About this documentation

This page explains how the Kaseya SIEM online help is organized and how to navigate it effectively. It describes how the different sections of the documentation relate to one another and where to go based on what you are trying to accomplish.

Use this page as a guide to the documentation structure. It does not explain platform features or workflows in detail. Instead, it helps you quickly identify the right section to start with, depending on your role, experience level, and immediate goal.

How this documentation is organized

The Kaseya SIEM documentation is organized by user intent rather than feature lists. Each section is designed to answer a specific type of question at the point when it typically arises. You do not need to read the documentation sequentially; each section is written to stand on its own.

The structure follows how customers typically adopt and use Kaseya SIEM over time:

  1. Orientation and context

  2. Initial access and data verification

  3. Conceptual understanding

  4. Day‑to‑day investigation and response

  5. Detection and automation design

  6. Governance, administration, and reporting

Home

Orientation and wayfinding

Use the Home section when you are new to Kaseya SIEM or unsure where to begin. It helps you confirm that you are in the right documentation set and explains how the help content is organized.

Release notes

Platform changes and updates

The Release notes document new features, enhancements, fixes, and behavioral changes as Kaseya SIEM evolves. Refer to this section to understand what has changed between releases and whether updates affect your existing workflows or detections.

Welcome to Kaseya SIEM

Platform context and reassurance

This section explains what Kaseya SIEM is, who it is designed for, and how it fits into the broader Kaseya security ecosystem alongside Kaseya MDR and SaaS Alerts. It focuses on product purpose, boundaries, and use cases rather than configuration or operations.

Use this section if you are evaluating Kaseya SIEM or want a clear understanding of when and why to use it.

Getting started with Kaseya SIEM

Initial access and setup

Use this section when you are ready to begin using Kaseya SIEM. It focuses on:

  • Access and login

  • Verifying that data is being ingested

  • Confirming basic coverage and visibility

This section is intentionally limited to onboarding and validation steps so you can quickly confirm that the platform is working before investing time in deeper configuration or analysis.

SIEM concepts

Vendor‑neutral concepts

This section introduces general SIEM concepts such as data collection, correlation, alerts, investigations, and common terminology. It is useful if you are new to SIEM technology or want a shared baseline before learning Kaseya‑specific behavior.

How Kaseya SIEM works

Concepts and mental models

This section explains how Kaseya SIEM implements SIEM concepts. It focuses on how data flows through the platform, how detections are generated, how cross‑domain correlation works, and how investigation and response fit together.

This content is conceptual and explanatory rather than procedural.

Using Kaseya SIEM

Day‑to‑day operations

This section covers how you work with Kaseya SIEM during normal operations, including the following:

  • Navigating the dashboard

  • Reviewing alerts and investigations

  • Performing unified analysis across data sources

  • Managing noise without reducing coverage

Use this section once Kaseya SIEM is part of your regular security workflow.

Detection, IOCs, and respond rules

Detection and automation design

This section explains how detections and automated response logic are defined in Kaseya SIEM. It covers Indicators of Compromise (IOCs), built‑in IOC categories, and respond rules used to automate containment or remediation actions.

Use this section when you want to shape how the platform detects activity and how it responds under specific conditions.

Administration and configuration

Governance and control

This section covers administrative and governance‑level controls, including the following:

  • User roles and access

  • MSP‑level versus organization‑level settings

  • Defaults, inheritance, and overrides

  • Data retention and compliance controls

These topics are typically relevant after the platform is operational and detections and investigations are in use.

Integrations and data sources

Visibility and ingestion

This section explains where Kaseya SIEM gets its data from and how different sources contribute to investigations. It includes information about endpoint, SaaS, network, and syslog ingestion, as well as integration scope and ownership.

Reporting and evidence

Proving outcomes and supporting audits

Use this section to generate reports and export data for compliance, audits, and customer communication. It includes guidance on incident timelines, evidence collection, and reporting use cases.

Getting help

Support and assistance

Use this section to understand how to get help, including how to contact support and how to engage SOC resources where applicable.

Scope and limitations

This documentation explains platform behavior and usage. It does not replace managed security services, onboarding sessions, or real‑time incident response. Where appropriate, links are provided to related resources for additional context.

Explore the documentation