Frequently asked questions

No. Arden only detects and alerts. It does not block, quarantine or stop anything, so keep Microsoft Defender or your EDR running. Arden adds visibility by reading the Windows event logs those tools don't usually surface, such as logons, service installs and log clearing across your network.

No tool can do that on its own. Arden Comply shows which Windows logging each requirement depends on, whether that logging was observed on your machines, and where the gaps are. That helps you prepare for an audit, but whether you are compliant is decided by your auditor or assessor, and most requirements also involve policies and procedures that no log can show.

None. Arden runs on your own server, agents send event logs only to that server, and there is no cloud service and no telemetry. If you contact support, you choose what to send, and Arden's support file is redacted before it leaves your network.

A 64-bit machine running Windows 10, Windows 11 or Windows Server 2016 or later, local administrator rights on it, and an account with admin rights on the machines you want to add agents to. There is no database or runtime to install.

The beta is invite-only. Each tester gets a license that runs for two weeks, after which Arden stops collecting new events but your existing alerts and reports stay available. Request an invite with the form on the home page and we'll be in touch.

Arden will. Its pricing hasn't been announced yet, but it will be a flat monthly rate based on the size of your environment, with no per-GB ingest fees, so the amount of log data you send won't change your bill. Splunk, QRadar and Microsoft Sentinel are commonly priced by data volume instead. Arden runs on your own Windows server, so you don't pay a cloud provider for ingest or storage either. For a detailed pricing breakdown, see our SIEM pricing comparison.

It depends on what you need and how much log data you produce, and Arden's own pricing hasn't been announced yet. Volume-based pricing grows with your log data: Splunk typically starts at $1,800 per year per GB of daily ingestion, and Microsoft Sentinel charges per GB ingested into Azure. Arden will be a flat monthly rate based on the size of your environment, with no per-GB ingest fees. It focuses on Windows event logs, with detection rules mapped to MITRE ATT&CK, email and webhook alerts, and audit-log coverage reports, and it runs on a Windows machine you already have. Read more in our guide to lightweight SIEM alternatives.

EDR (endpoint detection and response) watches individual machines for malware and suspicious process behavior. A SIEM collects and correlates log data across your environment to find patterns such as lateral movement, credential abuse and privilege escalation. According to CrowdStrike's 2025 Global Threat Report, 79% of attacks are now malware-free, relying on legitimate credentials and built-in admin tools. That activity still leaves traces in Windows event logs, such as RDP logons, pass-the-hash, PsExec lateral movement and new service installs, and that is what log monitoring looks for. The two complement each other. Arden only detects and alerts, so it doesn't replace EDR, but server-level log monitoring gives you a view of activity your EDR may not report on.

Most SIEM pricing follows one of three models. Per-GB ingestion (Splunk, Sentinel) ties your cost to how much log data you generate. A 50-endpoint Windows environment can easily produce 5–10 GB per day, putting annual costs at $10,000 to $50,000 or more. Per-endpoint or per-asset pricing (some managed SIEM providers) is easier to predict but grows with every machine you add. Flat-rate pricing charges a fixed monthly fee that doesn't depend on data volume. Arden will use a flat monthly rate based on the size of your environment, with no per-GB ingest fees; the actual prices haven't been announced yet. See our full SIEM pricing comparison for 2026.

No. Arden is not a replacement for a mature enterprise SIEM run by dedicated security staff. Splunk, QRadar and Sentinel take in data from dozens of source types, offer machine learning models and integrate with SOAR platforms. Arden focuses on Windows event logs. It's meant for organizations that have little or no log monitoring today, which is common among small and mid-size businesses. For them, it can alert on lateral movement, credential theft, privilege escalation and persistence recorded in Windows event logs. It won't catch every attack. Tested against the public EVTX-ATTACK-SAMPLES corpus, it raised at least one alert on 233 of 278 recorded attacks (84%).

Arden reads the Windows Security, System and PowerShell logs, plus Sysmon if it's installed. Event IDs it uses include 4624 and 4625 (successful and failed logons), 4672 (special privileges assigned at logon), 4688 (process creation), 7045 (new service installed), 4698 (scheduled task created), 1102 (audit log cleared), and 4778 and 4779 (RDP session reconnected and disconnected), among others. With Sysmon, Arden also looks for DLL side-loading, process injection, COM hijacking and registry-based attacks. Its detections are mapped to MITRE ATT&CK. Learn more in our guide to the 5 most critical Windows event IDs.

No. Arden is a single Windows executable with no database server or runtime to install. It keeps its data in a local SQLite file on the machine it runs on and serves its dashboard from that machine. There is no cloud component and no telemetry, so event data stays on your network. Because no third party handles your logs, Arden doesn't add a new data-residency or data-handling question for organizations subject to HIPAA, PCI DSS, CJIS or CMMC.

Arden Comply covers 133 requirements across seven frameworks: CJIS (15), HIPAA (14), PCI DSS (15), CMMC (35), NIST SP 800-171 (31), SOX (12) and FERPA (11). For each requirement it lists the Windows event categories the requirement depends on, shows whether those events were observed in your logs, and flags logging gaps. You can export the results as PDF, CSV or JSON to share with your auditor. The report describes audit-log coverage only. It doesn't determine whether you are compliant, which is up to your auditor or assessor. Event data stays on your server, and alert emails go through your own SMTP server. Read more in how to prepare for a compliance audit using Windows event logs.

Managed SIEM services typically cost $2,000 to $10,000 per month for small environments and include 24/7 monitoring by a third-party SOC. If your budget or compliance obligations call for round-the-clock human monitoring, that can be worth paying for. Arden is something different. It's software you run yourself on your own server, with no SOC behind it. It sends alerts to your team by email or webhook, and someone on your team decides what to do with each one.

Yes, with the Network edition. You run Arden on one Windows machine, scan a subnet to find hosts, and deploy agents to them from the dashboard using an account with admin rights on those machines. Each agent sends its event logs to your Arden server (HTTPS is supported), and alerts from all machines show up in one dashboard, with related alerts across machines grouped together. Alerts can also go out by email or webhook. Pricing will be a flat monthly rate based on the size of your environment.