Partner Support

The following 7-minute video provides an overview of where Blumira fits in the market and how to get started with Blumira's MSP program: Blumira MSP Program and Product Overview - XDR.

Use the information below to contact Blumira's Partnership team and team members.

After a customer decides to use Blumira, you can customize our template slide deck to help you quickly onboard and train them on how to use our app.

Click the following image to make a copy of and then customize our Onboarding Google Slides Template or download the PowerPoint file.

Overview

Blumira provides aggregate volume discounts to our MSP partners so that you can resell Blumira at healthy product margins. Internal use of your NFR account is free for up to a year. To continue free NFR for longer than a year, you’ll need to add paying customers to your MSP Portal. When you are ready to add clients on a paid edition, then you will commit to a monthly minimum dollar amount via a signed order form. That commitment drives your partner cost for all of your sub-accounts until you increase your commitment via a new order form.

Pricing tiers

The table below shows the current monthly minimum commitment for each MSP license tier. Your commitment to a monthly minimum determines the pricing for all of your sub-accounts. Tiers do not change automatically.

We bill monthly, in arrears, based on the actual aggregate usage above your monthly minimum commitment across all clients. If usage across all clients does not exceed the minimum, we bill the minimum.

Reference: See Blumira Pricing for information about the features included in each edition.

Initiating billing for customer accounts

To get billing started for a customer in your Blumira MSP Portal, email [email protected] or your Partner Specialist to inform them of what your minimum monthly commitment will be. The minimum commitment drives your pricing for all customers under your account. We will send you an order form to e-sign in accordance with your selection.

Calculating price for editions with Blumira Agent

You can use the Blumira MSP Price Calculator (XLSX file download) to determine the pricing for Blumira editions that include the Blumira agent. These editions - Advanced+, XDR Platform, and SIEM + Endpoint Visibility - include 1 agent per user, but you can calculate for additional agents if needed. The calculator helps with determining the maximum deployable agent count and the total cost.

Tip: Consult your Blumira order form to determine which edition(s) apply to your MSP.

Answers to FAQs

• A "billable user" or "user" in the context of billing refers to the number of knowledge workers at your customer—basically, the number of employees with email addresses who use them. This is different from app users with assigned Blumira roles.
• All paid editions are billed based on user count plus any add-on agents, if applicable. The MSP enters the user count into the customer details when adding customer accounts in the MSP Portal.
• Blumira Agent data retention is determined by the licensed edition.
• Any paid edition or add-on (Blumira Agent) can be used to meet your monthly minimum commitment. You can have sub-accounts on separate editions and the aggregate total of those is counted towards your minimum commitment.
• Blumira encourages you to enroll all customers in the Free edition who are not yet prospects for a paid edition.

Blumira bills MSPs monthly, in arrears, based on actual usage above a minimum commitment. The MSP commitment to Blumira is annual and breaks into 12 monthly minimum commitments. When actual usage across all of your customers exceeds your monthly minimum commitment, we bill for actual usage.

Important: Blumira charges per user, with a total user count that refers to the number of knowledge workers each of your customers has.

We send you one invoice each month that is based on the number of billable users for all sub-accounts that are on paid editions. A snapshot of the accounts tab of your MSP Portal is taken on the last day of each month to capture the number of users. You are responsible for the accuracy of the user counts and editions of your accounts. We will send a billing report that shows details for each sub-account.

After you add a credit card, you have the option to set your invoice to autopay.

If you have questions about your billing, please contact Blumira at [email protected].

To update the billing email address for your organization:

1. Navigate to MSP Portal > Settings.
2. In Email invoices and end-of-month billing report to, type the email address(es) where you want the monthly invoice sent.
3. Click Save changes.

View Blumira's current operational status on this status page.

Before you begin

Below, we provide several tips to help orient you within the app and ensure your success as you start using Blumira as an MSP. 

The videos in these articles can help you to visualize how to navigate the app:

• About the MSP Portal
• Blumira product demo

Know what to expect the first time you log in to the app

• After we create your NFR account, you will receive an account verification email. Follow the steps outlined in the email to get logged in to app.blumira.com.
• With one login you will have access to:
  • Your NFR account, including your MSP Portal, dashboards, reporting, and settings for your organization.
  • All customer accounts that you add to your parent account over time. Later, you can use the Accounts table or the Organizations menu at the top of the screen to switch between the accounts that you need to work in.
• If you are an Administrator of a Blumira NFR account, you land in the MSP Portal > Accounts page when logging in. You can confirm that you are in your parent NFR account by viewing the Organization name at the top of the screen ("My Org Name - NFR" in the screenshot below).
  
• The Accounts screen is empty at first, as you have not yet added any customer organizations in the app. This screen will show all of your customer accounts after you add them in later steps.
  Important: Do not add another new account for your internal use. All accounts that you add in MSP Portal are customer accounts. Your parent account is your internal use NFR account so there is no need to add another.
• MSP Portal > Users includes the users that have been added to the NFR account, and this is the same list as in Settings > Users when you are working in your NFR account. 
  Tip: Confirm the organization name at the top of the screen if you are unsure which account's users you are viewing.
• The MSP Portal is the best place to bulk-manage your subaccounts and NFR users. 
• Settings > Users is the best place to manage an individual organization's users. This is true for both NFR and customer accounts.

Know what each role can do in the app

• Review About Blumira roles for MSPs for a complete view of permissions.
• Assign the Administrator role to your NFR users that need to manage other users, integrations, and settings (detection rules, sensors, etc). Administrators have access to all of your customer organizations and the MSP Portal.
• Assign Administrator and Responder roles to users who need to be able to do everything in the app, including responding to findings.
• Assign only the Responder role to any helpdesk resources that need to respond to findings but that should not have access to configure settings or add accounts. You choose which accounts they have access to.

Using Blumira

Follow the steps outlined below to connect your data sources to send logs to Blumira, start receiving findings, and add other users who will be using Blumira with you.

As an MSP Administrator, you can use the MSP Portal to see and manage your customer accounts directly in the app. In the MSP Portal, you can:

• Add and update customer accounts
• Add and update NFR account users
• Change your billing contact information

Watch a video walk-through of the MSP Portal here: MSP Portal Walk Through.

The following video is a demonstration of the Blumira Advanced edition and how MSPs can use it:

Overview

As an MSP with an NFR account, you can use Blumira’s SIEM features for your own organization’s security practices while also managing your customers’ Blumira implementations. When Blumira creates your NFR account, it is considered the top-level parent account from which you can manage your own deployment and the deployment for each of your customers.

Some MSPs have internal controls, separated helpdesk and IT teams, or data security reasons for which they need to limit access to their organization’s log data. Some of their staff members only need access to their customers’ Blumira accounts, which means their organization should not use the top-level NFR account for both customer management and internal use of Blumira.

Deciding if you must separate your internal deployment for logging and detections into your own sub-account depends on the level of visibility of event logs that you want to give your organization’s users.

Important: All app users with access to an organization’s Blumira account have access to view and search log data and findings for the account. To fully restrict a user’s access to data, you must not add a user to the organization.

How to approach your account management

If you determine that you must limit internal access to your Blumira data, do not configure Cloud Connectors or sensors in the top-level parent account. Instead, use your parent account only for administration of users and sub-accounts, and create an internal sub-account dedicated to your organization’s use of Blumira’s SIEM features. 

To create and use your internal sub-account for detections:

1. Email Blumira’s MSP Team at [email protected] if you want to deploy your internal use licensing on a sub-account so that we can note your account properly and exclude it from sub-account billing. 
2. Create your sub-account in the MSP Portal and identify it as CompanyName - Internal Use, where “CompanyName” matches the name of the organization in your NFR account.
   Reference: Read Adding and updating customer accounts in MSP Portal for full instructions.
3. Add the users that need to have access to your internal-use sub-account and assign them Administrator role access in MSP Portal > Users. These users automatically get access to all your newly added sub-accounts, including your internal-use account.
4. Navigate from the MSP Portal to the “CompanyName - Internal Use” account and verify that you see the name displayed in the accounts box at the top of the screen.
5. Using your newly created internal-use sub-account, configure the necessary log sources for your organization in Cloud Connectors and Sensors, as appropriate.

If you have not yet requested an NFR account and know you will need an internal sub-account, email [email protected] and the MSP Team can set up both the top-level account and the internal sub-account for you from the start.

How roles impact NFR accounts

Administrators of an NFR account automatically get access to and administrator-level permissions for the MSP’s top-level account and all sub-accounts. Administrators are the only users with access to the MSP Portal where they can add new users and new customer accounts. Administrators can optionally also have the responder role if they also need to respond to findings in the app. 

A user that is granted administrator and responder roles in the MSP Portal is automatically added to all child accounts with both sets of permissions.

If a user is added as a Responder to the top-level account, the user gets responder-level permissions to the MSP account and can be individually assigned to specific child accounts.

Although other roles (Manager and Monitor) exist in Blumira, those are not compatible with user management in the MSP Portal and therefore cannot be used in top-level NFR accounts. Manager and Monitor can be assigned in sub-accounts.

Reference: See the capabilities of each role in About Blumira role for MSPs.

Blumira’s Security Operations and Support (SOS) teams are here to support customers who are using any of Blumira's paid plans. Blumira's Free SIEM does not include live support.

How to Contact Support

To contact Blumira, do one of the following depending on if you are experiencing an emergency:

• For non-urgent issues, click Support at the bottom of this window, and write us a message.
  Tip: If you do not see a Support button and you purchased Blumira, log back in to your Blumira account and then refresh this webpage.
• For emergency support over the phone, call us at (877) 870-5876 and follow the prompts to leave us a message, and an SOS team member will contact you.

Service Level Agreement

You can expect to receive an initial response from us within the following timeframes, depending on the priority of the issue and the support hours included with your licensed edition:

• Critical (i.e., an emergency) – 1 hour
• High (e.g., a major issue that is preventing you from being able to use Blumira) – 4 hours
• Normal (e.g., a general question that does not have an immediate negative impact on your business) – 1 business day
• Low (e.g., a feature request) – 2 business days

Hours of Availability

The following are our active support hours:

• 9 am ET – 8 pm ET, Monday-Friday for all issues
• Emergency 24/7 support for critical issues (e.g., potential breaches) is available to users in these editions:
  • M365
  • Cloud
  • Advanced
  • SIEM + Endpoint Visibility
  • XDR Platform

Outside of critical issues, we are not available when certain U.S. holidays are observed, including (but not limited to):

• New Year's Day
• Martin Luther King Jr. Day
• President's Day
• Juneteenth
• Independence Day
• Labor Day
• Indigenous Peoples' Day
• Thanksgiving and Day after Thanksgiving
• Christmas Eve and Christmas

Below are some examples of the frequently seen detections across our customers that you might see once you get started. Keep in mind that detections vary based on the integrations that are sending logs. Blumira has hundreds of pre-tuned detections, and our Incident Detection Engineering team adds more every week.

• Service Execution with Lateral Movement Tools
• 500GB+ Outbound Connection via Generic Network Protocol
• Pass the Hash Behavior
• Impossible Travel
• M365 Email Forwarding Enabled
• Potentially Malicious PowerShell Command
• Clear-Text Password on Local System

The table below displays the different MSP user roles that are available in Blumira, with a list of each of their capabilities. 

Notes:

• Feature availability is determined by the account's license. See Blumira Pricing for an overview of which features are available in each edition.
• See Managing users for details about editing user role settings.
• See Adding and updating users in MSP Portal for details about managing roles of MSP users across multiple accounts.
• You can assign multiple roles to a user, with the exception of the Monitor role, which is only for viewing the Monitor dashboard or sending notifications to your PSA tool. Monitor role will override any other roles assigned to a user.
• The MSP Portal is only visible to those who are Administrators in the MSP parent account. 

Overview

As an MSP, you can add users to a customer sub-account and manage their user settings (role, contact details, location, notification preferences) all within the Settings section of the Blumira app. 

This article is for adding Blumira users who need access to one specific account only, like end users from a co-managed customer for example. Blumira users that work as part of the MSP organization can be managed in the MSP Portal. See Adding and updating users in MSP Portal for more information.

Note: The term "users" in this article refers to the people who will log in and utilize Blumira's features according to their assigned Blumira role(s). This is not the same as billable users.

Before you begin

You must be an Administrator for the organization and have the sub-account registered under your MSP account before proceeding with managing users in the organization. Follow the steps in Adding and updating customer accounts in MSP Portal before proceeding with the steps below.

Currently, Administrators can only add new users to Blumira within the app. 

Note: If you get an error while trying to add a user, it is most likely because they already exist in another Blumira account. If you get an error like this, email [email protected] with a description of what you are trying to do and they will help.

Adding users

To add a user to an organization:

1. In the Organizations list, select the name of the organization that the user belongs to.
2. Navigate to Settings > Users.
3. Click Add New User.
4. Add the following information about the user:
   1. Name
   2. Email address used for login
      Note: This address may not match the email address used for email notifications. Check the user’s notification settings (Settings > Users > User detail > Edit User Notifications) for the alerting email address.
   3. Title
   4. Blumira role(s)
      Note: See About Blumira roles for MSPs for details. 
   5. Location
5. Click Save Changes.

Resetting multi-factor authentication

In order to practice strong security standards, we ask that company Admins reset MFA for their Blumira account users.

As an administrator, to reset MFA for one of your Blumira users:

1. Navigate to Settings > Users.
2. Click the row with the user's name.
3. Click Reset Two-Factor Authenticators.

Editing user notification settings

Findings trigger notifications that are sent immediately and according to your users' notification settings. Ensure that your users are able to receive notifications from Blumira to handle findings in an appropriate timeframe. (See About Blumira findings for recommended response times.)

As an Administrator or Manager, you can edit the Notifications your Blumira users receive.

To edit a user's notification settings:

1. Navigate to Settings > Users.
2. Click Edit (pencil icon) in the row with the user's name.
3. Click Edit User Notifications.
4. Verify that the correct information is provided for the user's:
   • Voice number
   • Text number
   • Email address
5. Select the relevant check boxes to turn on Voice, Text, or Email notifications per priority level.
   Tip: Blumira sends voice and text alerts from (313) 349-2586. Save the number as a safe caller/sender in your device so that alerts are not marked as spam.
6. Select or deselect these options:
   • Email me on every new finding comment.
   • Email me when a responder takes initial ownership of a finding.
7. Click Save.

Alternatively, users can open and edit their own Notification Settings from any page within Blumira by clicking the bell icon at the top of any screen.

Deleting users from an organization

As an Administrator or Manager in Blumira, you can delete users from your organization's account.

To remove a user:

1. In the Blumira app, click Settings.
2. Click Users.
3. Click Delete (trash icon) in the row next to the user's name.
4. In the confirmation window, click Delete to remove the user.

Overview

In the MSP Portal, as a Blumira user with an Administrator role in a Blumira NFR account, you can add additional users to the parent account, manage their roles across all accounts, and assign them to customer accounts.

Notes:

• The MSP Portal is only visible to users with Administrator role who are on the MSP parent account. By default, the MSP's NFR account is also the parent account.
• The term "users" in this article refers to the people who log in and utilize the Blumira application. This is not the same as billable users or user count for the customer accounts found in MSP Portal > Accounts.

Adding and updating users in the MSP Portal

The Users section of the MSP Portal provides the ability to add users to your parent and child accounts, and it displays a summary of all the existing users. The user summary table includes the following information:

• Email address for login
• Number of accounts the user has access to
• Assigned Blumira role(s)
  Warning: The roles you assign in the MSP Portal will apply globally by default to all current and future assigned customer accounts. If you need to edit individual account roles, you must edit the user’s role in Settings > Users within the individual customer’s organization. However, the individually assigned role will be overwritten by any bulk change made in the future in MSP Portal, so we recommend using and keeping the same global roles across customer accounts.

Tip: To add multiple users at the same time to your NFR account, download the User Upload Template (CSV), fill it out, and return it to [email protected]. Our team will then import and create all the users in bulk for you.

To add a single user to the MSP organization’s NFR account:

1. 1. Log in to your Blumira NFR account and navigate to MSP Portal > Users.
   2. Click + Add user.
   3. In the Add user window, complete the following fields:
      1. First name
      2. Last name
      3. Email address used for login
         Note: It cannot be edited in the app after saving. This address may not match the email address used for email notifications. Check the user’s notification settings (Settings > Users > User detail > Edit User Notifications) for the alerting email address, which is global per user and cannot be modified per account.
      4. (Optional) Phone number for text alerts
      5. (Optional) Phone number for voice alerts
   4. Under Select roles for this user, click the check box(es) next to the role(s) you want the user to have by default for all customer accounts. The options are Administrator and/or Responder.
      Note: Although additional roles (Manager, Monitor) can be applied in individual accounts, the Administrator and Responder roles provide all the necessary permissions that an MSP user needs to support customers in the app. Learn more in About Blumira roles for MSPs.
   5. Click Next.
   6. Under Select accounts that this user can access, click the check box(es) next to each customer account that you want to add this user to, or use the check box in the top row to add to all existing accounts.
   7. Click Create user.

Updating existing users in MSP Portal

You can update an existing MSP parent account users’ information, the accounts they have access to, and their roles in the MSP Portal.

Important: The changes made in MSP Portal impact all of the child accounts the user is associated with. To make individual changes per organization, follow the steps in Managing users in sub-accounts, which are done in the Settings > Users section of the app instead of the MSP Portal > Users section.

To view and edit a user’s roles across all customer accounts:

1. Navigate to MSP Portal > Users.
2. Click the row of the user you want to edit.
3. On the Accounts tab, under Roles, view the specific roles assigned per customer account.
4. In the User details window, under Details > Select role(s) for this user, check the box next to the role(s) you want to globally apply to the user in all accounts (the parent and all child accounts).
5. Click Save changes.

To edit a user’s details in MSP Portal:

1. 1. Navigate to MSP Portal > Users.
   2. Click the row of the user you want to edit.
   3. In the User details window, click Details and update any of the following:
      • First name
      • Last name
      • (Optional) Phone number for text alerts
      • (Optional) Phone number for voice alerts
   4. Click Save changes.
      
      

To add or remove a user from multiple accounts in MSP Portal:

1. Navigate to MSP Portal > Users.
2. Click the row of the user you want to edit.
3. In the User details window, under Accounts, click the check box next to each account name to either add or remove the user.
   Note: You can click the check box in the top row to select all accounts in the displayed list.
4. Click Save changes.
   
   

Overview

If a customer wants to stop using Blumira and the sub-account needs to be removed from your NFR account, it is important to notify Blumira by email as soon as possible. First, notify Blumira, then complete the steps below as the account administrator to deactivate logging, findings, and scheduled report notifications. 

Notifying Blumira

Determine if the customer plans to stop using Blumira entirely or if they plan to continue to use Blumira on their own or with a different MSP. Including this information in the request helps us to provide continuity of service through the transition period.

Send an email request to [email protected] and CC [email protected].

Important: Always loop in the MSP team ([email protected]) to any conversation where you, as the MSP, or your customer wants to de-provision a Blumira account. Our MSP partners are the administrators and owners of their customers’ sub-accounts, and Blumira requires notification from the account owner prior to performing any changes that impact subscription agreements and billing.

Include these details in the email:

• Provide the name of the sub-account and its current edition.
• Indicate your requested end-of-service date.
• Confirm if the account should remain active but move to a new parent organization in Blumira: 
  • If the request is to move the account onto its own, provide the contact information for the new administrators or users who are taking over the account.
    Note: At least one Blumira Administrator from the customer must be added to the sub-account before it is separated from your MSP parent account.
  • If the request is to move the account to a different MSP, please CC an admin from the incoming MSP and someone from the end client so that we can obtain approval from everyone before the de-parenting and re-parenting are completed.
• Confirm whether or not all customer data can be deleted on or after the end-of-service date, unless the account is moving to a new parent organization.

To provide the above information, you can copy and paste this list below into an email and insert the appropriate answers:

• Organization: <name>

• Current Blumira Edition: <Free, SIEM Pro, SIEM + Endpoint Visibility, etc.>

• End-of-service date: <date>

• Is the account moving? <yes/no/unknown>

• De-provisioning complete? <yes/no>

• Okay to delete all account data? <yes/no>

De-provisioning a customer account

Before we can permanently remove a customer's account, an account Administrator must complete the steps below to help prepare for the appropriate transition. If the customer is canceling and has no plan to continue using Blumira, stop sending logs and alerts before the end-of-service date.

1. Remove all of the customer's sensors:

   1. Navigate to Settings > Sensors > View details.
   2. In each Sensor detail screen, click Remove Sensor.
      
      

2. Remove all of the customer's Cloud Connectors:

   1. Navigate to Settings > Cloud Connectors > Edit Cloud Connector.
   2. Click Remove.
      
      
3. Remove any agent devices:
   1. Navigate to Blumira Agent > Devices > Device details.
   2. Click Remove.
      
      

4. Delete all scheduled reports:

   1. Navigate to Settings > Reporting > Scheduled Reports.
   2. Click next to each report to delete.
      
      
5. Remove all users that do not need access, which also stops all notifications:
   1. Navigate to Settings > Users.
   2. Click next to each user to remove them.

Next steps

A Blumira Support team member confirms the completion of a full de-provisioning and the date that service ends, if appropriate. 

Overview

Executive Summaries provide a high-level view of the security value Blumira is bringing to your organization by visualizing how much data Blumira received and analyzed, how many findings Blumira generated for suspected threats, and how many findings your team resolved.

These summaries are generated by Blumira at the start of each month and quarter, and they include a rolling trend of the previous 12 months of data for your organization. Copies of previous summaries are stored in the app so that you can download those at any time.

You can also optionally configure a recipients list for emailed copies of the reports.

Reference: See Using Executive Summaries for instructions on how to update these settings.

Managing settings for sub-accounts

MSPs can manage the settings for Executive Summaries per account; there are no global or cascading configuration options to bulk change settings for your MSP organization or your sub-accounts. You must configure each account with your desired preferences for each of the following optional settings:

• Content sections to exclude
• Email recipients (none by default)
• Custom logo
• Custom introductory text

Note: No recipients are selected by default for MSP-managed Blumira accounts. You must add recipients to receive the reports in an emailed format. Consider using a distribution list for your organization to centralize the delivery of Executive Summaries instead of selecting user roles. Even if you do not select any recipients, the reports will still be available in the app for you to download each month.

Overview

Blumira Agent helps you to detect and respond to threats on Windows endpoints. See these related articles for details about pricing, installing, and managing Blumira Agent on your Windows endpoints:

• MSP pricing
• Installing Blumira Agent on a remote device
• Managing your Blumira Agent devices

Activating Blumira Agent

If an account is licensed for the SIEM + Endpoint Visibility or XDR Platform editions, Blumira Agent is already activated upon upgrading to those licenses. To activate the Blumira Agent features in Advanced Edition, you must click Activate in the informational card that is displayed on either of the Blumira Agent screens.

Important: By activating the Blumira Agent you are agreeing to be bound by the MSP agreement terms and to be billed according to your agent usage.

Managing agent deployment limits

If you decide to install Blumira Agent on many devices at once, such as with automation, it is important to avoid installing the agent on more devices than the account is licensed to use. Blumira connects only to the number of agents licensed for the account at the time of deployment.

Caution: Using an installation key that is already at its limit will install the agent on your device, but the agent will not connect to Blumira or appear in the app. Installing Blumira Agent on a device that never connects to the app requires additional steps to remove it from the device. See Uninstalling the Blumira Agent service from a device that failed connection.

There are two different values in the app that limit the number of devices on which you can deploy Blumira Agent:

• Maximum Deployable Agents: This is the total number of agent devices that Blumira can connect to, and it directly relates to the licensing terms for the account.
  • This value defaults to 5 for all NFR accounts.
  • In MSP sub-accounts, this value defaults to the number of billable users for the organization as entered in the sub-account details window.
    
  • If your organization requires more agents than the user count of the organization, you can add more from the Installation screen.
    Important: By editing the Maximum Deployable Agents total, you can deploy additional agents at the add-on rate detailed in your contract.
    
    
• Installation Key Device Limit: This is the total number of agent devices that can be deployed using a specific key.
  • This value can be managed in the Installation key details window.
    
  • If only one installation key exists in the account, the device limit is equal to the Maximum Deployable Agents value.
    
    

Verifying usage versus the limit

Administrators can verify in the app how agent deployment for an account compares to its agent limit. 

In Blumira Agent > Installation, two informational cards at the top of the screen display the maximum number of allowed devices next to the number currently deployed. View which devices have successfully connected to Blumira in the Blumira Agent > Devices screen.

Managing an installation key limit

When creating a new key from the Installation page, you are prompted to type a limit for that key. You can edit the value on the installation key detail screen.

When an installation key's device limit is reached:

• The installation script and installation key fields are disabled and can no longer be copied.
• If a key is at its limit and the key has become disabled, tooltips appear to describe why that key is currently not available to view or use.
  
  
  
  
  

Adding new customer accounts

When you are ready to add your first customer, you will need to make a commitment in order to get discounted pricing. Review MSP pricing and How Blumira bills MSPs, decide where you would like to start, and then follow the steps below.  

Reference: See Selling the value of the paid Blumira editions to learn more about what customers gain with paid editions.

To add a customer account to your Blumira NFR account:

1. Email [email protected] or your Partner Specialist to inform them of what your minimum monthly commitment will be. The minimum commitment drives your pricing for all customers under your account. We will send you an order form to e-sign in accordance with your selection.
   Note: Free edition accounts can be added before you sign an order form.
2. Navigate to MSP Portal > Accounts.
3. Click Add New Account.
4. In the Add Account window, complete these steps:
   1. In Name, type the organization name of the customer.
   2. In Web domain, type the customer's website url.
   3. In User count, type the number of billable users.
      Note: A "user" refers to the number of knowledge workers at your organization; basically the number of employees with emails who use them.
   4. Under Edition, select the edition of the app that the customer will use.
   5. Click Next.
   6. Click the check box next to each user (in the MSP organization) who needs access to the customer account.
      Note: Users with the Administrator role in your MSP organization are automatically selected.
   7. Click Save changes.

Tip: To add multiple customers at the same time to Blumira, download the Account Upload Template (CSV), fill it out, and return it to [email protected]. Our team will then import and create all the customer accounts in bulk for you.

If your customer already has a Blumira account and wants you to manage it, please email [email protected] with the following message and CC the customer admin for approval:

• Subject: MSP Parenting Request for <MSP Name>
• Body: <Customer Blumira Account Name> has contracted with <MSP name> for services and would like us to manage their account. Please add them to our MSP Portal as a child account.

Managing customer accounts

You can view and manage the details of your sub-accounts in Accounts (MSP Portal > Accounts). This is also where you can quickly add members of your MSP organization to the sub-account.

To edit your customer’s account information and assigned users:

1. Navigate to MSP Portal > Accounts.
2. In the Accounts table, click the row of the account you want to edit.
3. In the options menu that appears, click Account details.
4. Complete one or more of the following steps:
   1. Under Details:
      1. In Account name, type the name of the customer organization.
      2. In Web domain, type the customer’s domain.
      3. In User count, type the customer’s number of billable users (ie, the number of employees with emails who use them).
      4. Select the appropriate Blumira edition for the account.
      5. Click Save changes.
         
         Important: Updating the edition or the billable user count will result in a change in monthly billing.
      6. Click Confirm.
      7. On the Users tab:
         1. Click the check box next to each user that needs access to the account.
         2. Click Save changes.

You can find the documentation for all Blumira integrations on our customer support site in the Deploying Blumira section. These documents might not contain details that are specific to MSPs. If you have suggestions about how we can improve the instructions that we provide for MSPs, please let us know.

Overview

You can send Blumira's finding notifications and scheduled reports to your professional services automation (PSA) system, such as ConnectWise Manage, Datto Autotask, or N-able.

Tip: See Parsing Blumira findings in ConnectWise Manage for information about how to parse and route tickets based on customer account information.

Before you begin

Most MSPs designate an email address that can be used for creating tickets via email, such as [email protected]. You can continue to use this same email address, but some MSPs prefer to create a separate email address for automated alerts from security tools. If you decide now to use your primary ticketing email address with Blumira, you can change it later.

After you determine which email address to use to receive notifications from Blumira, you must create a notification-only user in your account.

Creating a notification-only user account

To create a notification-only user account:

1. In the Blumira app, navigate to Settings > Users.
2. Click Add New User.
3. In the New user window, in First Name and Last Name, type a name for the user (e.g., ConnectWise Ticketing).
4. In Email, type the email address that you want to use.
5. From the Roles list, select Responder.
6. From the Locations list, select the locations that you want to use.
   Tip: If you have multiple locations, for most cases, you will want to select all locations.
7. Click Add user.

This new user, by default, receives notifications about all Blumira findings, which then appear as new tickets in your PSA tool. If you want to customize the notification settings for this user (i.e., only receive notifications for specific types of findings or priority levels), you can do so in Settings > Users > Edit > Edit User Notifications.

Note: When you create the new user account using your ticketing email address, you will receive a new user welcome email as a ticket. It is not necessary to activate this user account in order to receive notifications. 

Sending scheduled reports to your PSA

You might find it helpful for scheduled reports to be sent directly as a ticket, to notify IT staff of available reports and assign work to the appropriate internal resource. If you wish to do this, as mentioned at the top of this article, first determine what email address you wish to use.

To send scheduled reports to your PSA:

1. In the Blumira app, in the menu on the left, click Reporting.
2. Click Scheduled Reports.
3. In the row for the report that you want to send to a channel, click Edit Report.
4. In the Recipients box, type your PSA ticketing email address.
5. Click Save.

Overview

As an MSP with multiple customers in Blumira, you may want to associate the Blumira finding email notifications to the correct customer in your professional services automation (PSA) ticketing queue. You can leverage the customer name provided in the email subject line to parse and route email notifications. This article explains how ConnectWise Manage allows some parsing of email based on attributes in the subject line.

The subject line of finding email notifications from Blumira is formatted as follows: Finding_Type | Finding_Priority | Finding_Name @ Company_Name.

Reference:

• See Configuring Blumira to send notifications and scheduled reports to a MSP PSA tool to send notifications to ConnectWise Manage.
• See About user notifications for more information about Blumira's finding notifications.

Before you begin

Ensure your customer sub-accounts' names in Blumira match one of the following values in ConnectWise Manage and follow the same naming conventions used in your PSA:

• Company Name, which is also referenced as “Company” in ConnectWise Manage and is typically the properly formatted name of the customer’s company.
• Company ID, which is sometimes known in ConnectWise Manage as “PSA ID” and should not have spaces in it. 

To update an organization name in Blumira:

1. Navigate to MSP Portal > Accounts.

2. In the Accounts table, click the row of the account you want to edit.

3. In the options menu that appears, click Account Settings.

4. In the Account name box, type the name of the customer organization.

5. Click Save changes.

Important: Major name changes, such as when re-branding, require additional manual updates in our systems. When making major name changes in the app, please also inform us in a message by either sending an email to [email protected] or using the Support button below. 

Adding a Parser in ConnectWise Manage

The procedure provided below is limited to parsing only email subject lines.

To add a parser in ConnectWise Manage:

1. Navigate to System > Setup Tables.
2. Search the table for Email Connector.
   Note: If there is more than one Email Connector, select the one that is being used to receive your emailed Blumira finding notifications.
3. Click + at the bottom of the Parsing Rules page.
4. In Email Subject Line Parsing Rule, type {problem} @ {company}.
   
   Note: When using the {company} variable in the parser, ConnectWise Manage will attempt to match against both Company Name and Company ID. If you run into parsing errors, ensure that you do not have two companies with a matching Company Name and Company ID.
5. (Optional) Modify the priority parsing details based on how your service board priorities are configured by adding Service Priority levels to the parsing rule configured above as desired. Example:
   
6. Click Save at the top of the page in ConnectWise Manage.

Testing the parser 

You can wait for your next Finding or you can follow the instructions at Testing Blumira detections to test your parser. 

Alternatively, you can simply send an email to the correct address using the subject format: Finding_Type | Finding_Priority | Finding_Name @ Company_Name. Edit the “Customer_Name” to match an existing customer’s name.

Overview

This article explains the valuable features gained by using the paid editions of Blumira. General information about all of the Blumira editions is provided at blumira.com/pricing.

Note: The MSRP is not the partner cost. See MSP pricing for details about our MSP pricing tiers.

Paid features explained

The table below includes more information about the features gained by using the paid editions of Blumira.

When you are preparing for your next quarterly business review or another executive-level meeting, use Blumira's Executive Summaries to show the value that Blumira is bringing to your customers.

For more details about these monthly and quarterly summaries, see Using Executive Summaries.

For information to share in a sales meeting, you can download the slide deck below in PDF and PPTX format to better understand what customers receive in each Blumira edition:

You can also download the following PDF to provide a quick overview of the features offered in each Blumira edition:

This video provides an overview of Blumira Free:

You can also download this PDF to show your customers what they receive with Blumira Free.

Download the following PDF to read Blumira's 2022 report on the State of Detection & Response:

The following infographic, Critical Security: Logging, Detection & Response is great to leave behind after a meeting:

• completed version
• infographic template to customize with your own logo using a free Canva account

The following are case studies that our partners and customers have shared about how their organizations have benefitted from Blumira:

• MSP:  Path Forward IT – An MSP who uses Blumira for Advanced Threat Detection and Response without the need of an internal SOC
• SLED: Crescent City – A real customer story on how Crescent City, with an internal IT team of 1-person, automates threat response with Blumira – no SOC (security operations center) required.
• SLED: Ottawa County – Ottawa County’s complex infrastructure and busy IT team required an affordable, easy-to-use, automated detection and response solution to reduce manual log reviews required for state and local government compliance regulations.
• SMB: AdvantageCS – Security is important to the AdvantageCS mission to ensure their managed SaaS product isn’t an attack surface for their clients’ data stored in their cloud environment.
• Mid-Sized Healthcare Company – As a fast-growing company with a startup mentality, a mid-sized healthcare company needed a detection and response solution that acted like an extension of their current team. But they were frustrated by the decline in their existing AlienVault service and solution reliability.
• Healthcare: Burcham Hills – Trying to balance IT operations, virtualization and security goals, Burcham Hills needed to bring security in-house and help meet HIPAA and PCI DSS compliance.
• Manufacturing: Duraflame – With limited IT budget and staff, Duraflame needed a secure, reliable, user-friendly, and cost-effective way to protect against internal and external security threats and malware, without the heavy cost of managing a SOC.
• Telecom: TAS United – TAS United needed to secure and support a fully-remote workforce using their personal devices to do their jobs while meeting PCI DSS compliance.
• Construction: Atlantic Constructors – ACI turned to Blumira’s cloud SIEM to help them detect previously unknown threats, following response playbooks written for IT teams to help them remediate threats quickly and easily.
• Oil & Energy: Nittany Oil – Nittany Oil chose Blumira’s platform over other costly vendors to help them gain one year of data retention to meet PCI requirements, as well as providing greater network visibility, prioritized detections and playbooks for faster response.
• Financial Services: Greenleaf Trust – Through Blumira, Greenleaf Trust saw the opportunity to cut through the influx of security notifications. This analysis enables them to prioritize potential vulnerabilities and take action on each one with a click.

Some prospective customers might not know why they might need a SIEM solution, so beginning the sales process might involve educating them about the problem that it solves. You can use the Blumira website's glossary of terms, which includes commonly-asked questions about SIEMs and the value that they provide, to help answer these questions for your customers.

Blumira’s modern security platform helps your organization to easily meet and exceed compliance requirements for logging, monitoring, threat detection and response. The articles linked below explain how Blumira supports your compliance efforts.

Reference: You can find all of these articles at blumira.com/compliance.

Identifying the controls that Blumira helps satisfy

• CMMC/DFARS
• HIPAA
• PCI DSS
• NIST SP 800-53 Security Controls
• NIST 800-171

Additional compliance considerations

• What Tightening Cyber Insurance Requirements Means for MSPs
• Strengthening American Cybersecurity Act: What MSPs Need To Know
• Why You Probably Don’t Need a FedRAMP SIEM

You can use the battlecard below to help share talking points about Blumira, overcome objections, and explain what makes Blumira a superior solution to the competition.

Click the following images to download the full PDF:

You can download the following PDF to review the value of Blumira:

You can use the following one-pager to provide prospective customers a quick overview of the value of Blumira for small and medium businesses.

Click either image below to download the file as a PDF:

You can download this PDF to view a data sheet that describes Blumira's comprehensive security coverage for threat detection.

You can download this PDF to understand how Blumira's detections identify the top MITRE ATT&CK techniques to help you and your customers respond quickly to contain them.

You can access Blumira webinars on our YouTube channel:

You can use the following resources to email customers about Blumira's offerings:

• email template
• PNG image file to attach

You can use the following resources to spread the word on your social channels about Blumira's Free SIEM:

• PDF template to customize or use as-is
• Zip file with images

The Blumira Style Guide (PDF) is a brief overview of the Blumira logos, fonts, colors and secondary colors and more to help you understand how to present the Blumira brand in your marketing and sales materials.

Some partners like to include Blumira's logo in their sales and marketing materials to help highlight Blumira as one of their product offerings.

You can download the following .zip files, which contain Blumira's logos in both PNG and EPS formats:

• logos in PNG format
• logos in EPS format