SIEM Canned Queries | Voters

SIEM Canned Queries

planned

Gerald Mante

It would be nice if we can have an "easy button" for searching for specific common / interesting events. One example may be "failed logins" or "RDP Session Logins" with the option to modify the query to expand or scope it (Machine name etc).

April 16, 2024

James Stull

I lik the idea of canned queries, but even better is if we had a community share of queries for all huntress clients. Then we can share various queries with eachother.

Chris Bisnett

marked this post as

planned

We added a few example queries to the dashboard last week, but we're going to expand upon this to give some common queries for things like you pointed out as well as providing some additional examples within the dashboard to make it easy to find what you're looking for without needing to memorize the ES|QL syntax.