Managed SIEM

Ingest logs from Ubiquiti and Unifi

Currently all fields ingested as strings. Standard syslog fields (ie pri and facility) should be formatted as integers to allow for queries like where sonicwall.pri < 5 to search for syslogs with a severity of warning and above.

Import logs from DNS Filter and alert of repeating request for bad actor domains from an agent.

Able to monitor who accesses what in Keeper Password Manager

Currently can only be enabled at a Global level then overridden individually. Need to be able to enable for a small number of clients for testing before rolling out to all of them.

pfSense is a very popular firewall.

Ability to ingest from FortiGate firewalls

Add the ability to exclude a computer from log collection (mainly if consumption based). Though this would depend if you plan on using the Huntress agent or if you plan to eventually separate the SIEM into its own program. As if it is the latter it would be simple as just not installing the SIEM component.

It would be fantastic if Huntress was a full SIEM/SOAR solution, were we could collect event logs, syslogs, etc and the SOC be able to take action or help us resolve incidents. It would also be handy for us for more visibility. Such as which websites a user visited, what files they edited, etc.

With the SIEM, I would really like to see the ability to injest logs from syslog sources and from various devices. Such as Ubiquiti, pfSense, fortigate, and other firewalls/switches. Also other devices would be good such as printers and IoT devices. While these can generate a lot of noise, if we know how to best configure we can filter the noise out prior to shipping them to you.