Ironclad Portal FAQ

Overview

Answers to the questions we hear most often about how Ironclad stores your data and how to use the portal day to day. If you don't see what you're looking for here, check the Tutorials section for step-by-step guides, or reach out to your Decian contact.

Data & Retention

What is Ironclad's data retention policy?

Ironclad stores data in hot storage for 30 days and in cold storage for up to 365 days. During the first 30-day period, all of your data is available in the Ironclad portal at no extra cost. If you need to view data older than 30 days, you can initiate a retrieval job in the portal, which incurs a cost based on how much data you'd like to retrieve.

What's the difference between hot storage and cold storage?

Hot storage is instantly searchable and browsable right in the portal — this is where your most recent 30 days of data lives. Cold storage is longer-term archive storage; nothing there is instantly viewable. You explicitly request it back via a retrieval job before you can search or view it.

How do I request a retrieval job for older data?

From your customer view in the portal, open the Archived Logs panel and choose a From / To date range for the window you want, then click Estimate. The portal will show you the cost to retrieve that window based on the amount of data involved. Once you submit the job, it moves through Queued → Restoring → Ready as it's pulled back from cold storage.

How long does a retrieval job take?

It depends on how much data is being restored — larger windows take longer. You can track progress in the Retrieval Jobs list, which shows the window, estimate, status, and when it became (or will become) ready. Once the status shows Ready, click View to open the restored logs.

Once I retrieve archived data, how long can I view it before it needs to be retrieved again?

Restored data stays available in the portal for a limited window after the job completes before it expires and would need to be retrieved again if you still need it. Check the Expires At column in the Retrieval Jobs list for the exact date on any given job.

Can I search or hunt against retrieved archived data the same way I do live data?

Yes. In Threat Hunting, use the data source selector to point a hunt at a specific retrieved window (shown as Archived logs: [from date] → [to date]) instead of live data, then run the same filters and searches you would against current data.

Alerts & Investigations

Where do I go to see my organization's overall security status?

Overview is the default landing page after you log in, and the best starting point — it shows agent status, an alert summary, a SOC case overview, integration status, and other org-level metrics at a glance.

What's the difference between "Alerts Overview" and "Threat Hunting"?

Alerts Overview is a quick, high-level summary of what's happened in the last 24 hours — just metric cards, meant for a glance. Threat Hunting is where you actually dig in: pick a log source (M365, Windows Defender, a firewall, and more), then one or more plain-language behaviors for that source, such as Failed sign-ins & lockouts or Malware detected. For Microsoft 365 you can narrow by service first: Azure AD, Exchange, SharePoint / OneDrive, DLP, or Teams. You can also filter by severity, a specific host, or a MITRE ATT&CK technique, over whatever time window you choose. The Search Reference Guide lists every behavior and the alerts it returns.

How do I investigate a specific security incident?

Security incidents are tracked as cases under SOC. Each case shows its status (open/closed), severity, and owner. Open a case to review the details, add notes, and see related assets and indicators. When it's resolved, close the case from there.

Can I search my logs in plain English instead of building filters manually?

Where enabled, Threat Hunting includes an AI Search option that lets you type a natural-language question and translates it into a search for you.

Reporting

Can I get automated or scheduled reports?

Yes. Under Reporting, you can generate one-off reports or schedule recurring ones. Report types include Case Management, Alert Overview, Security Posture, and Vulnerability Management, available as HTML or PDF, for a time range like the last 24 hours, 7 days, 30 days, month-to-date, or the previous month. Scheduled reports can run daily, weekly, monthly, or quarterly and are emailed to whoever you list as a recipient.

Where do I find reports that were already generated?

Under Reporting, the report history keeps a record of everything that's been generated, along with its status.

Users, Billing & Access

How do I add another person from my team to the portal?

Under Account Management > Users, an admin can add a new user with a name and email; their role and permissions are automatically set based on the organization they're added under. If someone hasn't accepted their invite yet, you can resend it from the same page.

How can I tell which of my data sources are actively reporting in?

Under Account Management > Billing, you'll see active-source counts broken out by category — endpoints (your agents), network devices (syslog sources), and Office 365 (active mailbox count) — each with a last-checked timestamp so you know the data is current.

Connecting Data Sources

How do I connect a firewall, Microsoft 365, Google Workspace, or another integration?

All data source connections are configured under Integrations. Step-by-step guides for each one are available in the Tutorials section of this space.