Current Huntress modules like Managed AV etc can be turned off at the MSP level, and turned on at the organization level, or vise versa. With SIEM you can turn it on at the top level, but to disable it you have to create an exclusion. While this provides the function, it would be easier to turn it off at the top level and turn it on for customers that opt in. Having the same behavior across the platform would be simpler as well.