Tiers¶
AI SIEM is sold in four public tiers on AWS Marketplace, plus a private Enterprise+ offer. Each tier is cumulative — it includes everything in the tier below, plus what is listed against it. Upgrading is a non-destructive CloudFormation stack update: all data is preserved and feature gates activate immediately.
| Capability | Basic | Essential | Advanced | Enterprise |
|---|---|---|---|---|
| CloudTrail ingestion + timeline | ✓ | ✓ | ✓ | ✓ |
| Static threat rules | ✓ | ✓ | ✓ | ✓ |
| Security Hub + Config change ingestion | ✓ | ✓ | ✓ | ✓ |
| Editor UI | ✓ | ✓ | ✓ | ✓ |
| VPC Flow Logs + GuardDuty | ✓ | ✓ | ✓ | |
| Flow-log cost guardrail | ✓ | ✓ | ✓ | |
| ML behavioral baselines | ✓ | ✓ | ✓ | |
| Per-VPC detection thresholds | ✓ | ✓ | ✓ | |
| Cross-signal correlation | ✓ | ✓ | ||
| MITRE ATT&CK mapping | ✓ | ✓ | ||
| Custom detection rules (AI-authored + Sigma import) | ✓ | ✓ | ||
| Context-aware severity modifiers | ✓ | ✓ | ||
| AI playbooks (Bedrock) | ✓ | ✓ | ||
| Scheduled threat reports + investigations | ✓ | ✓ | ||
| Threat intelligence | ✓ | ✓ | ||
| Compliance posture scoring | ✓ | ✓ | ||
| AI Monitor metric-anomaly correlation | ✓ | ✓ | ||
| Multi-account monitoring | ✓ | ✓ | ||
| Response & remediation (SSM Automation) | ✓ | |||
| SSO + role-based access control | ✓ | |||
| Log Processor cross-correlation | ✓ |
Data sources per tier¶
- Basic — up to 5 data sources.
- Essential — up to 25 data sources.
- Advanced — multi-account, up to 200 sources.
- Enterprise — unlimited sources.
Retention per tier¶
| Retained data | Basic | Essential | Advanced | Enterprise |
|---|---|---|---|---|
| Events — searchable (OpenSearch) | 7 d | 90 d | 365 d | 365 d |
| Events — retained (S3 / Athena) | 7 d | 90 d | 365 d | 365 d |
| Threats | 7 d | 90 d | 180 d | 365 d |
| Threat timelines | 7 d | 90 d | 180 d | 365 d |
| Audit trail (default) | 30 d | 90 d | 365 d | 365 d |
| Config bucket — old object versions kept | 7 d | 14 d | 30 d | 30 d |
Audit retention can be raised independently at deploy via AuditRetentionDays (up to 36500 days / 100 years) with an optional COMPLIANCE Object-Lock mode; raw-log cold retention can be raised via DatalakeRetentionDays without a tier change. See getting started for the full retention and compliance notes.
Enterprise+¶
For large or multi-account deployments: annual pricing, custom terms, dedicated onboarding, and SLA — transacted via an AWS Marketplace Private Offer. See pricing and contact Perfware to arrange an offer.