Obsidian RidgeManaged SIEM
Obsidian Ridge runs a right-sized SIEM for your environment: collect the logs, tune the alerts, retain 90 days, and export audit-ready evidence for a HIPAA audit, an ABA Model Rule 1.6 file, or a cyber-insurance renewal questionnaire. Log collection is Ridge Log, an add-on to any tier at $8 per data source per month. Confirm the add-on contract term and retention in the written proposal.
The direct answer
For a practice of this size the deciding question is not which engine indexes faster. It is whether the service hands you the records a HIPAA audit, an ABA Model Rule 1.6 file or a cyber-insurance renewal questionnaire asks for, without putting a console in front of people who have patients or clients to see.
Obsidian Ridge runs that as Ridge Log. We agree the log sources before you buy, collect and retain them for 90 days searchable with archive on request, and produce the export when someone asks for proof. Ridge Log costs $8 per data source per month as an add-on on any tier, with no minimum number of sources. The add-on contract term is not published, so confirm it, the source list and the retention window in the written proposal. The platform underneath is chosen for your environment rather than sold to you as a brand.
One boundary, stated plainly: a log service produces evidence for a control. It does not by itself satisfy a rule, and the risk analysis, the written policies and the decisions about them stay with the practice.
For how five providers compare on evidence, retention, response and commercial terms, read the managed SIEM comparison for HIPAA and cyber insurance.
Definition
SIEM stands for Security Information & Event Management — software that collects security logs from every tool in your environment, retains them, and surfaces patterns a human should investigate.
Managed SIEM means the platform is operated for you. An analyst:
You see a monthly summary, not a console.
Source: NIST SP 800-92, Guide to Computer Security Log Management. csrc.nist.gov/pubs/sp/800/92/final
TL;DR
We connect your firewall, endpoint agents, identity provider, Microsoft 365 audit logs, cloud accounts, DNS filtering, MFA platform, and mail security to a SIEM we operate. Detections are tuned to your environment. Logs are searchable for 90 days.
When an auditor, insurer, or client asks for evidence, we export the package in a format they accept — mapped to HIPAA 164.312(b), SOC 2 CC7, PCI DSS Requirement 10, or your CMMC AU controls.
Ridge Log, our log collection, is $8 per data source per month on any tier, and we count your sources with you before we quote. We do not promise unlimited ingestion, because nobody who has run a SIEM honestly does.
What's included
We connect your firewall, endpoint agents, identity provider (Entra ID or Google Workspace), Microsoft 365 audit logs, cloud accounts (AWS, Azure), DNS filtering, MFA platform, and mail security to the SIEM. Onboarding is scoped — we tell you which sources matter for your compliance posture and which are noise.
A SIEM that forwards every event to your inbox is worse than no SIEM. We tune detection rules to your environment, suppress known-good noise, and only surface alerts a human should act on. Tuning continues for the life of the engagement.
Security logs are stored for 90 days in a searchable index. Older records can be archived for longer compliance windows when your framework requires it — HIPAA, for example, expects six years of documentation retention for related policies and procedures.
When an auditor asks for proof, we export the evidence package in a format they accept: access logs, authentication events, firewall rule changes, privileged-account activity, and exception reports. Mapped to the control your auditor is testing.
One page, plain English: what we watched, what we investigated, what was tuned, what needs a decision from you. Built for a leadership team that has fifteen minutes, not for a security analyst who has all day.
We are not a SIEM vendor and we do not move you onto a new one. The platform is Huntress Managed SIEM; the work is connecting the firewall, endpoints, identity provider and cloud accounts you already run, tuning what they send, and turning the result into something a human can act on. No rip-and-replace, and no migration project you did not need.
Log sources & what they prove
Below is the short version of what we typically ingest, what each source proves, and which control most auditors will map it to. The full integration list lives on the integrations page.
| Log source | What it proves | Common control mapping |
|---|---|---|
| Firewall / edge | Traffic blocks, rule changes, VPN access | PCI DSS 4.0 Req 10.2 / 10.5 |
| Endpoint (EDR) | Process execution, isolation events, malware containment | HIPAA 164.312(b) audit controls |
| Identity (Entra ID / Workspace) | Sign-ins, MFA prompts, conditional access, role changes | SOC 2 CC6.1 / CC7.2 |
| Cloud (M365, AWS, Azure) | Admin actions, data access, configuration changes | SOC 2 CC7.2 / CC7.3 |
| DNS filtering | Blocked domains, policy bypass attempts | NIST 800-53 SC-7 / AC-4 (inferred) |
| Mail security | Quarantined messages, impersonation attempts | HIPAA 164.308(a)(1)(ii)(D) |
Mappings are practitioner-level shorthand and are not a substitute for your auditor's interpretation. Sources cited: PCI DSS v4.0 Requirement 10, HIPAA Security Rule 164.312(b), and AICPA Trust Services Criteria (CC6, CC7).
Compare honestly
Three legitimate ways to handle security logs at SMB scale. Which one is right depends on how many hours per week your IT lead has, and how soon someone will ask for evidence.
| Question | DIY syslog / open-source | Cloud SIEM, self-served | Managed SIEM service |
|---|---|---|---|
| Up-front cost | Free server, your time | Per-GB ingestion, often surprising | Per-user base + scoped log sources |
| Who tunes alerts | You, weekends | You, in the vendor console | We tune; you read the summary |
| Audit-evidence export | Build it yourself | Possible — if you wrote the queries | Built and mapped to the control |
| Retention policy | Whatever the disk holds | Tiered, easy to misconfigure | 90 days searchable, archive on request |
| Honest fit | One IT lead, no compliance | In-house security analyst | SMB or lean team with audits incoming |
Most lean teams land on managed SIEM because DIY assumes hours nobody has, and a self-served cloud SIEM assumes an analyst who can write the queries. Managed SIEM is the middle path: real coverage, plain language, someone who returns your call within one business day.
Compliance posture
Sources: HHS HIPAA Security Rule, AICPA SOC 2 Trust Services Criteria, PCI Security Standards Council, DoD CIO CMMC, NIST SP 800-92.
What the log view looks like
A simplified view of the kind of correlated record we keep on hand — an identity event tied to the device it ran on, the network destination, and the response action.
Real consoles look more crowded than this. The point of managed SIEM is that you do not have to look at one — we do, and we export the picture above when an auditor or insurer asks for it.
Pricing
Ridge Core, Ridge Plus and Ridge Reserve are real tiers worth comparing. Ridge Log sits on top of any of them at $8 per data source per month, priced per source because ingestion volume varies. We do not promise unlimited ingestion.
Prices in USD · per person
Tier 01 · Ridge Core
A shared computer with no named user counts as one person.
Month-to-month · no minimum
Every computer and every email login watched by a 24/7 security team, with analysts reviewing alerts.
What's included
Replaces or complements
Tier 02 · Ridge Plus
Annual term · billed monthly
Everything in Ridge Core, plus staff training, email protection configured and monitored, and a secure browser for your work apps.
Everything in Ridge Core, plus
Replaces or complements
Tier 03 · Ridge Reserve
Annual term · billed monthly
Ridge Plus, plus more of what carriers ask about: a written incident response plan with a yearly ransomware tabletop, quarterly admin-access reviews, and monthly patch reporting you can put on an application.
Everything in Ridge Plus, plus
Replaces or complements
Billing is per data source, and one machine can be several. A single Windows server may contribute event logs, antivirus logs and web server logs, and each is counted on its own. A quote you build from endpoint count will come in low, which is why we scope the sources with you before quoting rather than after.
Some collection needs configuration, and that work is ours. PowerShell logging and Active Directory diagnostic logging are not on by default and do not switch themselves on — they need manual or Group Policy setup in your environment. It is in the onboarding window, not an extra line.
Identity logs ride along; longer retention does not. Where Managed ITDR is running, its identity logs come into the SIEM at no additional source cost. Retention beyond the standard window is a purchased add-on, so if a framework or a carrier asks you to hold longer, that is a priced decision we make deliberately rather than discover at renewal.
Replaces or complements
What it does not replace: enterprise SIEM deployments like Splunk Enterprise or Elastic running with a dedicated detection-engineering team. If that is where you are, you do not need us — and we will tell you on the triage call.
Honest fit check
Managed SIEM is the right fit for small and lean teams who feel real compliance weight or who have already been burned by an incident with no logs to investigate. It is not the right fit if:
If any of those describe you, we tell you on the triage call. We tell you when you don't need us.
What happens after you reach out
A direct call with the senior analyst who would run it. We confirm your compliance posture, the log sources that actually matter, and whether log collection is the right next step. If Ridge Core or Ridge Plus covers you, we say that.
Within one business day after the briefing you get a fixed-fee proposal: per-person Ridge Reserve pricing, per-source line items, retention scope, and timeline. No metered surprises in the contract.
Log source connectors, detection tuning to your environment, alert routing, and the first audit-evidence template. We sequence sources by compliance priority so the most important records are flowing first.
A one-page executive summary at the end of each month. Audit-evidence exports whenever you (or your auditor) ask. A yearly ransomware tabletop in Ridge Reserve so the first time you use the runbook is not during a real incident.
Where this fits
Managed SIEM is Ridge Log, an add-on on any tier at $8 per data source per month, priced per source because ingestion volume varies by firm size. It sits above MDR and ITDR, correlating what the endpoint and identity layers each see on their own.
Pairs with Managed Detection & Response, Managed ITDR, and Endpoint Security Posture Management.
When OCR or an insurer asks for audit logs, 'we think it was fine' is not an answer. SIEM gives a dental practice the retained, searchable log trail the HIPAA Security Rule's audit-control standard expects.
How this works for dentalReconstructing who touched a sealed or privileged matter after an incident requires logs that were actually kept. SIEM provides the retained evidence a firm needs for a defensible breach-response and a Formal Opinion 483 notification decision.
How this works for law firmsAn IRS Stakeholder Liaison conversation after an incident goes better with a real log trail. SIEM retains and correlates the activity a CPA firm needs to answer what happened, when, and to which client data.
How this works for accountingThe insurance wedge
Questionnaires increasingly ask whether security logs are centralized, monitored, and retained. SIEM is the yes — with the retention window and the searchable trail an underwriter, a regulator, or a breach investigation will ask you to produce.
From $1,500, delivered in 7 business days — final quote depends on scope, up to $3,500. Signed evidence pack mapped to your carrier's questionnaire — delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Buyer guidance published . Updated . By Kfir Yair, CISSP.
Obsidian Ridge's Ridge Log managed SIEM add-on costs $8 per data source per month, with no minimum. The add-on contract term is not published; confirm it, source coverage and retention in the quote. A security team monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States.
A law firm needs to know which systems produced a record, how long it remains available and who investigates a concerning event. Scope the identity, endpoint, firewall and supported cloud sources before deciding how much log collection to buy. A legal document system is not covered merely because a general SIEM integration exists.
Ridge Log is a separately priced add-on on any tier. Use the law-firm service page and published pricing to separate monitoring from incident-response work and evidence preparation. Agree access permissions and export procedures for records that may contain client information.
Logs can help a healthcare practice review system activity and investigate security events, but the retention period must match the record and the practice's requirements. HIPAA's documentation-retention rule is not a blanket instruction to retain every raw system log for six years. HHS describes audit controls and information-system activity review in its Security Rule summary.
Specify the sources, search period, archive period, access controls and evidence exports before deployment. The dental programme connects that work to the wider risk analysis. A SIEM subscription alone does not make a practice HIPAA compliant. Compare SIEM providers for HIPAA and insurance evidence before agreeing retention and response scope.
FAQ
MDR focuses on endpoint detection and response. SIEM collects and correlates selected logs across systems. Whether a law firm needs both depends on its risks, systems and evidence requirements.
Ridge Log is separately scoped as an add-on; log-source coverage and retention must be confirmed in the proposal.
Do not treat HIPAA's six-year documentation-retention rule as a universal raw-log retention period. Determine the records you must retain, the practice's risk analysis and other applicable requirements. Scope searchable and archived logs explicitly, along with access and export arrangements.
Probably not, and we will tell you that on the triage call. A SIEM earns its keep when you have to prove what happened to an outsider: an auditor, an insurer, a client doing diligence, or your own board after an incident.
If none of those apply, Ridge Core or Ridge Plus covers most small businesses well.
The most common SMB triggers for adding log collection are an upcoming SOC 2 Type II, a HIPAA covered-entity relationship, PCI DSS scope, a CMMC contract, or a cyber-insurance renewal asking for centralized log retention.
MDR watches your endpoints and, from Ridge Core upward, your identities, and responds when something is wrong.
Managed SIEM collects logs from every other security tool you run, firewall, cloud, DNS, mail security, into one searchable place, retains them, and produces evidence on demand. MDR is about response. SIEM is about visibility and proof.
Most teams need both, which is why log collection is Ridge Log, an add-on on any tier, rather than a standalone product.
HIPAA's Security Rule does not name a specific retention period for audit logs themselves — it requires covered entities to implement audit controls under 164.312(b) and retain documentation of related policies, procedures, and actions for six years under 164.316(b)(2).
In practice, most HIPAA-aligned programs retain searchable security logs for at least one year and archive longer for incident-related evidence.
We default to 90 days searchable and extend archive retention when your specific compliance posture asks for it.
Source: HHS Security Rule, 45 CFR 164.312(b) and 164.316(b)(2). https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/
Usually yes for the security-relevant sources. If you already run a general-purpose log aggregator (Graylog, ELK, a syslog box), we can either ingest from it as an upstream source or replace it for the security use case — your choice.
We do not try to be your application performance monitoring tool. The scope is security logs that support investigation, detection, and audit evidence. Your dev team's app logs can stay where they are.
One page. Top of the page: what we watched (sources online, ingestion volume, retention status). Middle: what we investigated, including any alerts that became incidents, and what we tuned to reduce future noise.
Bottom: items that need a decision from leadership — a policy gap, a vendor question, an account that should be deprovisioned. It is meant to be read in five minutes by a non-technical owner or director.
Auditors get a different export, formatted for control evidence.
Log collection is Ridge Log, an add-on on any tier at $8 per data source per month.
It is priced per source because ingestion volume varies wildly between a 20-person law firm and a 200-person clinic, and we do not promise unlimited ingestion.
After the briefing you get a fixed proposal with the tier fee plus a per-source line for what you actually connect. No metered surprises mid-month.
Huntress Managed SIEM. We are not a SIEM vendor and we do not run a stable of them — we connect the sources you already have into one platform and operate it.
If you are already invested in a different SIEM, say so on the briefing call: we will tell you honestly whether moving is worth it, and often it is not.
It covers the parts most SMB merchants struggle with: centralized log collection across the in-scope components, daily review (we do the review), and retention.
PCI DSS 4.0 Requirement 10 asks for logs that record user activity, administrator activity, access to cardholder data, and changes to identification and authentication mechanisms — all of which are in scope for the log sources we ingest.
We do not perform your formal PCI audit; we produce evidence the QSA will accept. Source: PCI DSS v4.0 Requirement 10. https://www.pcisecuritystandards.org/document_library/
Related
Our security guide for small registered investment advisers explains where monitoring records fit alongside the firm's written program and provider oversight.
Next step
See where you stand in a few minutes, or talk with us. Both are free and we tell you when you don't need us. 30 minutes, real answers, no follow-up sales sequence.