C
Chris Ba
Connect Perception Point alerting to Huntress SIEM please.
There is already a round-about way to get SentinelOne detections of malicious files to go into Perception Point and Huntress through other connections, however, Perception Point also has alerting for "Possible Account Takeover (ATO)" that could provide signaling to Huntress for additional possibilities of detection.
Many of the same detections that Perception Point uses are included in Huntress' signals (new Browser/OS, new subnet, mail rules created, etc), but the Perception Point connector could add additional signals that might not be initially seen by the Huntress <> ITDR connector.
As an example of how it could feed Huntress more directly/quickly, would be similar to the Perception Point <> SentinelOne connection:
For each malicious file that FortiMail Workspace Security was informed about by SentinelOne, FortiMail Workspace Security creates a note in the Incidents > Threats page in SentinelOne.
This is similar but different to the request at Perception Point