Yes. The Advanced Reporting Tool is an add-on that extends either Adaptive Defense or Adaptive Defense 360. It requires an active subscription to one of those endpoint protection products because it draws its data from the telemetry those agents collect. ART is not a standalone SIEM and cannot ingest data from non-Panda sources.

ART captures a comprehensive set of endpoint events including process creation and execution, network connection attempts, file system operations, registry changes, user logon and logoff events, detected threats and blocked activity, and device inventory changes. All events are timestamped and attributed to specific devices and users, giving analysts full context for investigation and reporting.

Endpoint telemetry collected by ART is stored in Panda Security's cloud infrastructure using Elastic. Data is encrypted in transit and at rest. Access is controlled by Aether role-based permissions, so only administrators with the appropriate access level can query or export the retained telemetry. Panda publishes its data handling practices in its security and privacy documentation.

Yes, and this is one of its most valuable use cases. After a security incident, ART lets you query historical events to reconstruct exactly what happened: which process ran first, what files it accessed, what network connections it made, and which other devices were affected. Because data is retained for up to one year, you can investigate incidents that occurred weeks or months before they were discovered, which is critical for uncovering persistent threats or dwell-time attacks.

Yes. ART is licensed per endpoint on an annual subscription basis, matching the seat count of your underlying Adaptive Defense or AD360 subscription. It can be purchased as a standalone add-on or as part of the Adaptive Defense 360 ART bundle. Contact a Firewalls.com specialist for volume pricing if you are adding ART to a large deployment.