A monitored host / instance is defined as a physical or virtual network element, server, or machine that sends data to Sift Security. In cases where there is an intermediate device (e.g. Network Device, Log Management tool, etc.) that sends data, you should count the entities that generate the data. In some situations monitoring the number of users is a more appropriate metric, in which case we may be able to scale on users instead of hosts.
Listed pricing is only for the software and excludes infrastructure.
If Sift Security provides, monitors & manages the infrastructure, Sift passes through AWS costs plus a 25% surcharge.
Sift can work with you to estimate the infrastructure charges, which is based on data volume, the number of users, and data retention requirements.