What is the difference between Ingest Data, Processed Data (Events), Data Received, and Data Stored in Panther?

Last updated: April 29, 2025

QUESTION

What is the difference between the terms: Ingest Data, Processed Data (Events), Data Received, and Data Stored in Panther?

These terms are visible in the Panther Console when viewing the Analytics Dashboard for my log sources and the details page for a particular source:

Untitled design.png

ANSWER

  • Data Received: The raw, unprocessed data that enters Panther and awaits processing and parsing.

  • Processed Data / Ingested Data / Data Stored: These terms all refer to data that has successfully passed through your log source's configured filters (both raw event filters and normalized event filters) and been parsed by a log schema. This data is often called "parsed logs" and is the basis for calculating your ingestion quota.

Important: In the Panther GraphQL Metrics API, totalBytesIngested and totalBytesProcessed represent the same data but are measured over different time periods. Their values are the same ones used to calculate your ingestion quota. For more details on their differences, please refer to the documentation.