Managed SIEM

It would be nice to have the ability to submit SIEM logs to the SOC for review in the event it was missed by AI or Human the first time.

Using the information that comes from the /logs/sources/smart_filter_stats page, allowing someone to export as a useable format (CSV, JSON, etc) to understand what isn't being stored - good for compliance

I currenty utilize a SIEM tool that I really like as it gives me the functionality to go hunt myself. but there are also dashboards that are premade that report on things such as Executive Dashboard: Top Browsing Categories Remote Access Tool Usage RDP Avvess by User Windows account creation Windows account Lockouts O365 Logon activity by user and location SPAM Recipients Account Lockouts Top Alert Generating Accounts Security Dashboard Alerts by Host Top Blocked Domains Top 10 DNS Hostnames Mitre Attack Tactics Top Web Proxy Categories Interactive logons Off hours Alternate credential logins ( ex.Run as) Interactive Logins Top O365 Security Evensts Its easy to look at and then if i want i can drill into it as well I would love to see this with the SIEM tool

I would like to have additional headers such as source name, source IP, and username included in the SIEM dashboard. Currently, the headers available are limited to Timestamp, Details, Organization, event.provider, event.code, and message. Adding these headers would enhance the usability and provide more detailed insights.

I would like to see the SIEM receive its own reporting management. Example from logs | where event.code == 4625 From previous 7-days Email to blah@blah.com It could be as simple as just a PDF with all the events in which you can click on the view to login then view the event.

Hyperlink to source to view all logs from said source, and also sort by source or any column.

Want to add an And or an OR search to SIEM ability to the elastic search query

The monthly/quarterly reports show metrics about how much data is collected by SIEM and how many resulted in incidents, but it would be nice to also see this from the perspective of the "top" sources or users generating signals/incidents.

would be great to have some precanned queries and reports to run for Fortigate firewall events in dashboard , similar to ones for SonicWall l

Need visualize the data in various format like chart, bar, pic etc