Can I view the volume of log data ingested into Panther (over a time period)?

QUESTION

How can I check how much data has been ingested by Panther over a specific time span?

ANSWER

To do this, you can leverage our metrics API endpoint. This endpoint conveys information about alerts, ingestion, and detections. The following examples demonstrate getting data about log ingestion via our API.

Example 1: Total Amount Ingested

query getIngest {
  metrics(input: {
    fromDate: "2023-11-01T00:00:00Z",
    toDate: "2023-11-30T23:59:59Z"
  }) {
    totalBytesProcessed
  }
}

Example 2: Ingestion Breakdown by Log Type

query getIngest {
  metrics(input: {
    fromDate: "2023-11-01T00:00:00Z",
    toDate: "2023-11-30T23:59:59Z"
  }) {
    bytesProcessedPerSource {
      label
      value
    }
  }
}