Managed SIEM

Ingest powershell data for auditing and detection purposes. Malicious PowerShell scripts are commonly used by threat actors to run silent actions in the background.

Hello Huntress team, We’ve identified an issue that exposed a visibility gap in Syslog source monitoring. In one customer organization, Syslog sources suddenly disappeared. Huntress now shows 0 Syslog sources, even though multiple devices are still configured to send logs to a specific agent. We’re currently debugging the cause. This only affected a single organization; others are working as expected. As a result, we realized there’s no clear way to detect when a Syslog source that was previously sending logs regularly stops doing so. It would be extremely valuable to have: An alert or warning when a previously active source becomes silent This would help detect ingestion failures early and avoid blind spots in SIEM data.

Collect, parse, and store logs from Azure, AWS, and Google Workspace

I understand that internal Syslog collection is supported, but external Syslog collection is not yet available. It would be advantageous to have support for external Syslog collection to broaden the scope of log sources that can be integrated into Huntress SIEM.

Track PowerShell modules and scripts to identify anomalous/malicious activity

Ingest all CW ScreenConnect server logs to Huntress SIEM

Ingest all CW RMM logs to Huntress SIEM

I am interested in deploying a Linux agent to collect SIEM logs. It would be beneficial if this feature could be included when Linux support for EDR is rolled out, as it would streamline the process of managing logs across different operating systems.

Support full log collection for both MacOS and Linux systems to be able to have a Customers entire infrastructure able to be covered with Managed SIEM.

Ingest logs from Check Point Harmony Email & Collaboration