Security Analytics and Logging Licenses

Security Analytics and Logging Subscription Overview

You can combine SAL with your Security Cloud Control subscription. When managing your firewalls with Security Cloud Control, you can obtain Security Analytics and Logging entitlement in these ways:

  • Device management with unlimited logging: This option provides a per-device license. It includes device management capabilities for your firewall device and unlimited log storage for a rolling period of 90 days.

  • Device management only with optional cloud logging: This option involves purchasing a per-device license for management only. You can then add Security Analytics and Logging as a separate cloud logging subscription. This allows you to customize logging data storage and log retention based on your specific operational and compliance needs.

Flexible Security Analytics and Logging Subscription Tiers

If you don’t want to use the device management with unlimited logging option, you can purchase logging capacity separately. This standalone Security Analytics and Logging subscription offering provides greater flexibility, longer default retention, and increased storage entitlements. The default minimum retention period for these subscription tiers is 1 year.

Choose these flexible Security Analytics and Logging subscription tiers if:

  • You have already purchased your firewall devices as part of a different order.

  • You have specific logging estimates and want to buy a tier based on a fixed amount of ingest, storage, and logging retention.

  • You want a log retention period that is more than 90 days.

Security Analytics and Logging subscription is categorized into three tiers—Essentials, Advantage, and Premier. This table describes the storage capacities and log retention periods available for each tier.

Description Retention Period Storage Limit Subscription Term

Cisco SAL Essentials Subscriptions

1, 2, or 3 year

2 TB

0-5 years

Cisco SAL Advantage Subscriptions

1, 2, or 3 year

4 TB

0-5 years
Cisco SAL Premier Subscriptions

1, 2, or 3 year

10 TB

0-5 years

For more information about the subscription plans, refer to the Security Cloud Control Firewall Management Ordering Guide.

Note

For paid subscriptions, Security Analytics and Logging automatically manages your event data to ensure that it aligns with your licensed retention period. Security Analytics and Logging periodically removes event data that is older than your specified retention period. This cleanup process is run every 30 days. You always retain access to all event data within your full retention period.