MCP or API for SIEM
closed
E
Evgeny Popkov
Currently SIEM is lacking a major capability - we can only query SIEM data via UI. This is a huge disadvantage and a shame, given how much data is stored there.
Customers can benefit hugely from programmatic SIEM querying capability - either API or MCP will drastically increase the value of this product and most importantly - help accelerate and automate investigations!
M
Michael Vincent
updated the status to
closed
SIEM Query API is available:
https://api.huntress.io/docs#rest-api/tag/siem/POST/v1/siem/query
E
Evgeny Popkov
Excellent, this works. I'll play around with it to find out the limitations, but so far I'm happy we can query SIEM via API!
M
Michael Vincent
There is currently an API available to run SIEM queries:
Does this API meet your needs?
J
Jerome Cousineau
I need recurring reports for certain queries, for visibility. The existing ES|QL implementation is lacking many useful commands, making it pretty useless. I would replace the existing Manage Queries > "Schedule this query" feature with my own query management tool via API, if there was an API available.