Chris Bisnett different vendors do or do not retain to same degree. Having a single trusted vendor to warehouse these, possibly on different terms (from customer SIEM, pricing wise), would be a huge boon to us just for compliance reasons. DattoRMM was, im pretty sure, infinite technician activity retention when we onboarded years ago. Its 6m rolling now. I trust my staff, but... thats not going to mean much if we end up with an insider threat situation and i dont have vis of their entire history.

Expanding: I'm not even sure you can get DattoRMM activity logs via API. But if you give me a means to manually ingest, dedup the duplicates that come from that, and raise alerts.if we are behind by X on manual submit? Ill pay for that even if you dont threat hunt against it.

Chris Bisnett The biggest thing for me is to be able to investigate if/when the RMM gets owned in a quick and easy manner. A lot of that is up to the RMM vendor actually giving access to that data via API but if it is available, it would be great to have the SIEM be able to ingest that and possibly alert on anything malicious. If that makes sense.