Managed SIEM

Can SIEM also look at FIM

It would be really good to have SIEM able to ingest logs from RMM solutions to help monitor and secure the usage of our RMM tools. This would be taking the logs of engineers and internal staff usage, and co-managed resources within the RMM tool and identifying things like source login location, and actions within the tool - bulk changes, deletions, script changes, deployment of large jobs, creation of scripts and deployment within a short timeframe etc, anything that could be deemed as unusual / unsafe behaviour. We're on Datto RMM so would like that to be first cab off the rank

If a server is configured as DNS server ingest the logs for the service. This is listed in CIS v8.1, Safeguard 8.6.

Would be great to not require a windows device to be a log collector for clients that have no onprem servers anymore but would still like network device logs etc collected. Even via a Raspberry Pi or similar so less investment than a NUC.

Would be great to collect logs from NAS appliances. I have both Synology and QNAP NAS systems at client sites and the logs would help get insight into authentication and access attempts as well as things like the built-in AV logs on those devices.

Some clients have a need for 12+ months (see Office of Comptroller of Currency https://www.occ.treas.gov/ ).

If one of the Enabled Syslog Agents(ie: syslog listener) stops sending data for an extended period(ideally configurable), there should be an alert that is generated to have someone investigate.

It would be really good to have SIEM able to ingest logs from MSP documentation platforms to help monitor and secure the usage. This would be taking the logs of engineers and internal staff usage, and co-managed resources within the RMM tool and identifying things like source login location, and actions within the tool - bulk changes, deletions, rapid password access etc. anything that could be deemed as unusual / unsafe behaviour. We're on IT Glue so would like that to be first cab off the rank

Ingest access logs from things like Screenconnect, Kaseya, Nable, Auvik, Datto RMM etc etc that MSP's use to admin their clients.

It would be nice if you could create custom alerts for the SIEM. Basically create a query and if something meets the criteria send a alert. A few things that you would probably want for this feature: I don't think these alerts should go to SOC. As otherwise the SOC might get overwhelmed by custom alerts. Allow the custom alert to have a threshold before activated. For example set a threshold of 50 failed logins on user bob2 before triggering. While the alerts should not go directly to the SOC it probably would be helpful if visible to the SOC if something does happen.