USM Anywhere™

Projected Data Consumption

Role Availability Read-Only Analyst Manager

On the My Subscription page, USM Anywhere displays the total data you have consumed for the month, the remaining data to be consumed, and the projected data you will consume based on your current usage. The service tier specified on your license determines the amount of data you're allowed to consume each month.

Projected Data Consumption field on the My Subscription page

The Projected Data Consumption field is calculated using the following formula:

projectedMonthlyConsumption = (currentMonthDataConsumption / totalDaysOfDataConsumption) * DaysInMonth

Where:

  • currentMonthDataConsumption = the total data consumed in the current month.
  • totalDaysOfDataConsumption = the number of days passed in the current month (includes days with no recorded data).
  • DaysInMonth = the total number of days in the month.

For example, in a 30-day month, if at the end of the 15th day the instance has received 10 TB of data, the projected data consumption will be (10 TB / 15) * 30 = 20 TB.

The Projected Data Consumption field is crucial because it provides an estimate on how much data you will consume by the end of the month. This number should never exceed your allocated monthly usage. Exceeding the monthly limit turns USM Anywhere into transient mode, where incoming events are no longer searchable. More importantly, USM Anywhere's performance deteriorates. System process time increases, causing the sensor cache to fill up and the sensor to disconnect.

AT&T Cybersecurity recommends that you monitor your projected data consumption early and constantly, so that you can perform countermeasures when you're to exceed your monthly limit. You can reduce consumption by monitoring fewer networks, cutting down the number of data sources, or creating filtering rules to restrict data collection.

On the same My Subscription page, there is a chart that displays the data collected during the current period.

Total Event Data Chart on the My Subscription page

On the lower side of the page, there are three tables that show the breakdown of how much data is being processed by each data source, event names, and reporting device. You can use the Last 24 Hours filter for identifying data during the last hour, last 24 hours, last 7 days, last 30 days, or last 90 days. You can also configure your own period of time by clicking the Custom Range option. This option enables you to customize a range. When you click the icon, a calendar opens. You can choose the first and last day to delimit your search by clicking the days on the calendar or entering the days directly. Then select the hours, minutes, and seconds by clicking the specific box. Finally, select AM or PM.

Tables on the My Subscription page

Click Download CSV to create a comma-separated value (CSV) file detailing the specific information of each table in a spreadsheet.