Managed SIEM

We would like to be able to send SIEM syslog data directly from the firewall into the Huntress portal rather than relaying through an agent on the network.

Bitwarden is a popular password manager and is used in both hosted/cloud and self-hosted setups. They publish event logs via a very well documented API. Would love to see Huntress support this for ingest. PLEASE support custom URLs for self-hosted and not just cloud hosted. https://bitwarden.com/help/public-api/ https://bitwarden.com/help/event-logs/

If one of the Enabled Syslog Agents(ie: syslog listener) stops sending data for an extended period(ideally configurable), there should be an alert that is generated to have someone investigate.

Ingest powershell data for auditing and detection purposes. Malicious PowerShell scripts are commonly used by threat actors to run silent actions in the background.

Would love to see SIEM reports similar to the EDR reports we currently get. Could either be added to the current EDR reports or separate.

Ingest access logs from things like Screenconnect, Kaseya, Nable, Auvik, Datto RMM etc etc that MSP's use to admin their clients.

It would be helpful if the SEIM agent on Windows ingested logs relating to App Control and App Locker. These are located in Applications and Services logs - Microsoft - Windows - CodeIntegrity and Applications and Services logs - Microsoft - Windows - AppLocker A more generalized version of this request is for us to be able to create templates or otherwise control which of the many Windows event logs we want to capture on a per-client basis.

In line with requests for other password managers we have clients that use this. Ingesting and alerting on these being exploited would be good news.

Barracuda Cloudgen firewalls, Barracuda Email Protection, Barracuda Identity Protection, Barracuda Cloud to Cloud Backup

If a server is configured as DNS server ingest the logs for the service. This is listed in CIS v8.1, Safeguard 8.6.