Managed SIEM

It would be great to have SIEM log failure alerting separate for Endpoints (event logs) and network equipment/other connectors. Use case: I'd like to know if a sonicwall stops sending logs to a syslog connector within 4 hours of failure, but don't want to be alerted if a workstation is offline and not sending logs. It would be great to have separately controlled thresholds/per source with a default for that type of source available as well.

I want to create a custom alert/escalation based on SIEM queries, e.g, using SIEM queries to create an alert/escalation when specific accounts are logged into, without using the scheduled reports

Support for additional commands like SORT, STATS, and COUNT. These are part of the ES|QL documentation and will allow us to create queries such as failed login count by IP address or username.

Hi Team, Are there any plans to support SIEM with Checkpoint?

It would be nice if there were an option to create an alert for successful and/or attempted logins for specified admin account(s).

We have multiple firewalls sending syslogs to different servers to allow for the agents on those servers to forward the logs to the SIEM. The source is always the name of the server, not the name or brand name of the firewalls. It would be nice if we could change the names of the source type and agent for them so they are easier to find.

Current behavior of scheduling certain queries as an export/email would be helpful to be able to run monthly. Not just the max 7 day interval with the current version of the schedule query options. Can 30 days be added as an interval?

Rather than through email, I would love to see SIEM offline source escalations going to PSA. Everything we do is out of PSA and the email escalations are just not clean.

N-Central is able to export user (technician) event to syslog since version 2024.3 with a further expanded list of events added in version 2024.6 at the end of 2024. It would be great if we could export that to Huntress SIEM directly. Especially useful for N-Central servers that are not on premise (i.e. no nearby Windows Agent). The upcoming Linux agent will mostly solve this however direct export to Huntress would remove the extra server requirement.

It would be really good to have SIEM able to ingest logs from Microsoft SQL Server to help monitor and secure the usage of our SQL Databases.