Skip to content
Tenvara is coming soon. Get early access
Beta

Compare: Security monitoring

ConnectWise SIEM alternative: Tenvara

ConnectWise SIEM, formerly Perch, is a multi-tenant SIEM built for MSPs, collecting logs from endpoints, networks, cloud apps and Microsoft 365. MSPs look at Tenvara when they want to run security monitoring themselves, in the same app as their devices and tickets, using the agent they already deploy.

Get early access See the comparison
Tenvara: Security monitoring

The tool today

What ConnectWise SIEM does

A multi-tenant SIEM for MSPs, formerly Perch, with network intrusion detection. Made by ConnectWise. This is how the vendor describes it, in our words.

  • Log collection from endpoints, networks, apps and the cloud, including Microsoft 365.
  • Correlation and real-time alerting, with MSP-specific threat intelligence.
  • Built-in network-based intrusion detection.
  • Data retention from one to seven years for compliance.
  • Tickets in ConnectWise PSA and response through ConnectWise Automate scripts.

Side by side

Tenvara vs ConnectWise SIEM

The security monitoring jobs that matter most, and how each product handles them. Then what else comes with Tenvara, such as RMM, remote access and backup, in the same app.

Security events from Windows, macOS and Linux

Tenvara Yes

Collected by the Tenvara agent Guide

ConnectWise SIEM Yes

Endpoint log collection

Microsoft 365 sign-ins and audit log

Tenvara Yes

Seven streams per connected tenant Guide

ConnectWise SIEM Yes

Microsoft 365 log collection

Firewall logs by syslog

Tenvara Yes

pfSense, OPNsense and DrayTek parsed, any standard syslog Guide

ConnectWise SIEM Yes

Syslog

Detection rules to tune or write yourself

Tenvara Yes

Built-in rules, tuned per customer, plus your own Guide

ConnectWise SIEM Yes

Correlation and real-time alerting

Adjustable event retention

Tenvara Yes

Searchable for 7 to 3,650 days or no limit, 90 by default Guide

ConnectWise SIEM Yes

One to seven years

Incidents and response

Tenvara Yes

Detections grouped into incidents, with targets and a report Guide

ConnectWise SIEM Yes

Incident response workflows

Threat intelligence

Tenvara Yes

abuse.ch, Spamhaus and Emerging Threats feeds, plus MITRE ATT&CK Guide

ConnectWise SIEM Yes

MSP-specific threat intelligence

Detections become tickets

Tenvara Yes

Same app, closes when the detection closes Guide

ConnectWise SIEM Yes

Tickets in ConnectWise PSA

Network intrusion detection sensor

Tenvara Yes

Suricata as a role on the agent Guide

ConnectWise SIEM Yes

Built-in network IDS

Alerts that stay quiet unless something is wrong

Tenvara Yes

Your own work recognised, one cause one alert, lowering with Undo Guide

ConnectWise SIEM Yes

Tuning and AI-driven triage

Microsoft 365 account takeover response

Tenvara Yes

Impossible travel, stolen tokens, MFA fatigue; sign out or block Guide

ConnectWise SIEM Yes

Identity threat detection for Microsoft 365

Log retention

Tenvara Yes

Up to 10 years, with archive and restore Guide

ConnectWise SIEM Yes

One to seven years

Also in Tenvara

What else you get with Tenvara, in the same app

Remote monitoring and alerts

Tenvara Yes

Device health, checks and alerts by policy, on one agent Guide

ConnectWise SIEM Add-on

Separate product: ConnectWise RMM or Automate

Remote access

Tenvara Yes

Control a device's screen from the browser, with every session logged Guide

ConnectWise SIEM Add-on

Separate product: ScreenConnect

Endpoint, server and VM backup

Tenvara Yes

Image, folder and Hyper-V or Proxmox VM backups Guide

ConnectWise SIEM Add-on

Separate product: ConnectWise x360Recover

Microsoft 365 backup

Tenvara Yes

Mail, OneDrive, SharePoint and Teams backed up and restored Guide

ConnectWise SIEM Add-on

Separate product: ConnectWise Cloud Backup

Microsoft 365 security posture

Tenvara Yes

Security checks on every tenant, mapped to CIS, NIST, SCuBA and Essential Eight Guide

ConnectWise SIEM Add-on

Separate product: ConnectWise SaaS Security

IT documentation

Tenvara Yes

Customer records and knowledge base articles, linked to devices Guide

ConnectWise SIEM Add-on

Separate product: ConnectWise Documentation (formerly ITBoost)

Security awareness training

Tenvara Yes

Phishing simulations, lessons, quizzes and policy acceptance Guide

ConnectWise SIEM No

Not included; partner tools via Marketplace

Add-on means the vendor sells it as a separate product or paid extra. ConnectWise SIEM details come from the vendor's own website, see sources.

The one-app pitch

What else you'd replace

Most MSPs running ConnectWise SIEM pay for several other tools beside it. Tenvara does these jobs too, on the same customer record, with one agent and one login.

See every comparison

Switching

Moving from ConnectWise SIEM

A calm move, not a big bang. Run both side by side until your team is happy.

How a gradual move to Tenvara works
  1. 1

    Deploy the agent alongside

    Install the Tenvara agent next to your existing collectors. Each device starts sending security events as soon as it enrols.

    Installing the agent
  2. 2

    Connect Microsoft 365 tenants

    Consent each customer tenant so sign-ins and audit logs flow in.

    Connecting a tenant
  3. 3

    Point firewalls at Tenvara

    Add each firewall as a network source and send its syslog to Tenvara, directly or through a relay on an agent at the site.

    Event sources and collection
  4. 4

    Turn detections into tickets

    Add the suggested alert rule so critical and warning security alerts open tickets for your team, and each ticket resolves when its detection closes.

    Integrations and alerting
  5. 5

    Run both, then switch

    Compare detections side by side for a few weeks and tune rules per customer before you stop the old service.

    Detection rules and suppressions

ConnectWise SIEM pricing

ConnectWise SIEM is priced by quote.

Tenvara pricing

One product with every feature included, hosted or self-hosted. Tenvara is new and in beta, and pricing is announced before launch.

See pricing

Questions

ConnectWise SIEM vs Tenvara: FAQ

Yes. Connect Microsoft Defender or SentinelOne with your own account and their alerts come into Tenvara as detections next to its own.

Events are kept for 90 days by default and raw records for 30. Administrators can keep events for anywhere from 7 to 3,650 days, or without limit, and archive older days.

Any firewall or gateway that sends standard syslog. pfSense, OPNsense and DrayTek are read for their own fields, and a syslog relay at the site collects logs without sending them across the internet.

Seven streams per connected tenant: sign-ins, the directory audit log, risk detections, and the unified audit log for Entra ID, Exchange, SharePoint and OneDrive, and Teams. Tenvara reads them every five minutes.

Tenvara is coming soon.

Apply for the beta to run Tenvara side by side with ConnectWise SIEM before you decide, or get launch updates and hear first when pricing is announced.

Get early access All comparisons

Comparison based on publicly available information as of September 2026. ConnectWise SIEM is a trademark of its owner; Tenvara is not affiliated with it. Spotted something out of date? Tell us and we'll correct it.

Sources