Alert on Firewall Logs and Detections
J
Jacob Boston
Currently, Huntress does not alert on firewall logging or firewall detections. It would be beneficial to have alerts for these logs to enhance security monitoring and response capabilities. Implementing this feature would provide more proactive threat detection and allow for quicker responses to potential security incidents.
Autopilot
Merged in a post:
Firewall Alerting
S
Skylar Pervaza
There should be a way to configure alerting for ingested firewall logs. We can connect the firewalls via syslog ingestion, but it feels like that data isn't being utilized to its fullest potential. There should be options to configure alerting based on activity. Some good prebuilt alerts would be common items like firewall admin creations, deletions, changes and similar activities that pose a high threat if the actions are not legitimate.
S
Skylar Pervaza
Agreed, we are ingesting the logs with Huntress, but it feels like the implementation is incomplete. There is no way to configure alerting for vital events like admin accounts created, etc. Please implement this feature.