Managed SIEM

It would be nice if we can have an "easy button" for searching for specific common / interesting events. One example may be "failed logins" or "RDP Session Logins" with the option to modify the query to expand or scope it (Machine name etc).

If a Windows server is configured as a DHCP server ingest the DHCP logs. This is listed in CIS v8.1, Safeguard 1.4

Would love to see SIEM reports similar to the EDR reports we currently get. Could either be added to the current EDR reports or separate.

If a server is configured as DNS server ingest the logs for the service. This is listed in CIS v8.1, Safeguard 8.6.

Sometimes I want to be able to export data to a csv if there is a lot of data I have to look over. Allowing exporting all data of a query search would be helpful with this.

Would be good if there was a way to store a custom query we make for quick reference back to. E.G if we are monitoring the same event type for a particular user, instead of having to type of the ES|QL command each time, being able to load a stored custom query or a dropdown list of showing the history of previously ran queries to refer back on.

When you select SIEM and it shows the logs, the columns show TimeStamp, Organization, Agent, Event Provider, Event code and Message. If we could add a user account to that view that shows which user it is, that would be extremely helpful to see user accounts in the initial view.

I think it would be great if we have the ability to specify / override the default syslog port (514). In environments with multiple syslog servers running on a device, it would great to be able to allow Huntress to consume syslogs without disrupting existing services. Thanks

It would be very nice to have alerts based on location alerts. Allow the admins to set their boundaries or even based off which NinjaOne location they are based for alerting, review, and even escalation to SOC. A good example I am based out of the USA and one of our M365 accounts starts logging in from Brazil, then an endpoint is showing activity from China. It would be nice to have this tracked and shown in a map along with all the alerting, review, and notification that could be provided.

I know this was mentioned in our introduction to the SIEM, but a way to at least sort out the organizations from each other, even just being able to filter so the organization we want to look for is on top. It's a little difficult to sift through logs while seeing logs from other companies splattered in.