERT-In’s rule that ICT logs be kept in India for 180 days is not met by anything on paper. Essentials’ 30-day window is also far short of 180 days. And no analyst firm has placed it; review badges are all there is.
The numbers behind the platform
What your ConnectWise SIEM rollout looks like
Count users and pick a tier per client
List each client’s users, Microsoft 365 tenants and firewalls, then map small offices to Essentials and audited ones to Pro.
Settle retention and storage terms
Match retention to each client’s rules, ask ConnectWise where the logs will be stored, and get both answers in the contract.
Pilot on two clients
Push the agent through the ConnectWise Platform to two clients, connect Microsoft 365 and the firewall, and watch alert volume.
Switch on the SOC where it pays
Add the ConnectWise SOC for clients with no night cover, agree how escalations reach your desk, and test the SLA with a drill.
Package it and roll it out
Fold the per-user cost into a security bundle, onboard the remaining clients, and hand each one its first threat report.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We had no one watching logs after 8 p.m. Putting the ConnectWise SOC on our top twelve clients closed that gap in a week.”
“Per-user pricing let us fold the SIEM into our security bundle at a fixed monthly fee. Clients never see a log-volume surprise.”
“A lending client asked where its logs are stored. ConnectWise could not name an India region, so that account went elsewhere.”
“Essentials was fine for small offices, but its 30-day window was useless for audits. The manufacturing clients went to Pro.”
“Event Search in the new SIEM finally lets our level-two techs trace a sign-in across Microsoft 365 and the firewall in one query.”
“The Dedicated Tenant isolation mattered to our largest client’s auditors more than any feature. That alone justified the upgrade.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the MSP SIEM and managed SOC market — tap any vendor to see why it sits where it does.
TechBag MSP SIEM & SOC Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Three tiers; SOC with a vendor-stated 15-minute SLA.
MSP Fit × Log Depth
The grid nobody publishes — how well it suits an MSP running many clients vs how much log data it keeps and lets you search.
Multi-tenant; 1–7 year retention on Pro.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
ConnectWise SIEM vs the managed SIEM and MDR field
Against Huntress Managed SIEM, Arctic Wolf Aurora MDR, Barracuda Managed XDR, Sophos MDR and Microsoft Sentinel — on sources, price, retention, SOC, MSP fit and India.
| Dimension | ConnectWise SIEM | Huntress Managed SIEM | Arctic Wolf Aurora MDR | Barracuda Managed XDR | Sophos MDR | Microsoft Sentinel |
|---|---|---|---|---|---|---|
| What it is | MSP SIEM + optional SOC | SOC-run SIEM for MSPs | MDR service, not a SIEM | XDR as a service | MDR on your own stack | Cloud SIEM you operate |
| Deployment | Cloud; isolated tier | Cloud, Huntress agent | SaaS with sensors | Cloud on AWS and Azure | Sophos Central, cloud | Azure only |
| Data sources | 22 named + 17 syslog | Core MSP sources | 200+ integrations | 40+ data sources | 500+ integrations | Content hub connectors |
| Pricing model | Per user, quoted | Per source, pooled data | Contract, quoted | Build & Price, quoted | Quote only | Per GB ingested |
| Published entry price | Not published | $3.50/source/month | $44,000 a year | Not published | Not published | About $4.30 per GB |
| Included vs add-on | SOC optional below top | SOC included | Concierge included | SOC is the product | Tiers not named | No SOC included |
| Retention and limits | 30 days to 7 years | 1 year default, 7 max | Not published | Not published | Not published | 90 days included |
| Detection depth | Correlation + views | SOC-tuned detections | Agentic SOC + humans | MITRE-mapped rules | AI plus analysts | KQL analytics rules |
| Integrations | ConnectWise Platform | Huntress platform | Vendor-neutral feeds | Barracuda stack + others | Bring your own stack | Azure and Microsoft 365 |
| MSP multi-tenancy | Multi-tenant by design | Portal-level controls | Per-organisation deals | MSP programme | Partner dashboard | Lighthouse + GDAP |
| India storage region | None documented | US-hosted | No India listed | Mumbai listed | Mumbai DC; confirm MDR | Central India |
| SOC and support | 24/7, 15-minute SLA | 24/7 human-led SOC | 24/7 + concierge | Follow-the-sun SOC | 24/7 Sophos analysts | No SOC; Azure support |
| Lock-in and exit | Tied to the platform | 12-month terms | Fixed-term contracts | Terms not public | Keep your tools | Data in your tenant |
| Best fit | ConnectWise MSPs | Huntress-agent MSPs | Direct mid-market buyers | Logs must stay in India | Mixed-vendor estates | Microsoft-heavy SOCs |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose ConnectWise SIEM if…
- ✓You are an MSP already running ConnectWise PSA and RMM, and want the SIEM on the same platform
- ✓You need a 24/7 SOC behind client monitoring but cannot staff analysts through the night
- ✓You want per-user pricing you can fold into a fixed monthly security bundle
Compare alternatives if…
- ✓You want a published price before a sales call — Huntress prints a per-source rate
- ✓Clients need their logs stored in India — Barracuda Managed XDR lists Mumbai, Sentinel lists Central India
- ✓You have your own analysts and KQL skills — Microsoft Sentinel may cost less per client
Do not expect…
- ✓A published price or INR billing — every tier is quoted, and in US dollars
- ✓An India storage region — ConnectWise documents none for its cloud products
- ✓An analyst placement — no Gartner, Forrester or IDC report ranks it
ConnectWise SIEM is one of 35 siem & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What does watching client logs by hand cost you?
Drag the sliders (client users monitored; technician-hour cost). Estimates model technician time spent reviewing client logs and chasing alerts at an assumed 1.5 hours per monitored user a year, with 70% of it taken off your team by SOC triage and one multi-tenant console. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only: ConnectWise names the meter — per user — but publishes no figure for SIEM Essentials, SIEM Pro or Dedicated Tenant, and the 24/7 SOC is included only on Dedicated Tenant (optional on the other two). No INR price is published, and third-party price lists are not ConnectWise’s. TechBag sizes your clients’ users and retention first, then quotes in INR with GST.
SIEM Essentials
Best for small offices on Microsoft 365
- Per user, quote only
- Endpoint + Microsoft 365 identity cover
- 30-day retention window; SOC optional
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
SIEM Pro / Dedicated Tenant
Best for audited or high-volume clients
- Per user, quote only
- Event Search; 1–7 year retention
- Dedicated Tenant: isolated, SOC included
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which clients need only endpoint and Microsoft 365 cover (Essentials), and which need Event Search and long retention (Pro)?
Does any client need logs kept 180 days or longer? Essentials reports over 30 days; Pro goes from one to seven years.
Has ConnectWise stated in writing where each client’s logs are stored? No India region is documented for the SIEM.
Will you buy the ConnectWise SOC for every client or a few? It is included only on Dedicated Tenant.
What exactly starts and stops ConnectWise’s 15-minute SLA clock — first alert, triage or first contact with you?
Are your clients’ firewalls, EDR and SaaS apps among the 22 named integrations and 17 syslog feeds?
Does per-user pricing fit clients with many shared devices, and can the contract be invoiced in INR with GST?
Are you on ConnectWise RMM? The SIEM agent is deployed through the ConnectWise Platform, so rollout is simplest there.
Questions buyers ask
Ready to evaluate ConnectWise SIEM?
Count your clients' users and retention needs first, or let a TechBag advisor scope a two-client pilot with the ConnectWise SOC switched on.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.