Send SIEM syslogs directly into the Huntress portal | Voters

Send SIEM syslogs directly into the Huntress portal

Dan Sheather

We would like to be able to send SIEM syslog data directly from the firewall into the Huntress portal rather than relaying through an agent on the network.

December 5, 2024

Nate O'Brien

Hi Dan Sheather and all, we would likely only be able to support this for firewalls with the ability to TLS encrypt the syslog messages, otherwise the firewalls would be sending sensitive cleartext messages across the internet. Would that be a viable solution for you? I know not all firewalls support TLS over TCP syslog unfortunately. The only alternative would be API integrations.

Mason Schmitt

Hi Nate O'Brien, we currently use rsyslog which supports TLS.

Robert Quick

This would be great. If the current agent goes off line, we lose the logs.

Jacob Wiley

This would be very much appreciated!

Samuel Williams

Absolutely need this. We have a weird use case where we have a customer that has another MSP and have Huntress through them. They have us monitoring and managing their firewalls alone. There is no spare machine we could park an agent on to act like a syslog collector. Being able to point those logs directly at Huntress would be the exact solution to our problem.