Managed SIEM

Currently the deployment of windows event ingest agents feels clunky and slow unless an entire organization is targeted, we'd like the ability to easily add agents in bulk without having to mass select an organization. The current override onboarding achieves this albeit slowly and individually, the primary reason is device role targeting, e.g. servers vs desktops. We'd also like a means to onboard the agent via CLI so we can automate its onboard process, we are restricted to the override function and it must be manually maintained currently which is prone to human error.

Hypervisor (and upstream management like vCenter) log storage is required by our compliance auditors. Managed SIEM is ingesting our logs under 'Syslog-Generic' which accomplishes the "keep these for later cause you have to and just-in-case". I have to believe that, much like firewall log data, parsing out the data to fields usable in ES|QL will be a benefit for threat hunting / alerting and for retrospective investigations.

Would be great to collect logs from NAS appliances. I have both Synology and QNAP NAS systems at client sites and the logs would help get insight into authentication and access attempts as well as things like the built-in AV logs on those devices.

We should support the collection of AUL Logs on MacOS as it is the equivalent of Windows WEL logs. See the request below for flat file collection on Linux and MacOS: https://feedback.huntress.com/siem/p/adding-log-collection-for-macos-and-linux

We have the majority of our customers with Draytek routers, and currently there is no direct data parsing.. I appreciate we can use the Syslog Local option but there would be additional value by having direct parsing capability. It would be great if you could create pre-defeined search strings failed login attempts for VPN access. Logon/Logoff activity for the management interface and any firewall changes.