Question 1

Is SecuSIEM available?

Accepted Answer

Yes, SecuSIEM is available today in production, hosted 100% in Quebec.

Question 2

Which log formats are supported at ingestion?

Accepted Answer

Syslog RFC 3164/5424, Windows Event (WEF/WEC), AWS CloudTrail, Office 365 Audit, Fortinet/Cisco/Palo Alto firewalls, plus CrowdStrike, SentinelOne, Microsoft Defender, GCP Audit Logs, K8s audit and custom JSON via collector.

Question 3

How many detection rules are included?

Accepted Answer

1000+ Sigma rules maintained by the SecuAAS team, mapped to MITRE ATT&CK. Evolving library via managed updates. You can write custom YAML rules.

Question 4

Does SecuSIEM replace Splunk or Microsoft Sentinel?

Accepted Answer

For most Quebec MSP and SMB use cases: yes. For very large volumes (>10 TB/day) or deep Sentinel-native Azure integrations: SecuSIEM covers the fundamentals but may require extensions.

Question 5

Do my logs leave Canada?

Accepted Answer

No. Ingestion, hot/cold storage, indexing, search and analysis are 100% at OVH Beauharnois — outside Cloud Act, Patriot Act and FISA jurisdiction. No cross-border transfer. Loi 25 compliant.

Question 6

How does SecuSIEM integrate with SecuMon?

Accepted Answer

Native pipeline: SecuMon metric anomalies (abnormal CPU spike, unexpected open port, suspicious process) are published as security events in SecuSIEM. Native logs + metrics correlation.

Question 7

Is there a multi-tenant MSP console?

Accepted Answer

Yes. Logical per-tenant isolation, client management, white-label branding, distributor billing with structural discount.

Question 8

What is the default retention?

Accepted Answer

Hot logs (real-time search): 30 days. Cold logs (OVH Object Storage archival): 13 months included, configurable up to 7 years. Immutable WORM audit compliance available.

Question 9

How does SecuAI power the SIEM?

Accepted Answer

SecuAI provides incident summaries, remediation suggestions, and SOAR playbook generation. Sovereign model hosted at OVH Beauharnois; no data feeds third-party training.

Question 10

How do I contact the SecuSIEM team?

Accepted Answer

Via /contact or /secusiem/pricing. MSP partners get preferential pricing and the white-label multi-tenant console.

Frequently asked questions about SecuSIEM