NinjaOne (MSP) connection to Huntress SIEM does not split by company
C
Chris Bareham
Please make the NinjaOne connection more like the SentinelOne connection.
While connecting NinjaOne to the SIEM, we were not able to split the data coming in by the Organization as built in NinjaOne. The events being ingested by the SIEM show the NinjaOne Organization, but all of the data can only be sent to a single Huntress Organization.
SentinelOne allows for a single API key to be created. This only has to be connected one time in Huntress, then any organization current or future, will show as an Unmapped Organization. This capability is not available for NinjaOne, but it needs to be! Please.
A
Anthony Kolka
I have just been investigating this myself. The current options I have are to set up a middleware that routes webhook requests by org ID, or come here and recommend a MSP feature where we can set the web hook at the MSP level and then just have a RMM org ID mapping for client orgs. Of course Ninja RMM could have a better webhook system as well, but here we are.
C
Chris Bareham
Anthony, yes it seems like it would be an easy fix since the logs show the NinjaOne organization name -- a simple mapping of the NinjaOne org name --> Huntress org names seems like an easy win, but maybe there is more under the hood that doesn't make it feasible. Right now the workaround solution I am using is to just use a filter in the SIEM with the NinjaOne org name
from logs | WHERE ninja_one.device.references.organization.name == <CustomerNinjaOrgName>
K
Kenny Maurer
I think I saw that somewhere on the roadmap