How do I find out my current usage within Panther? What happens if I go over my daily or yearly ingestion limit? Will my logs be affected or deleted? How can I determine my monthly ingestion overall and by individual application? How does Panther determine the monthly ingestion rate?
You will receive an in-app notification in your Panther Console notifying you when you are approaching your monthly data ingestion limit. The monthly ingestion quota is determined by the raw size of the events ingested into Panther, there is not additional quota added for event processing or storage.
There are two other ways to see your monthly ingestion:
View the Ingestion by Log Source chart on your Panther Console dashboard.
To adjust the timeframe of the chart, use the date picker in the upper right corner of the dashboard page.
View the Ingestion Quota at the top of your Log Sources page.
Panther will not delete any logs or prevent you from ingesting additional logs, but there may be an associated cost with the increase. Our reporting looks at how much data flows through the system each month from the 1st-30/31st.
Please reach out to your account executive if you have any questions about consumption or ingestion overages.