Log & Event Monitoring

What this service offers

This service ingests, normalizes, and analyzes endpoint, server, and system event logs around the clock — then turns noisy telemetry into plain-English business-impact summaries your team can act on.

It is the foundation of managed detection. If you cannot see host activity, everything else is guesswork.

• Continuous telemetry ingest from endpoint and server sources
• Long retention without forced cloud streaming — up to 365+ days via Kevantic Data Lake (local appliance or cloud path)
• Alert translation into plain-English impact summaries for your portal
• Correlation that helps our analysts surface real risk faster
• Customer portal Alerts view (tenant-isolated)

Limitations (honest scope)

Clear boundaries help you buy the right module — not oversell.

• Focuses on host/system event telemetry — it is not a full network packet sensor (see NDR).
• Quality depends on agents/collectors being installed and healthy on covered assets.
• Does not by itself isolate hosts; pair with Incident Response and Automation for containment.
• Raw log retention policy follows your deployment mode (Edge Appliance vs cloud path).

Who should go for it

• Every Kevantic customer — this is Core and included in the base plan.
• Organizations that need continuous monitoring without building an in-house SIEM team.
• Leaders who want business-language alerts instead of raw log dumps.

Usually not the best fit if…

• Teams that only want a one-time audit with no ongoing monitoring.
• Environments where no endpoints/servers can be instrumented at all.