Can I use Ingestion Filters to reduce Panther ingestion costs?

QUESTION

Can I use raw or normalized event filtering to reduce Panther ingestion costs?

ANSWER

Any raw log events dropped by an ingestion filter (both raw event filter and normalized event filter) will not contribute towards your ingestion quota.

This means:

• If you are a SaaS customer: no costs are incurred.

• If you are a Cloud Connected customer (meaning you host your own Panther infrastructure): you may incur partial costs due to the processing required to evaluate the filters, but you will not incur any detection processing costs or storage costs.