Subscription Management

Role Availability	Read-Only	Investigator	Analyst	Manager

With a USM Anywhere license, you can always view your subscription data in one place. Use the My Subscription page to access your license information, event data, and raw log data and to connect to a USM Central instance.

Subscription Data

Go to Settings > My Subscription to open the page.

The following table lists the fields you see on the page.

Information on the My Subscription Page

Field	Description
License Usage
Consumed Data	The amount of data USM Anywhere has processed every month.
Projected Data Consumption	The amount of data already stored for the month plus calculated data storage needs for the rest of the month. See Projected Data Consumption for more information.
Sensors	The number of licensed sensors and pending deployment sensors. Click Manage Sensors to open the Sensors page. See Sensors Page Overview for more information.
EPS	Events per second (EPS) in the last 24 hours.
Filtered EPS	Percentage of filtered EPS in the last 24 hours.
Filtering Rules	Number of filtering rules in your environment. Click Manage Rules to open the Filtering Rules page. See Filtering Rules from the Orchestration Rules Page for more information.
Data Consumption Status
Data Consumption Status	The health status of your subscription’s data consumption, reflecting real data consumption rates compared to your subscription tier over time: healthy, caution, warning, violation, or recovery. See Understanding Your Data Consumption Status for more information.
License Information
License Type	Either the trial or subscription license.
Service Tier	The monthly storage limit. See the LevelBlue pricing page for details or to request a quote. Important: Tier options do not have unlimited processing power, memory allotment, or disk input/output (I/O) speeds. In addition to storage per month, your deployment size’s impact on any of these factors will influence which tier option is right for your environment. LevelBlue recommends pre-deployment sizing discussions with your sales representative to help select the right tier for you.
License End Date	Either the trial expiration date (for trial licenses) or support end date (for subscription licenses). The displayed date depends on your computer’s time zone.
Cold Storage	Click Export Raw Logs to download the raw log files in ZIP format. See Raw Log Data for more information. By default, cold storage is unlimited for USM Anywhere customers within their service terms but unlimited for LevelBlue Threat Detection and Response for Government (LevelBlue TDR for Gov) customers for three years. Keep in mind these points: You can export raw logs for a 31-day month, but you are limited to a 31-day span if the range exceeds a single month. The start time is 00:00:00 on the start date selected, and the end time is 23:59:59 on the end date selected. So if you select from 1/1/2020 to 2/1/2020, the logs start at 00:00:00 1/1/2020 and end at 23:59:59 2/1/2020.
Email	Email address associated with your license.
MSSP Status	Indicates whether the USM Anywhere deployment has been successfully connected to a USM Central or not. See Connecting a USM Anywhere to a USM Central for more information.
MSSP Service	Name of the connected USM Central deployment.
Historical Data Consumption	A list of data consumption by month. Click Download CSV to download a file with this information.
Top Data Sources	Displays a list of the top data sources. Click Download CSV to download a file with this information.
Top Event Names	List of the top event names related to their data source. Click Download CSV to download a file with this information.
Top Reporting Devices	List of top reporting devices. Click Download CSV to download a file with this information.

Raw Log Data

Raw log data is data that has been forwarded and collected through your sensors, agents, and Cloud Connectors. USM Anywhere stores this data and enables you to extract raw log data for audit purposes or further forensic analysis.

Important: LevelBlue recommends that you download the raw log data on a monthly basis.

When requesting raw log files, the date range cannot exceed 31 days. To download more than 31 days’ worth of data, you must make multiple requests. Refrain from making all requests at the same time, which may tie up your USM Anywhere instance. You can make two or three requests, wait for the emails to arrive, and then make your next requests.

To extract raw log data

1. Go to Settings > My Subscription.

2. Inside License Information, click Export Raw Logs.

   

   The Export Raw Log Files dialog box opens.

   

3. Select a date range to download the raw log files in ZIP format (dates are in UTC).

   Note: The date range cannot exceed 31 days.

4. Click Request Download.

   The Log Files Requested dialog box opens to inform you that your request is being processed. This process can take up to 24 hours.

   
   Important: The beginning date can’t be earlier than your first day of storage.

5. Click OK.

   You will receive an email with a link to your file.

6. Click the link in the email to download the ZIP file.

   Important: This link will expire in 48 hours.

7. Extract the zipped bundle, and you will see the files listed as forensics-YYYY-MM-DD.hh.log.gz, where YYYY-MM-DD.hh refers to the date and hour.

Email Notifications Concerning Your License

USM Anywhere sends the following notification emails to the email address associated with your license. Typically, this is the email address used to register the trial or your subscription:

• A license is changed from trial to subscription.
• A license tier is upgraded.
• A license expiration date is updated.
• The number of sensors allowed is updated.
• An activated license has expired.
• An activated license is deleted.