MCP or API for SIEM | Voters

MCP or API for SIEM

Evgeny Popkov

Currently SIEM is lacking a major capability - we can only query SIEM data via UI. This is a huge disadvantage and a shame, given how much data is stored there.

Customers can benefit hugely from programmatic SIEM querying capability - either API or MCP will drastically increase the value of this product and most importantly - help accelerate and automate investigations!

2 days ago

Evgeny Popkov

Excellent, this works. I'll play around with it to find out the limitations, but so far I'm happy we can query SIEM via API!

Michael Vincent

There is currently an API available to run SIEM queries:
https://api.huntress.io/docs#rest-api/tag/siem/POST/v1/siem/query
Does this API meet your needs?

Jerome Cousineau

I need recurring reports for certain queries, for visibility. The existing ES|QL implementation is lacking many useful commands, making it pretty useless. I would replace the existing Manage Queries > "Schedule this query" feature with my own query management tool via API, if there was an API available.