API to Expose list of Active SIEM Sources on a per client basis.
E
Eric MacDonald
We would appreciate having the ability to tell from the organization level which SIEM Sources are configured (And receiving logs) for each client so that we can build internal tooling around finding clients who are missing eligible sources and also monitoring to alarm if the logs per source count fall to 0.
I could see this being a new component of the existing organizations list endpoint or a new subpoint for SIEM sources.
C
Christo Pretorius
We really need this for accurate billing on our agreements so would really appreciate this being actioned.
P
Phil Steel (Elite Business Systems)
This endpoint is very important for how we bill customers. We need to be able to isolate the count of Windows Event Logs from the count of other SIEM sources at the client level so that we can bill them accordingly. Without this it is causing a large amount of manual administrative headache for our team.
C
Chris Nolan
We have a few clients where we manually enable SIEM on a handful of agents - DCs, for example (not ideal, but its the best we can do). This would be really helpful for us to be able to detect when a new DC is created, or a new client is onboarded, and SIEM hasn't been turned on by our team yet.