Managed SIEM

If one of the Enabled Syslog Agents(ie: syslog listener) stops sending data for an extended period(ideally configurable), there should be an alert that is generated to have someone investigate.

Would love to see SIEM reports similar to the EDR reports we currently get. Could either be added to the current EDR reports or separate.

It would be nice to have the ability to submit SIEM logs to the SOC for review in the event it was missed by AI or Human the first time.

I need to be able to create a list of devices that are sending event logs and a way to view how much traffic those devices are sending. I would really like to be able to create a list of what SHOULD be reporting and alert when something is not. Firewalls mostly.

I would like to see the SIEM receive its own reporting management. Example from logs | where event.code == 4625 From previous 7-days Email to blah@blah.com It could be as simple as just a PDF with all the events in which you can click on the view to login then view the event.

I currenty utilize a SIEM tool that I really like as it gives me the functionality to go hunt myself. but there are also dashboards that are premade that report on things such as Executive Dashboard: Top Browsing Categories Remote Access Tool Usage RDP Avvess by User Windows account creation Windows account Lockouts O365 Logon activity by user and location SPAM Recipients Account Lockouts Top Alert Generating Accounts Security Dashboard Alerts by Host Top Blocked Domains Top 10 DNS Hostnames Mitre Attack Tactics Top Web Proxy Categories Interactive logons Off hours Alternate credential logins ( ex.Run as) Interactive Logins Top O365 Security Evensts Its easy to look at and then if i want i can drill into it as well I would love to see this with the SIEM tool

Want to add an And or an OR search to SIEM ability to the elastic search query

Need visualize the data in various format like chart, bar, pic etc