Managed SIEM

Can the N-central feed be extended to N-Sight , its like the little brother of N-Central but only available as SAAS, no self hosted edition. Then us N-Sight users can get the logs ingested into Huntress

The ZyXel Nebula network ecosystem works a lot like Unifi and Meraki and does seem to support syslog destinations through Configure > Site setting > Reporting > Syslog server. The logs likely look a lot like the competitors, and include logging for APs, switches, security appliances / firewalls, as well as optional traffic logs.

We are trying to set up alerts to detect and alert us when a new app is added with admin permissions. Huntress ITDR alerted on a new eM Client addition but it got us thinking how we can alert us when other apps are added by Admins, just as an additional metric for our team. Our Huntress SIEM ES|QL queries that use DISSECT fail with "Failed to parse query: Pipeline splitting is not enabled" , in both the SIEM portal and the /v1/siem/query API. Please enable pipeline splitting ( DISSECT ) for ES|QL in the SIEM. Use case: a scheduled ITDR query that extracts the Entra application name from itdr.Target.ID on consent and service-principal events. If DISSECT can't be enabled, can EVAL/RENAME be enabled instead? Both currently return server errors. Current Query that work, but does not provide the App name as its own column. Though it is visible in the itdr.Target.ID field, it is surrounded by other not useful data. FROM logs | WHERE event.provider == "ITDR" AND itdr.Operation IN ("Consent to application.","Add delegated permission grant.","Add app role assignment to service principal.","Add service principal credentials.") | KEEP @timestamp, itdr.Operation, itdr.UserId, itdr.Target.ID, itdr.ObjectId

MCP (Model Context Protocol) adoption is rapidly expanding from interactive LLM sessions to autonomous agents and service accounts performing actions across security, infrastructure, SaaS, and customer environments. These workflows generate valuable audit telemetry, but there is currently no standardized way to ingest, interpret, and detect threats in MCP activity within Huntress SIEM. Desired Outcome Deliver a vendor-neutral approach for ingesting and interpreting MCP audit logs so Huntress can: Identify activity outside an entity’s authorized scope (users, agents, service accounts) Correlate MCP activity with the broader threat landscape (identity, endpoint, cloud, network) Enable actionable detections and automated response for suspicious or unauthorized behavior Key requirements: Normalized schema for MCP audit events Actor identification (user, autonomous agent, service account) MCP server/gateway/session/tool/target-platform context Source and target tenant/customer context for multi-tenant environments Requested action, privilege level, data sensitivity, execution result Authorization and RBAC context (allowed tools/actions) Support for successful, denied, and attempted activity—not just completed actions S3-based ingestion, with the ability for partners to normalize data into a Huntress-defined format

Proofpoint announced in their most recent webinar that they are working on an API to support SIEM reporting. They stated that it would be available as of July 2025. https://us2.proofpointessentials.com/api/v1/docs/index.php

As a cloud LDAPS, RADIUS, and SSO Identity Provider having authentication logs is important to us as an MSP & our clients that use the platform. https://jumpcloud.com/support/directory-insights-api

Peplink firewalls

Would be great to collect logs from NAS appliances. I have both Synology and QNAP NAS systems at client sites and the logs would help get insight into authentication and access attempts as well as things like the built-in AV logs on those devices.

Omada has the remote logging capabilities very similar to the existing UniFi integration.

I want to create a custom alert/escalation based on SIEM queries, e.g, using SIEM queries to create an alert/escalation when specific accounts are logged into, without using the scheduled reports