> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/about-integrations/tiers-and-support.md).

# MDR SIEM Tiers

{% hint style="warning" %}
MDR SIEM tiers only apply to SIEM-based technology and not to integrations that use a via SIEM connection.
{% endhint %}

## Advanced (Tier 1)

{% hint style="info" icon="money-bills" %}
Plan Options: Premium, Premium Pro
{% endhint %}

For Advanced (Tier 1) SIEMs, we may leverage either out-of-the-box (OOTB) or custom rules to map the SIEM alerts to our own ingestion criteria. We also use the SIEM for investigation telemetry.

**This tier includes:**

* Support for OOTB vendor detection rules (queried via API), and post Expel rule review to determine level of support per rule (e.g. full support, partial support, index as evidence).
* Support for custom detection rules (queried via API), and post Expel rule review to determine level of support per rule (e.g. full support, partial support, index as evidence). 
* 50 custom rules reviewed per contract year.
* Triage of all generated alerts to the appropriate support level based on Expel rule reviews.

**Advanced (Tier 1) SIEM integrations:**

* CrowdStrike Falcon NextGen SIEM
* Google Security Operations (SecOps)
* Microsoft Sentinel 
* Palo Alto Networks Cortex XSIAM
* Splunk - Enterprise Security (Splunk ES)
* Splunk - Core (Splunk Core)
* Sumo Logic Cloud SIEM (CSE)

## Essentials (Tier 2)

{% hint style="info" icon="money-bills" %}
Plan Options: Select, Premium, Premium Pro
{% endhint %}

For Essential (Tier 2) SIEMs, we leverage your SIEM's out-of-the-box (OOTB) rules to map the SIEM alerts to our own ingestion criteria, but we do not support any custom rules you may have in place. We also use the SIEM for investigation telemetry.

**This tier includes:**

* Support for OOTB vendor detection rules (queried via API), and post Expel rule review to determine level of support per rule (e.g. full support, partial support, index as evidence).
* Triage of all generated alerts to the appropriate support level based on Expel rule reviews.

**Essentials (Tier 2) SIEM integrations:**

* Datadog Observability & Analytics Platform
* Elastic Security (SIEM)
* Exabeam Fusion SIEM
* Exabeam Fusion XDR
* Exabeam Threat Center
* Hunters SOC Platform
* Palo Alto Strata
* Panther Cloud SIEM
* QRadar
* SentinelOne Singularity Data Lake

## Investigative Only (Tier 3)

{% hint style="info" icon="money-bills" %}
Plan Options: Starter, Select, Premium, Premium Pro
{% endhint %}

For Investigative Only (Tier 3) SIEMS, no alerts from the SIEM are mapped to Expel Alerts, but the SIEM's data can still be used by us for investigation telemetry. We strongly recommend you set up Tier 3 SIEMs in Workbench to increase the available investigative support.

**This tier includes:**

* APIs for [Investigative Actions](/workbench-reference/expel-terminology.md#investigative-action).
* Using the data as an investigative source.

**Investigative Only (Tier 3) SIEM integrations:**

* Devo
* LogRhythm
* Logz.io
* Securonix Next-Gen SIEM
* Sumo Logic Cloud Infrastructure Security


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/about-integrations/tiers-and-support.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.